<div dir="ltr"><div dir="ltr">Hi<div><br></div><div>Try configuring your vpn-server as below:</div><div><br></div><div>For Split-Tunnel:<br>---------------------<br><br>conn WindowsAndroidOtherClients_wEAP<br>    left=<your-public-internet-ipaddr-here><br>    right=%any<br>    leftsubnet=<a href="http://192.168.0.0/22,192.168.12.0/22,192.168.21.0/24">192.168.0.0/22,192.168.12.0/22,192.168.21.0/24</a><br>    rightsourceip=<a href="http://10.254.236.2/22">10.254.236.2/22</a><br>    rightdns=192.168.0.2,192.168.12.2,192.168.21.2<br>    ikelifetime=86400s<br>    lifetime=43200s<br>    rekey=no<br>    reauth=no<br>    dpddelay=40<br>    dpdtimeout=120<br>    dpdaction=clear<br>    modeconfig=pull<br>    ike=aes256-sha1-modp1024!<br>    esp=aes256-sha1!<br>    keyexchange=ikev2<br>    leftauth=pubkey<br>    rightauth=eap-radius<br>    eap_identity=%any<br>    leftsendcert=always<br>    rightsendcert=never<br>    leftid=<a href="http://vpn.domain.org">vpn.domain.org</a><br>    rightid=%any<br>    leftcert=vpnserverCert.pem<br>    auto=add<br><br><br>Or for FULL-Tunnel<br>-------------------<br><br><br>conn WindowsAndroidOtherClients_wEAP<br>    left=<your-public-internet-ipaddr-here><br>    right=%any<br>    leftsubnet=<a href="http://0.0.0.0/0">0.0.0.0/0</a><br>    rightsourceip=<a href="http://10.254.236.2/22">10.254.236.2/22</a><br>    rightdns=192.168.0.2,192.168.12.2,192.168.21.2<br>    ikelifetime=86400s<br>    lifetime=43200s<br>    rekey=no<br>    reauth=no<br>    dpddelay=40<br>    dpdtimeout=120<br>    dpdaction=clear<br>    modeconfig=pull<br>    ike=aes256-sha1-modp1024!<br>    esp=aes256-sha1!<br>    keyexchange=ikev2<br>    leftauth=pubkey<br>    rightauth=eap-radius<br>    eap_identity=%any<br>    leftsendcert=always<br>    rightsendcert=never<br>    leftid=<a href="http://vpn.domain.org">vpn.domain.org</a><br>    rightid=%any<br>    leftcert=vpnserverCert.pem<br>    auto=add     <br><br></div><div>The above is a working config that i use for both windows-native-ikev2 and android clients</div><div><br></div><div>thanks & regards</div><div>Rajiv</div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Dec 20, 2021 at 4:42 PM Gregory Edigarov <<a href="mailto:edigarov@qarea.com">edigarov@qarea.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello Everybody.<br>
<br>
here's my strongswan setup:<br>
conn vpn-default<br>
  auto=add<br>
  compress=no<br>
  type=tunnel<br>
  keyexchange=ikev2<br>
  ike=aes256-sha1-modp1024 <br>
  esp=aes256-sha1<br>
  fragmentation=yes<br>
  forceencaps=yes<br>
  dpdaction=clear<br>
  dpddelay=300s<br>
  rekey=no<br>
  left=%any<br>
  leftid=@<a href="http://vpn.domain.org" rel="noreferrer" target="_blank">vpn.domain.org</a><br>
  leftauth=pubkey<br>
  leftcert=certificate.pem<br>
  leftsendcert=always<br>
  #leftsubnet=<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
  leftsubnet=<a href="http://192.168.0.0/22,192.168.12.0/22,192.168.21.0/24" rel="noreferrer" target="_blank">192.168.0.0/22,192.168.12.0/22,192.168.21.0/24</a><br>
  leftfirewall=yes<br>
  leftsourceip=%config<br>
  right=%any<br>
  rightid=%any<br>
  rightauth=eap-radius<br>
  rightsourceip=<a href="http://10.254.236.2/22" rel="noreferrer" target="_blank">10.254.236.2/22</a><br>
  rightdns=192.168.0.2,192.168.12.2,192.168.21.2<br>
  rightsendcert=never<br>
  eap_identity=%identity<br>
<br>
the server uses letsencrypt certificates, stored as:<br>
<br>
  270517   4 -rw-r--r--  1 root   root     3750 Nov 18 18:54<br>
  /etc/ipsec.d/cacerts/ca.pem 270515   4 -rw-r--r--  1 root<br>
  root     1838 Nov 18 18:54 /etc/ipsec.d/certs/certificate.pem<br>
  270520   4 -rw-r--r--  1 root   root     1704 Nov 18 18:55<br>
  /etc/ipsec.d/private/key.pem<br>
<br>
which is valid:<br>
    Issuer: C = US, O = Let's Encrypt, CN = R3<br>
    Validity<br>
      Not Before: Nov 18 14:19:34 2021 GMT<br>
      Not After : Feb 16 14:19:33 2022 GMT<br>
    Subject: CN = <a href="http://vpn.domain.org" rel="noreferrer" target="_blank">vpn.domain.org</a><br>
<br>
with this config I can connect from Windows 10, from ubuntu<br>
via strongswan-starter (ipsec.conf) but not from Network Manager, <br>
from iphone (seems to be ok), but not from android standard vpn client.<br>
i.e.:<br>
Windows 10 - ok<br>
ubuntu (strongswan-starter) - ok<br>
android (strongswan for android) - ok<br>
ubuntu (network manager) - don't work<br>
android (standard client) - don't work (even though I've imported CA<br>
certificate) <br>
<br>
what am I missing for systems that don't work?<br>
<br>
--<br>
With best regards,<br>
   Gregory Edigarov<br>
</blockquote></div></div>