<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="en-NL" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Hello everyone<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">I did some further investigation, it seems like the certificate isn’t the problem. I tried this with a certificate generated by the PKI tool, and the same messages are still in the log.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Apr 19 12:15:07 fwhq05 charon: 08[IKE] peer requested virtual IP %any<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Apr 19 12:15:07 fwhq05 charon: 08[IKE] assigning virtual IP 192.168.8.1 to peer '…'<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Apr 19 12:15:07 fwhq05 charon: 08[IKE] peer requested virtual IP %any6<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Apr 19 12:15:07 fwhq05 charon: 08[IKE] no virtual IP found for %any6 requested by '…'<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Apr 19 12:15:07 fwhq05 charon: 08[KNL] received netlink error: Invalid argument (22)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Apr 19 12:15:07 fwhq05 charon: 08[KNL] unable to add SAD entry with SPI c53c8641<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Apr 19 12:15:07 fwhq05 charon: 08[KNL] received netlink error: Invalid argument (22)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Apr 19 12:15:07 fwhq05 charon: 08[KNL] unable to add SAD entry with SPI ab3a3b48<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Apr 19 12:15:07 fwhq05 charon: 08[IKE] unable to install inbound and outbound IPsec SA (SAD) in kernel<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">So no old kernel, no certificate… what else can it be?
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Kind regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Jeroen.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-NL" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Users <users-bounces@lists.strongswan.org>
<b>On Behalf Of </b>Jeroen Landheer<br>
<b>Sent:</b> Friday, 19 April 2019 11:50<br>
<b>To:</b> Thomas Egerer <hakke_007@gmx.de>; users@lists.strongswan.org<br>
<b>Subject:</b> Re: [strongSwan] Ubuntu 16: Received netlink error: Invalid Argument (22)<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Thanks for the response Thomas<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">You’re right that this kernel is old, it’s Ubuntu 16.04 so I decided to replace that machine with the much newer Debian 9.8. I’m now on kernel version 4.9.0-8-amd64, but this hasn’t
helped. I’m actually thinking this might have to do with the certificate I’m using, since the certificate was generated by a Microsoft Certificate Authority, not the internal PKI tools. I created the private key on the Debian machine using the ipsec pki tool,
next I generated a certificate request using that same tool and used this request to let my CA issue a certificate.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Here’s some info about the certificate, using the certutil tool on Windows:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">X509 Certificate:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Version: 3<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Serial Number: 38000000bda7de55e826a360e20000000000bd<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Signature Algorithm:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Algorithm ObjectId: 1.2.840.113549.1.1.11 sha256RSA<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Algorithm Parameters:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 05 00<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Issuer:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> CN=…<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Name Hash(sha1): 02de19ec77e1b73e3ee81fbf33040929b61510af<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Name Hash(md5): 2507479912498e5c82c4d715d6f2b36f<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">NotBefore: 18/04/2019 17:11<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">NotAfter: 17/04/2021 17:11<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Subject:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> CN=Company Firewall<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> O=Company<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Name Hash(sha1): c1ecb37bbdab3a3e5fd38af556ea105228b463f1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Name Hash(md5): bc0ce29929023983b116aef799b85701<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Public Key Algorithm:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Algorithm ObjectId: 1.2.840.113549.1.1.1 RSA<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Algorithm Parameters:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 05 00<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Public Key Length: 4096 bits<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Public Key: UnusedBits = 0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 0000 30 82 02 0a 02 82 02 01 00 a1 ea 0d 54 16 07 92<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 0010 d9 57 cc 5f 64 1e 6e 03 45 98 ce 23 83 7d 38 a2<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">…<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 01f0 cb 03 95 87 f5 05 f3 09 58 b4 37 52 69 0d 75 e2<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 0200 59 c7 55 53 8c bc 31 0f 55 02 03 01 00 01<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Certificate Extensions: 9<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 2.5.29.17: Flags = 0, Length = 3e<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Subject Alternative Name<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> DNS Name=…<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> DNS Name=…<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> DNS Name=…<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 2.5.29.14: Flags = 0, Length = 16<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Subject Key Identifier<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 18ac7e7d52238f02579e8190ea68f3ce283d9d77<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 2.5.29.35: Flags = 0, Length = 18<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Authority Key Identifier<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> KeyID=82785767ff34df9161f00a37dc4df7a9d387732b<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 2.5.29.31: Flags = 0, Length = 59<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> CRL Distribution Points<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> [1]CRL Distribution Point<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Distribution Point Name:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Full Name:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> URL=…..<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 1.3.6.1.5.5.7.1.1: Flags = 0, Length = 91<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Authority Information Access<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> [1]Authority Info Access<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Alternative Name:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> URL=…<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> [2]Authority Info Access<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Alternative Name:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> URL=…<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 2.5.29.15: Flags = 1(Critical), Length = 4<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Key Usage<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Digital Signature, Key Encipherment (a0)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 1.3.6.1.4.1.311.21.7: Flags = 0, Length = 30<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Certificate Template Information<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Template=VPN Server(1.3.6.1.4.1.311.21.8.7409278.1580920.3752321.8005686.9414170.164.2713793.11843046)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Major Version Number=100<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Minor Version Number=5<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 2.5.29.37: Flags = 0, Length = 20<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Enhanced Key Usage<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Server Authentication (1.3.6.1.5.5.7.3.1)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> IP security IKE intermediate (1.3.6.1.5.5.8.2.2)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Client Authentication (1.3.6.1.5.5.7.3.2)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 1.3.6.1.4.1.311.21.10: Flags = 0, Length = 26<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Application Policies<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> [1]Application Certificate Policy:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Policy Identifier=Server Authentication<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> [2]Application Certificate Policy:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Policy Identifier=IP security IKE intermediate<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> [3]Application Certificate Policy:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Policy Identifier=Client Authentication<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Signature Algorithm:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Algorithm ObjectId: 1.2.840.113549.1.1.11 sha256RSA<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> Algorithm Parameters:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 05 00<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Signature: UnusedBits=0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 0000 53 a4 15 5f fa 88 1e 76 7f af e3 d9 94 bb 0f 05<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 0010 5e 55 fa b8 c1 58 78 bf 78 71 1f 8c aa 89 83 14<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">…<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 00e0 fb 7f 80 fd aa cf 5f 7d ba c6 e8 05 93 0c 76 78<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US"> 00f0 9b da 12 bd 49 43 33 00 fe 97 c0 e9 c5 b7 20 18<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Non-root Certificate<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Key Id Hash(rfc-sha1): 18ac7e7d52238f02579e8190ea68f3ce283d9d77<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Key Id Hash(sha1): 0dd4d49ae7cb0a17cba19871b82a0e90a86ce5f7<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Key Id Hash(bcrypt-sha1): df7f493937a1b175d83b27935f7ea1528bfd73ff<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Key Id Hash(bcrypt-sha256): ed3bcef6c9c725b72a26a658ee8037533b1046724a75772ce10ee83b80ed547f<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Key Id Hash(md5): 89d062523ffb9998f9617e1c58d51bfc<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Key Id Hash(sha256): f4a7bd1e71d1c6422eca8fdcdfb3c8c184e72cb8bbbe242de97a2c3c68698d1b<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Key Id Hash(pin-sha256): nO3Yrqy2aZhe9UfSwzGkWGWOF9GhThXmWaBjUGU/y3s=<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Key Id Hash(pin-sha256-hex): 9cedd8aeacb669985ef547d2c331a458658e17d1a14e15e659a06350653fcb7b<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Cert Hash(md5): ac80ead487d9100456004dfb8bf63a4d<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Cert Hash(sha1): 421247d634be3256c9a2112eee82dc85bfc63b95<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Cert Hash(sha256): c4c563b0b0a76f59ddfdee044c75f0550b9b02e24065cb2b0bddd755641fb8ee<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-family:"Courier New";mso-fareast-language:EN-US">Signature Hash: 5384636758d9dffcc8bdc722c0deafa0e573ce7f51e5b3f87439f21a2f2d9af1<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Using openssl x509 -in certfile.crt -text -noout yields the same results.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">When I generate a CA certificate + a server certificate simply using the PKI tools, this yields a certificate with SHA384RSA instead of a SHA256RSA cert.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Could this be part of the issue, or am I missing something else?
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Kind regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Jeroen.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-NL" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Thomas Egerer <<a href="mailto:hakke_007@gmx.de">hakke_007@gmx.de</a>>
<br>
<b>Sent:</b> Wednesday, 17 April 2019 20:07<br>
<b>To:</b> Jeroen Landheer <<a href="mailto:jlandheer@bintelligence.nl">jlandheer@bintelligence.nl</a>>;
<a href="mailto:users@lists.strongswan.org">users@lists.strongswan.org</a><br>
<b>Subject:</b> Re: [strongSwan] Ubuntu 16: Received netlink error: Invalid Argument (22)<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="en-NL"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="en-NL">Hi Jeroen,<br>
<br>
don't use that antique kernel unless you have to. Sounds like the IV generator issue from [1]:<br>
<quote><br>
Note: For kernel versions 4.2-4.5 you will have to select Encrypted Chain IV Generator manually in order to use any encryption algorithm in CBC mode.<br>
</quote><br>
<br>
Hth<br>
Thomas<br>
<br>
[1] <a href="https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules">
https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules</a><o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="en-NL">On April 17, 2019 7:07:10 PM GMT+02:00, Jeroen Landheer <<a href="mailto:jlandheer@bintelligence.nl">jlandheer@bintelligence.nl</a>> wrote:<o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<p class="MsoNormal"><span lang="en-NL">This apears in my log file:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">Apr 17 18:43:04 fwhq03 charon: 11[IKE] assigning virtual IP 192.168.8.1 to peer 'jlan--------------e.nl'<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">Apr 17 18:43:04 fwhq03 charon: 11[KNL] received netlink error: Invalid argument (22)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">Apr 17 18:43:04 fwhq03 charon: 11[KNL] unable to add SAD entry with SPI cf789c5c<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">Apr 17 18:43:04 fwhq03 charon: 11[KNL] received netlink error: Invalid argument (22)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">Apr 17 18:43:04 fwhq03 charon: 11[KNL] unable to add SAD entry with SPI b651e5ec<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">Apr 17 18:43:04 fwhq03 charon: 11[IKE] unable to install inbound and outbound IPsec SA (SAD) in kernel<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">It seems that somehow strongswan can't assign a virtual IP address to the peer. <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">Config:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">config setup<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> charondebug="all"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> uniqueids=no<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">conn ikev2-vpn<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> auto=add<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> compress=no<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> type=tunnel<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> keyexchange=ikev2<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> fragmentation=yes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> forceencaps=yes<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> ike=aes256-sha1-modp1024,3des-sha1-modp1024!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> esp=aes256-sha1,3des-sha1!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> dpdaction=clear<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> dpddelay=300s<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> rekey=no<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> left=%any<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> <a href="mailto:leftid=@vpn.-------------.---o">
