<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 14pt; color: #000000"><div>Hello<br>I need to configure a VPN server for road warriors devices <br>RW establishes the tunnel and then a local process of the server hosting the stongswan must access to the rw device.<br>RW config is preset, i can only change the VPN server IP @ to reach.<br>My VPN server is behind my internet acces router with nat and Port forwarding of ports 500/4500<br>I must do a stupide error but I cannot make it run<br>I looked at samples, i tried both ipsec.conf and swanctl.conf <br>with Ipsec.conf , I always fail with no "matching peer config found" <br>with swanwctl, I found a way to establish the tunnel, keep alive are exchanged but tunnel seems not be well configured<br>(for that I must add my public IP in the local-ts local_ts = 192.168.1.55,XXX.XXX.166.2)<br>I would appreciate your help<br><br>Peer1 - AccessRouter1wNAT ============== MyAccessRouterwithNAT =================== ServerStrongSwan <br> @PUB1 My@Pub 192.168.1.1(Defgwy) 192.168.1.55<br> Port Foward (500,4500) =========================><br> <=========================================== HTTPS over Tunnel ===================<br><br>------------------------------------------------------------------------------------------------<br># ipsec.conf - strongSwan IPsec configuration file<br>config setup<br> charondebug="all"<br>conn %default<br> ikelifetime=60m<br> keylife=20m<br> rekeymargin=3m<br> keyingtries=1<br> keyexchange=ikev2<br> authby=secret<br>conn Peervpn<br> right=%any<br> rightsubnet=10.10.10.0/28<br><br> #My@PUB=XXX.XXX.166.2 # don't know what to do with my @ Pub<br> <br> left=192.168.1.55<br> leftfirewall=yes<br> leftsubnet=192.168.1.0/24<br><br> ah=aes256-sha256-modp2048<br> esp=aes256-sha256-modp2048<br> ike=aes256-sha256-modp2048<br> auto=add<br>------------------------------------------------------------------------------------------------<br>ipsec.secrets:<br># This file holds shared secrets or RSA private keys for authentication.<br>10.10.10.1 : PSK myterriblesecretwithpeer1<br>myPeer1 : PSK myterriblesecretwithpeer1<br>------------------------------------------------------------------------------------------------<br>sudo ipsec statusall<br>Status of IKE charon daemon (strongSwan 5.5.1, Linux 4.19.66-v7+, armv7l):<br> uptime: 6 seconds, since Mar 30 09:45:02 2020<br> malloc: sbrk 1216512, mmap 0, used 215368, free 1001144<br> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 0<br> loaded plugins: charon aes rc2 sha2 sha1 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke vici updown<br>Listening IP addresses:<br> 192.168.1.55<br> 2a01:cb10:593:cf00:137:62f2:f7e8:274c<br> 10.6.0.1<br>Connections:<br> Peervpn: 192.168.1.55...%any IKEv2<br> Peervpn: local: [192.168.1.55] uses pre-shared key authentication<br> Peervpn: remote: uses pre-shared key authentication<br> Peervpn: child: 192.168.1.0/24 === 10.10.10.0/28 TUNNEL<br>Security Associations (0 up, 0 connecting): none<br>------------------------------------------------------------------------------------------------<br>sudo swanctl --log<br>10[NET] received packet: from 80.14.87.221[58694] to 192.168.1.55[500] (464 bytes)<br>10[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]<br>10[IKE] 80.14.87.221 is initiating an IKE_SA<br>10[IKE] local host is behind NAT, sending keep alives<br>10[IKE] remote host is behind NAT<br>10[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(MULT_AUTH) ]<br>10[NET] sending packet: from 192.168.1.55[500] to 80.14.87.221[58694] (464 bytes)<br>14[NET] received packet: from 80.14.87.221[58698] to 192.168.1.55[4500] (304 bytes)<br>14[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]<br>14[CFG] looking for peer configs matching 192.168.1.55[XXX.XXX.166.2]...80.14.87.221[myPeer1]<br>14[CFG] no matching peer config found<br>14[IKE] peer supports MOBIKE<br>14[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>14[NET] sending packet: from 192.168.1.55[4500] to 80.14.87.221[58698] (80 bytes)<br><br></div><div><br>------------------------------------------------------------------------------------------------<br>------------------------------------------------------------------------------------------------<br>Don't waste your time with this second syntaxe based on swanctl, if you found how to set the ipconf one<br><br>When using Swanctl.conf with my PUB IP in local_ts, the tunnel seems to be established but not the routing<br>Should i make it by hand in place of _updown script or is this tunnel badly set ?