<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">Thanks to Dirk Hartmann and his scripting idea, The simplest way to add a VPN connection to Windows 10 that includes the routing to the internal IP, is by running the following commands in PowerShell commands. This also enables strong ciphers (MODP2048)</div><div class=""><br class=""></div><div class=""><i class="">This is for a username/password VPN available to all users (remove -<b class="">AllUserConnection</b> from the </i><b class="">Add-VpnConnection</b><i class=""> command for just the current user)</i></div><div class=""><br class=""></div><div class="">------------</div><div class=""><br class=""></div><div class=""><div class=""><b class="">reg add HKLM\System\CurrentControlSet\Services\Rasman\Parameters /v NegotiateDH2048_AES256 /t REG_DWORD /d 2 /f</b></div><div class=""><b class=""><br class=""></b></div><div class=""><b class="">Add-VpnConnection -Name "vpn-connection" -ServerAddress my-server-ip-or-hostname -TunnelType "Ikev2" -AllUserConnection -EncryptionLevel Required</b></div><div class=""><b class=""><br class=""></b></div><div class=""><b class="">Set-VPNConnection -Name "</b><b class="">vpn-connection</b><b class="">" -AllUserConnection -SplitTunneling 1</b></div><div class=""><b class=""><br class=""></b></div><div class=""><b class="">Add-VpnConnectionRoute -ConnectionName "</b><b class="">vpn-connection</b><b class="">" -DestinationPrefix 10.0.0.0/18</b></div><div class=""><b class=""><br class=""></b></div><div class=""><b class="">Set-VPNConnectionIPsecConfiguration -ConnectionName "</b><b class="">vpn-connection</b><b class="">" -AuthenticationTransformConstants SHA256128 -CipherTransformConstants AES256 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -PfsGroup None -DHGroup Group14 -Force</b></div></div><div class=""><a href="http://www.naimuri.com" class=""><b class="">
</b></a></div><div><br class=""></div><div><i class="">Reboot machine for registry entry to take affect</i></div><div><i class=""><br class=""></i></div><div><i class=""><br class=""></i></div><div><br class=""><blockquote type="cite" class=""><div class="">On 4 May 2018, at 07:49, Christian Salway <<a href="mailto:christian.salway@naimuri.com" class="">christian.salway@naimuri.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=us-ascii" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Still working on this issue so a quick morning update.</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">I've figured that in the request IKE_AUTH is the client telling strongSwan what it supports as "information".</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class=""> # Win10 supports ADDR(1) DNS(3) NBNS(4) SRV ADDR6(8) DNS6(10) SRV6</div><div class=""><br class=""></div><div class=""> # OSX supports ADDR DHCP(6) DNS MASK(2) ADDR6 DHCP6(12) DNS6 DNS_DOMAIN(25)</div></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">So I have added dns and domain into the attr.conf</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><b class="">$ /etc/strongswan.d/charon/attr.conf</b></div><div style="text-align: start; text-indent: 0px;" class=""><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">attr {</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-weight: normal;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-weight: normal;" class=""> load = yes</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-weight: normal;" class=""> dns = 10.0.5.202</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-weight: normal;" class=""> 25 = eu-west-2.compute.internal</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-weight: normal;" class="">} </div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-weight: normal;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-weight: normal;" class="">and removed DHCP because as Thor said, it was only being used by strongSwan to assign an IP address to the client which is not needed in my case.</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-weight: normal;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-weight: normal;" class="">Windows 10 is still not adding any route though but I have managed to alter the command so I can bind the route persistently to the interface (as opposed to the IP that I had before) which allows for IP address changes</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-weight: normal;" class=""><br class=""></div><div class=""><div class=""><b class="">netsh interface ipv4 show interfaces</b></div><div class=""><i class=""><br class=""></i></div><div class=""><i class="">note the name of your vpn interface</i></div><div class=""><br class=""></div><div class=""><b class="">netsh interface ipv4 add route 10.0.0.0/18 "vpn-interface-name"</b></div></div></div><a href="http://www.naimuri.com/" class="">
</a></div><div class=""><br class=""></div><div class=""><i class="">where 10.0.0.0/18 is your internal network</i></div><div class=""><br class=""></div></div></div></blockquote></div><br class=""></body></html>