<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body dir="auto">
<div style="-webkit-text-size-adjust: auto;">Hello Fred </div>
<div style="-webkit-text-size-adjust: auto;"><br>
</div>
<div><span style="-webkit-text-size-adjust: auto;">The connections works. I have forgot the cacert. But i become no Internet connections pls help. </span></div>
<div><span style="-webkit-text-size-adjust: auto;"><br>
</span></div>
<div><span style="-webkit-text-size-adjust: auto;"><br>
</span><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);">German:<br>
Hallo,<br>
ich kann mich mit meinen clients verbinden, jedoch habe ich dann direkt kein internetzugriff mehr. Ich hab leider keine logs da dies bei mir irgendwie nicht funktioniert. Ich weis nicht warum keine log dateien angelegt werden. <br>
Ubuntu LTS <br>
Strongswan 5.1.2<br>
Root Server Hetzner<br>
<br>
Meine Configs: <br>
<br>
English:<br>
<span id="result_box" lang="en"><span class="hps">Hello,</span><br>
<span class="hps">I can connect</span> <span class="hps">with my</span> <span class="hps">clients</span>, <span class="hps">but I have</span><span class="hps">no</span> <span class="hps">internet</span> <span class="hps">access</span> <span class="hps">then</span> <span class="hps">directly</span> <span class="hps">more</span>.<span class="hps">Unfortunately</span> <span class="hps">I
do not have</span> <span class="hps">logs</span> <span class="hps">as this</span><span class="hps">somehow</span> <span class="hps">does not work for</span> <span class="hps">me.</span> <span class="hps">I do not know</span> <span class="hps">why no</span> <span class="hps">log</span> <span class="hps">files</span> <span class="hps">are
created.</span><br>
<span class="hps">Ubuntu</span> <span class="hps">LTS</span><br>
<span class="hps">strongswan</span> <span class="hps">5.1.2</span><br>
<span class="hps">Root servers</span> <span class="hps">Hetzner<br>
under my cmd(ipconfig) the gateway from the VPN connection is 0.0.0.0 it´s wrong ? <br>
</span> <br>
<span class="hps">My</span> <span class="hps">configs</span>:</span><br>
<font>ipsec.conf</font><font><br>
</font><font>config setup</font><font><br>
</font><font> # uniqueids=never</font><font><br>
</font><font> charondebug="cfg 2, dmn 2, ike 2, net 2"</font><font><br>
</font><font><br>
</font><font>conn %default</font><font><br>
</font><font> keyexchange=ikev2</font><font><br>
</font><font> ike=aes128-sha256-ecp256,aes256-sha384-ecp384,aes128-sha256-modp2048,aes128-sha1-modp2048,aes256-sha384-modp4096,aes256-sha256-modp4096,aes256-sha1-modp4096,aes128-sha256-modp1536,aes128-sha1-modp1536,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha1-modp2048,aes128-sha256-modp1024,aes128-sha1-modp1024,aes256-sha384-modp1536,aes256-sha256-modp1536,aes256-sha1-modp1536,aes256-sha384-modp1024,aes256-sha256-modp1024,aes256-sha1-modp1024!</font><font><br>
</font><font> esp=aes128gcm16-ecp256,aes256gcm16-ecp384,aes128-sha256-ecp256,aes256-sha384-ecp384,aes128-sha256-modp2048,aes128-sha1-modp2048,aes256-sha384-modp4096,aes256-sha256-modp4096,aes256-sha1-modp4096,aes128-sha256-modp1536,aes128-sha1-modp1536,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha1-modp2048,aes128-sha256-modp1024,aes128-sha1-modp1024,aes256-sha384-modp1536,aes256-sha256-modp1536,aes256-sha1-modp1536,aes256-sha384-modp1024,aes256-sha256-modp1024,aes256-sha1-modp1024,aes128gcm16,aes256gcm16,aes128-sha256,aes128-sha1,aes256-sha384,aes256-sha256,aes256-sha1!</font><font><br>
</font><font> dpdaction=clear</font><font><br>
</font><font> dpddelay=300s</font><font><br>
</font><font> rekey=no</font><font><br>
</font><font> left=%any</font><font><br>
</font><font> leftsubnet=0.0.0.0/0</font><font><br>
</font><font> leftcert=serverCert.pem</font><font><br>
</font><font> right=%any</font><font><br>
</font><font> rightdns=8.8.8.8,8.8.4.4</font><font><br>
</font><font> rightsourceip=10.254.254.0/24</font><font><br>
</font><font><br>
</font><font>conn IPSec-IKEv2</font><font><br>
</font><font> keyexchange=ikev2</font><font><br>
</font><font> auto=add</font><font><br>
</font><font><br>
</font><font>conn IPSec-IKEv2-EAP</font><font><br>