leftid=@vpn.-------------.---o</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> leftcert=/etc/ipsec.d/certs/vpn-server-cert.pem<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> leftsendcert=always<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> leftsubnet=0.0.0.0/0,::/0<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> right=%any<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> rightid=%any<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> rightdns=192.168.5.2,192.168.5.9,2001:980:aa14:5::2,2001:980:aa14:5::9<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> rightsourceip=192.168.8.0/24,2001:980:aa14:8::/64<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> rightsendcert=never<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> rightauth=eap-mschapv2<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"> eap_identity=%identity<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">If I run the check script for the kernel modules, I get this: (this is basically a standard ubuntu setup)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_XFRM_USER=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NET_KEY=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"># CONFIG_NET_KEY_MIGRATE is not set<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_AH=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_ESP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_IPCOMP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_XFRM_TUNNEL=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_TUNNEL=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_XFRM_MODE_TRANSPORT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_XFRM_MODE_TUNNEL=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_XFRM_MODE_BEET=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_LRO=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_DIAG=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_TCP_DIAG=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_UDP_DIAG=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET6_AH=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET6_ESP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET6_IPCOMP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET6_XFRM_TUNNEL=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET6_TUNNEL=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET6_XFRM_MODE_TRANSPORT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET6_XFRM_MODE_TUNNEL=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET6_XFRM_MODE_BEET=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_DCCP_DIAG=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IP_ADVANCED_ROUTER=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IP_MULTIPLE_TABLES=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_AH=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_ESP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_IPCOMP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_XFRM_MODE_TRANSPORT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_XFRM_MODE_TUNNEL=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET_XFRM_MODE_BEET=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6_ROUTER_PREF=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6_ROUTE_INFO=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"># CONFIG_IPV6_OPTIMISTIC_DAD is not set<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6_MIP6=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6_ILA=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6_VTI=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6_SIT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6_SIT_6RD=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6_NDISC_NODETYPE=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6_TUNNEL=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6_GRE=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6_MULTIPLE_TABLES=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6_SUBTREES=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6_MROUTE=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6_PIMSM_V2=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET6_AH=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET6_ESP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET6_IPCOMP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET6_XFRM_MODE_TRANSPORT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET6_XFRM_MODE_TUNNEL=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_INET6_XFRM_MODE_BEET=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_IPV6_MULTIPLE_TABLES=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"># CONFIG_NETFILTER_DEBUG is not set<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_ADVANCED=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_INGRESS=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_NETLINK=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_NETLINK_ACCT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_NETLINK_QUEUE=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_NETLINK_LOG=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_NETLINK_GLUE_CT=y<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_SYNPROXY=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XTABLES=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MARK=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_CONNMARK=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_SET=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_AUDIT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_CONNMARK=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_CT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_DSCP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_HL=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_HMARK=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_LED=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_LOG=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_MARK=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_NAT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_NETMAP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_NFLOG=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"># CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_RATEEST=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_REDIRECT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_TEE=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_TPROXY=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_TRACE=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_SECMARK=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_TCPMSS=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_BPF=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_CGROUP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_CLUSTER=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_COMMENT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_CONNMARK=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_CPU=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_DCCP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_DSCP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_ECN=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_ESP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_HELPER=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_HL=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_IPCOMP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_IPRANGE=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_IPVS=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_L2TP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_LENGTH=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_LIMIT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_MAC=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_MARK=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_NFACCT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_OSF=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_OWNER=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_POLICY=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_QUOTA=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_RATEEST=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_REALM=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_RECENT=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_SCTP=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_SOCKET=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_STATE=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_STATISTIC=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_STRING=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_TCPMSS=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_TIME=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_U32=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XTABLES=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">CONFIG_NETFILTER_XT_MATCH_POLICY=m<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">Kernel version: 4.4.0-145-generic<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">Any idea how to diagnose this issue?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">Kind regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-NL">Jeroen. <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="en-NL" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
</blockquote>
</div>
<p class="MsoNormal"><span lang="en-NL"><br>
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.<o:p></o:p></span></p>
</div>
</body>
</html>