<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000066" bgcolor="#FFFFFF">
<p>The IPSec gateway is a virtual machine dedicated to being the
IPSec gateway for the LAN. All port 500 and 4500 traffic is
directed to it by the LAN gateway using DNAT, and the LAN gateway
has a public IP. No special measures have been taken on the LAN
gateway for routing ESP.<br>
</p>
<p>On the remote phone, which runs the Strongswan app and has a
public IP, an attempt to connect results in my old friend
"NO_PROPOSAL_CHOSEN".</p>
<p>In the IPSec gateway's log is:</p>
<p>Mar 16 17:57:08 12[ENC] <1> parsed IKE_SA_INIT request 0 [
SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG)
N(REDIR_SUP) ]<br>
Mar 16 17:57:08 12[CFG] <1> looking for an ike config for
192.168.1.16...192.168.1.6<br>
Mar 16 17:57:08 12[IKE] <1> no IKE config found for
192.168.1.16...192.168.1.6, sending NO_PROPOSAL_CHOSEN</p>
<p>Well both the IPSec gateway and remote phone, are using their
static LAN IP rather than any reference to a public IP, for some
reason. That seems pretty queer.<br>
</p>
<p>'No IKE config found' might imply that remote_ts has to have
192.168.1.0/24, although extensive past experience shows that I
can fiddle with infinite permutations in this and fail
indefinitely. I just don't understand the language -meaning- of
the config files settings yet, in terms of plain English.<br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 03/16/2018 05:52 PM, Info wrote:<br>
</div>
<blockquote type="cite"
cite="mid:29baf6e4-f6e4-b914-ee5a-4dc52af5cceb@quantum-equities.com">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<p>Granted, and actually I'm much further than this now, thanks in
part to your help.</p>
<p>I was seeing whether it's worth bothering here. <br>
</p>
<p>No one seems to be using swanctl judging from no response on
#IRC. It's a far better system than ipsec.conf.</p>
<p>I've given up on my complete LAN using VPN as some devices can
not do IPSec, and I can't figure out how to make them
interoperate with machines running IPSec. So I've relegated
myself to using an IPSec gateway in the LAN to link with outside
machines.</p>
<p>I still don't understand the language of swanctl.conf. For
example my best guess is this is correct for the gateway, and
the gateway can still communicate with all non-IPSec machines in
the LAN while running strongswan-swanctl, and I've fixed the
SELinux problems, but it does not work with my remote machines.
The daemon starts just fine and loads all the certs and keys of
course.<br>
</p>
<p>ikev2-pubkey {<br>
version = 2<br>
# proposals =
aes192gcm16-aes128gcm16-aes192-prfsha256-ecp256-ecp521,aes192-sha256-modp3072,default<br>
rekey_time = 0s<br>
pools = primary-pool-ipv4 #, primary-pool-ipv6<br>
fragmentation = yes<br>
dpd_delay = 30s<br>
# dpd_timeout doesn't do anything for IKEv2. The general
IKEv2 packet timeouts are used.<br>
local-1 {<br>
cert = cygnus-Cert.pem<br>
id = cygnus.darkmatter.org<br>
}<br>
remote-1 {<br>
# defaults are fine.<br>
}<br>
children {<br>
ikev2-pubkey {<br>
local_ts = 0.0.0.0/0 #,::/0<br>
rekey_time = 0s<br>
dpd_action = clear<br>
# esp_proposals =
aes192gcm16-aes128gcm16-aes192-ecp256,aes192-sha256-modp3072,default<br>
}<br>
}<br>
}<br>
<br>
</p>
<p>So each end should take the other end's public cert, combine it
with its private key, and come up with a symmetric key to
communicate with.</p>
<p>The local_ts determines what traffic is to go in to IPSec, but
that would be all of it. So from another machine in the LAN I
aim at the mailserver outside at 72.251.232.108, if I can
somehow make the LAN direct traffic to the IPSec gateway (which
is different from the LAN gateway), the IPSec gateway should
somehow aim it at the mailserver rather than the remote phone or
tablet.</p>
<p>And somehow the IPSec gateway should be able to carry on
simultaneous conversations with the mailserver and phone/tablet,
but surely that means two point-to-point connections..<br>
</p>
<br>
<div class="moz-cite-prefix">On 03/16/2018 05:24 PM, Noel Kuntze
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:2c3fcd2b-b17d-1ccd-b9b3-726f82a08203@thermi.consulting">
<pre wrap="">We two talked about this on IRC about two weeks ago. Use the Host-To-Host transport mode configuration on the bottom of the UsableExamples page.
How you authenticate the hosts is up to you. Preferably, you want to have some central PKI that you use. Maybe put the keys in DNS using the ipseckey plugin, but I haven't tested that yet.
Kind regards
Noel
</pre>
</blockquote>
</blockquote>
<br>
</body>
</html>