</font><font> also="IPSec-IKEv2"</font><font><br>
</font><font> rightauth=eap-mschapv2</font><font><br>
</font><font> rightsendcert=never</font><font><br>
</font><font> eap_identity=%any</font><font><br>
</font><font><br>
</font><font>conn CiscoIPSec</font><font><br>
</font><font> keyexchange=ikev1</font><font><br>
</font><font> # forceencaps=yes</font><font><br>
</font><font> rightauth=pubkey</font><font><br>
</font><font> rightauth2=xauth</font><font><br>
</font><font> auto=add</font><br>
<br>
Ipsec.secrets:<br>
<br>
<font> : RSA serverKey.pem</font><font><br>
</font><font><br>
</font><font>mtes : EAP "123456"</font><font><br>
</font><font>mtest : XAUTH "<a href="tel:1234567" x-apple-data-detectors="true" x-apple-data-detectors-type="telephone" x-apple-data-detectors-result="1">1234567</a>"</font><font><br>
</font><font>atest : EAP "12345"</font><br>
<br>
strongswan.conf:<br>
<font>charon {</font><font><br>
</font><font><br>
</font><font> # number of worker threads in charon</font><font><br>
</font><font> threads = 16</font><font><br>
</font><font><br>
</font><font> # dns</font><font><br>
</font><font> dns1 = 10.254.254.1</font><font><br>
</font><font><br>
</font><font> </font><font><br>
</font><font> plugins {</font><font><br>
</font><font><br>
</font><font> sql {</font><font><br>
</font><font> # loglevel to log into sql database</font><font><br>
</font><font> loglevel = -1</font><font><br>
</font><font> }</font><font><br>
</font><font> }</font><font><br>
</font><font>}</font><font><br>
</font><font><br>
</font><font>libstrongswan {</font><font><br>
</font><font><br>
</font><font> # test crypto at startup</font><font><br>
</font><font> crypto_test {</font><font><br>
</font><font> on_add = yes</font><font><br>
</font><font> }</font><font><br>
</font><font>}</font><font><br>
</font><br>
<br>
</span><span style="-webkit-text-size-adjust: auto;">Von meinem iPhone gesendet</span></div>
<div style="-webkit-text-size-adjust: auto;"><br>
Am 09.04.2015 um 11:54 schrieb "Fred" <<a href="mailto:curious_freddy@gmsl.co.uk">curious_freddy@gmsl.co.uk</a>>:<br>
<br>
</div>
<blockquote type="cite" style="-webkit-text-size-adjust: auto;">
<div><span>On 09/04/2015 10:15, Marc Müller wrote:</span><br>
<blockquote type="cite"><span>Hello,I can not connect from a Windows client to the server Strongswan.</span><br>
</blockquote>
<blockquote type="cite"><span>But I try the Fritzbox should connect to the server Strongswan If this</span><br>
</blockquote>
<blockquote type="cite"><span>works. If I want from a Windows client to the Strongswan via VPN</span><br>
</blockquote>
<blockquote type="cite"><span>connection I get the error 800”The VPNserver may beunreachable.”(But</span><br>
</blockquote>
<blockquote type="cite"><span>with the Fritzbox I can connect?) In the log files If nothing. Only the</span><br>
</blockquote>
<blockquote type="cite"><span>Fritzbox are compounds with the Strongswan server.</span><br>
</blockquote>
<span></span><br>
<span>You can always enable logs on Strongswan.</span><br>
<span></span><br>
<span>e.g.</span><br>
<span></span><br>
<span>charondebug="app 2, asn 2, chd 2, job 2, tnc 2, tls 2, knl 2, cfg 2, dmn 2, ike 2, net 2, lib 2, mgr 2"</span><br>
<span></span><br>
<span>Make sure the CA public cert is installed as a trusted CA on your Windows machine for Windows to trust serverCert.pem, otherwise it will refuse to connect.</span><br>
<span></span><br>
<span>Also make sure that the recommended certificate requirements are met for serverCert.pem:</span><br>
<span></span><br>
<span>e.g. --flag serverAuth --flag ikeIntermediate</span><br>
<span></span><br>
<span>Fred</span><br>
<span></span><br>
<span></span><br>
<span></span><br>
<span>_______________________________________________</span><br>
<span>Users mailing list</span><br>
<span><a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a></span><br>
<span><a href="https://lists.strongswan.org/mailman/listinfo/users">https://lists.strongswan.org/mailman/listinfo/users</a></span><br>
<span></span><br>
<span></span><br>
<span></span><br>
<span></span><br>
</div>
</blockquote>
</body>
</html>