<br><br>XXX.XXX.166.2 {<br> RemotePeers {<br> version = 2<br> proposals = aes256-sha256-modp2048<br> local_addrs = 192.168.1.55<br> pools = rw_pool<br> local { # dont know why auth for local...<br> auth = psk<br> }<br> remote {<br> auth = psk<br> }<br> children {<br> RemotePeersVPN {<br> local_ts = 192.168.1.55,XXX.XXX.166.2<br> #local_ts = 192.168.1.55<br><br> # Dont know why cannot find it in /usr/local/libexec but found /usr/lib<br> # updown = /usr/local/libexec/ipsec/_updown iptables<br> updown = /usr/lib/ipsec/_updown iptables<br> }<br> }<br> }<br>}<br>pools {<br> rw_pool {<br> addrs = 10.10.10.0/28<br> }<br>}<br>secrets {<br> ike-remote-Peer1 {<br> id = myPeer1<br> secret = myterriblesecretwithpeer1<br> }<br>}<br>------------------------------------------------------------------------------------------------<br>sudo ipsec statusall<br>XXX.XXX.166.2:<br> RemotePeers: 192.168.1.55...%any IKEv2<br> RemotePeers: local: uses pre-shared key authentication<br> RemotePeers: remote: uses pre-shared key authentication<br>RemotePeersVPN: child: 192.168.1.55/32 XXX.XXX.166.2/32 === dynamic TUNNEL<br>Security Associations (0 up, 0 connecting): none<br>------------------------------------------------------------------------------------------------<br>sudo swanctl --log<br>12[NET] received packet: from 80.14.87.221[58736] to 192.168.1.55[500] (464 bytes)<br>12[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]<br>12[IKE] 80.14.87.221 is initiating an IKE_SA<br>12[IKE] local host is behind NAT, sending keep alives<br>12[IKE] remote host is behind NAT<br>12[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(MULT_AUTH) ]<br>12[NET] sending packet: from 192.168.1.55[500] to 80.14.87.221[58736] (464 bytes)<br>10[NET] received packet: from 80.14.87.221[58737] to 192.168.1.55[4500] (304 bytes)<br>10[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]<br>10[CFG] looking for peer configs matching 192.168.1.55[XXX.XXX.166.2]...80.14.87.221[myPeer1]<br>10[CFG] selected peer config 'RemotePeers'<br>10[IKE] authentication of 'myPeer1' with pre-shared key successful<br>10[IKE] peer supports MOBIKE<br>10[IKE] authentication of 'XXX.XXX.166.2' (myself) with pre-shared key<br>10[IKE] IKE_SA RemotePeers[1] established between 192.168.1.55[XXX.XXX.166.2]...80.14.87.221[myPeer1]<br>10[IKE] scheduling rekeying in 13593s<br>10[IKE] maximum IKE_SA lifetime 15033s<br>10[IKE] peer requested virtual IP %any<br>10[CFG] assigning new lease to 'myPeer1'<br>10[IKE] assigning virtual IP 10.10.10.1 to peer 'myPeer1'<br>10[IKE] CHILD_SA RemotePeersVPN{1} established with SPIs ca64039c_i c33dcf71_o and TS XXX.XXX.166.2/32 === 10.10.10.1/32<br>10[ENC] generating IKE_AUTH response 1 [ IDr AUTH CPRP(ADDR) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_6_ADDR) ]<br>10[NET] sending packet: from 192.168.1.55[4500] to 80.14.87.221[58737] (288 bytes)<br>05[IKE] sending keep alive to 80.14.87.221[58737]<br>08[NET] received packet: from 80.14.87.221[58737] to 192.168.1.55[4500] (128 bytes)<br>08[ENC] parsed INFORMATIONAL request 2 [ N(NATD_S_IP) N(NATD_D_IP) ]<br>08[ENC] generating INFORMATIONAL response 2 [ N(NATD_S_IP) N(NATD_D_IP) ]<br>08[NET] sending packet: from 192.168.1.55[4500] to 80.14.87.221[58737] (128 bytes)<br>----------<br>Status of IKE charon daemon (strongSwan 5.5.1, Linux 4.19.66-v7+, armv7l):<br>XXX.XXX.166.2:<br> RemotePeers: 192.168.1.55...%any IKEv2<br> RemotePeers: local: uses pre-shared key authentication<br> RemotePeers: remote: uses pre-shared key authentication<br>RemotePeersVPN: child: 192.168.1.55/32 XXX.XXX.166.2/32 === dynamic TUNNEL<br>Security Associations (1 up, 0 connecting):<br> RemotePeers[1]: ESTABLISHED 7 minutes ago, 192.168.1.55[XXX.XXX.166.2]...80.14.87.221[myPeer1]<br> RemotePeers[1]: IKEv2 SPIs: 51aac4f5007e70b6_i 88876b56d5d9029d_r*, rekeying in 3 hours<br> RemotePeers[1]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048<br>RemotePeersVPN{1}: INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: ca64039c_i c33dcf71_o<br>RemotePeersVPN{1}: AES_CBC_256/HMAC_SHA2_256_128, 0 bytes_i, 0 bytes_o, rekeying in 47 minutes<br>RemotePeersVPN{1}: XXX.XXX.166.2/32 === 10.10.10.1/32<br><br><br></div></div></body></html>