<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
ok i have it (almost) working<br>
<br>
vpn server ipsec.conf (running strongswan 5.2)<br>
<br>
config setup <br>
# uniqueids=never<br>
charondebug="cfg 2, dmn 2, ike 2, net 2"<br>
<br>
conn %default<br>
keyexchange=ikev2<br>
dpdaction=clear<br>
dpddelay=300s<br>
rekey=no<br>
left=%any<br>
leftsubnet=0.0.0.0/0<br>
leftcert=serverHostCert.pem<br>
right=%any<br>
rightdns=8.8.8.8<br>
rightsourceip=192.168.126.3/24<br>
type=tunnel<br>
#rightsubnet=192.168.126.0/24<br>
forceencaps=yes<br>
<br>
conn nexus5<br>
keyexchange=ikev1<br>
# forceencaps=yes<br>
rightauth=pubkey<br>
rightauth2=xauth<br>
auto=add<br>
rightsourceip=192.168.126.5<br>
(many more like this one, all of them android phones)<br>
<br>
conn <laptop><br>
keyexchange=ikev2<br>
auto=add<br>
#leftsubnet=192.168.126.0/24<br>
#rightsourceip=192.168.126.4<br>
<br>
conn <workstation><br>
keyexchange=ikev2<br>
auto=add<br>
leftsubnet=192.168.126.0/24<br>
<br>
<br>
the only thing i cannot get it to work is to be able to ssh from
<laptop> to <workstation><br>
<br>
i don't understand how i could do it as ip assigned to
<laptop> and <workstation> have /32 netmask<br>
also i run many VMs on <laptop> which i would like to be able
to route into the vpn but is not possible as i don't get any route<br>
<br>
i can reach the network behind the vpn server, 192.168.125.1 that's
good<br>
<br>
output from <workstation><br>
<br>
$ ip r<br>
default via 172.17.0.1 dev eth0 <br>
172.17.0.0/21 dev eth0 proto kernel scope link src 172.17.1.163 <br>
192.168.122.0/24 dev prov0 proto kernel scope link src
192.168.122.1 <br>
192.168.255.0/24 dev br0 proto kernel scope link src
192.168.255.1 <br>
<br>
$ ip -4 a <br>
<br>
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc
pfifo_fast state UP group default qlen 1000<br>
inet 172.17.1.163/21 brd 172.17.7.255 scope global eth0<br>
valid_lft forever preferred_lft forever<br>
<b>inet 192.168.126.4/32 scope global eth0</b><br>
valid_lft forever preferred_lft forever<br>
<br>
<br>
<br>
ipsec.conf on <workstation> (running strongswan 5.2)<br>
<br>
config setup<br>
nat_traversal = yes<br>
charonstart=no<br>
<br>
conn sample-with-ca-cert<br>
leftsourceip=%config<br>
rightsubnet=192.168.125.0/24<br>
leftcert=workstationCert.pem<br>
leftid=workstation<br>
right=vpn-server-ip<br>
rightid="C=AR, O=strongSwan, CN=vpn-server-FQDN"<br>
auto=start<br>
leftfirewall = yes <br>
<br>
<br>
i feel like i'm missing something obvious but i cannot get an answer
googling for it<br>
any pointer will be appreciated<br>
<br>
thanks<br>
<br>
<br>
<div class="moz-cite-prefix">On 10/14/2014 03:40 PM, Martin Willi
wrote:<br>
</div>
<blockquote cite="mid:1413272446.3171.8.camel@martin" type="cite">
<pre wrap="">Hi,
</pre>
<blockquote type="cite">
<pre wrap="">i want to know if strongswan running on a linux server can support this
clients.
- android phones using native client, and configured as ipsec rsa xauth
(x509+Xauth), all traffic should be routed over the vpn
- mikrokit router, configured as ipsec rsa, behind a dynamic ip but not
nat (adsl), not all traffic should be routed over vpn.
router will nat is clients into the vpn
- remote workstation running linux behind nat, not all traffic should be
routed over vpn, but it should allow connections from other vpn client
- laptop running linux, most of the time behind nat, it may or may not
need to route all the traffic over vpn, it needs to be able to connect
to the remote workstation over the vpn
</pre>
</blockquote>
<pre wrap="">
That should be doable, yes. Obviously you'll need multiple connection
definitions in your ipsec.conf, most likely one for each of these
clients.
The tricky part is probably to assign the correct connection definition
to each connecting client. I assume the first two use IKEv1? Then you
can distinguish them by the authentication method. For the latter two
I'd recommend to use IKEv2 (and strongSwan clients?), but not sure what
your "other vpn client" supports. If required you can used different
leftids on your responder with IKEv2, and then select the correct
configuration based on the proposed responder identity. Alternatively
you may select the configuration based on the client identity or its IP
address; this highly depends on your client capabilities.
Whether to "route all traffic over VPN" depends on your leftsubnet
configuration; you may also dynamically allow clients to propose what to
tunnel by using traffic selector narrowing.
</pre>
<blockquote type="cite">
<pre wrap="">i want to know if strongswan can do all this for me running on a single
server, on a single instance with a single pool of ip
</pre>
</blockquote>
<pre wrap="">
Sharing an in-memory virtual IP pool is straightforward since 5.0.1;
just define the same rightsourceip pool subnet to share it across
multiple connections.
Regards
Martin
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
1AE0 322E B8F7 4717 BDEA BF1D 44BB 1BA7 9F6C 6333</pre>
</body>
</html>