[strongSwan] failed to configure VPN behind my router

jl.boussel at laposte.net jl.boussel at laposte.net
Mon Mar 30 11:42:37 CEST 2020


Hello 
I need to configure a VPN server for road warriors devices 
RW establishes the tunnel and then a local process of the server hosting the stongswan must access to the rw device. 
RW config is preset, i can only change the VPN server IP @ to reach. 
My VPN server is behind my internet acces router with nat and Port forwarding of ports 500/4500 
I must do a stupide error but I cannot make it run 
I looked at samples, i tried both ipsec.conf and swanctl.conf 
with Ipsec.conf , I always fail with no "matching peer config found" 
with swanwctl, I found a way to establish the tunnel, keep alive are exchanged but tunnel seems not be well configured 
(for that I must add my public IP in the local-ts local_ts = 192.168.1.55,XXX.XXX.166.2) 
I would appreciate your help 

Peer1 - AccessRouter1wNAT ============== MyAccessRouterwithNAT =================== ServerStrongSwan 
@PUB1 My at Pub 192.168.1.1(Defgwy) 192.168.1.55 
Port Foward (500,4500) =========================> 
<=========================================== HTTPS over Tunnel =================== 

------------------------------------------------------------------------------------------------ 
# ipsec.conf - strongSwan IPsec configuration file 
config setup 
charondebug="all" 
conn %default 
ikelifetime=60m 
keylife=20m 
rekeymargin=3m 
keyingtries=1 
keyexchange=ikev2 
authby=secret 
conn Peervpn 
right=%any 
rightsubnet=10.10.10.0/28 

#My at PUB=XXX.XXX.166.2 # don't know what to do with my @ Pub 

left=192.168.1.55 
leftfirewall=yes 
leftsubnet=192.168.1.0/24 

ah=aes256-sha256-modp2048 
esp=aes256-sha256-modp2048 
ike=aes256-sha256-modp2048 
auto=add 
------------------------------------------------------------------------------------------------ 
ipsec.secrets: 
# This file holds shared secrets or RSA private keys for authentication. 
10.10.10.1 : PSK myterriblesecretwithpeer1 
myPeer1 : PSK myterriblesecretwithpeer1 
------------------------------------------------------------------------------------------------ 
sudo ipsec statusall 
Status of IKE charon daemon (strongSwan 5.5.1, Linux 4.19.66-v7+, armv7l): 
uptime: 6 seconds, since Mar 30 09:45:02 2020 
malloc: sbrk 1216512, mmap 0, used 215368, free 1001144 
worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 0 
loaded plugins: charon aes rc2 sha2 sha1 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke vici updown 
Listening IP addresses: 
192.168.1.55 
2a01:cb10:593:cf00:137:62f2:f7e8:274c 
10.6.0.1 
Connections: 
Peervpn: 192.168.1.55...%any IKEv2 
Peervpn: local: [192.168.1.55] uses pre-shared key authentication 
Peervpn: remote: uses pre-shared key authentication 
Peervpn: child: 192.168.1.0/24 === 10.10.10.0/28 TUNNEL 
Security Associations (0 up, 0 connecting): none 
------------------------------------------------------------------------------------------------ 
sudo swanctl --log 
10[NET] received packet: from 80.14.87.221[58694] to 192.168.1.55[500] (464 bytes) 
10[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ] 
10[IKE] 80.14.87.221 is initiating an IKE_SA 
10[IKE] local host is behind NAT, sending keep alives 
10[IKE] remote host is behind NAT 
10[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(MULT_AUTH) ] 
10[NET] sending packet: from 192.168.1.55[500] to 80.14.87.221[58694] (464 bytes) 
14[NET] received packet: from 80.14.87.221[58698] to 192.168.1.55[4500] (304 bytes) 
14[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ] 
14[CFG] looking for peer configs matching 192.168.1.55[XXX.XXX.166.2]...80.14.87.221[myPeer1] 
14[CFG] no matching peer config found 
14[IKE] peer supports MOBIKE 
14[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ] 
14[NET] sending packet: from 192.168.1.55[4500] to 80.14.87.221[58698] (80 bytes) 


------------------------------------------------------------------------------------------------ 
------------------------------------------------------------------------------------------------ 
Don't waste your time with this second syntaxe based on swanctl, if you found how to set the ipconf one 

When using Swanctl.conf with my PUB IP in local_ts, the tunnel seems to be established but not the routing 
Should i make it by hand in place of _updown script or is this tunnel badly set ? 

XXX.XXX.166.2 { 
RemotePeers { 
version = 2 
proposals = aes256-sha256-modp2048 
local_addrs = 192.168.1.55 
pools = rw_pool 
local { # dont know why auth for local... 
auth = psk 
} 
remote { 
auth = psk 
} 
children { 
RemotePeersVPN { 
local_ts = 192.168.1.55,XXX.XXX.166.2 
#local_ts = 192.168.1.55 

# Dont know why cannot find it in /usr/local/libexec but found /usr/lib 
# updown = /usr/local/libexec/ipsec/_updown iptables 
updown = /usr/lib/ipsec/_updown iptables 
} 
} 
} 
} 
pools { 
rw_pool { 
addrs = 10.10.10.0/28 
} 
} 
secrets { 
ike-remote-Peer1 { 
id = myPeer1 
secret = myterriblesecretwithpeer1 
} 
} 
------------------------------------------------------------------------------------------------ 
sudo ipsec statusall 
XXX.XXX.166.2: 
RemotePeers: 192.168.1.55...%any IKEv2 
RemotePeers: local: uses pre-shared key authentication 
RemotePeers: remote: uses pre-shared key authentication 
RemotePeersVPN: child: 192.168.1.55/32 XXX.XXX.166.2/32 === dynamic TUNNEL 
Security Associations (0 up, 0 connecting): none 
------------------------------------------------------------------------------------------------ 
sudo swanctl --log 
12[NET] received packet: from 80.14.87.221[58736] to 192.168.1.55[500] (464 bytes) 
12[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ] 
12[IKE] 80.14.87.221 is initiating an IKE_SA 
12[IKE] local host is behind NAT, sending keep alives 
12[IKE] remote host is behind NAT 
12[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(MULT_AUTH) ] 
12[NET] sending packet: from 192.168.1.55[500] to 80.14.87.221[58736] (464 bytes) 
10[NET] received packet: from 80.14.87.221[58737] to 192.168.1.55[4500] (304 bytes) 
10[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ] 
10[CFG] looking for peer configs matching 192.168.1.55[XXX.XXX.166.2]...80.14.87.221[myPeer1] 
10[CFG] selected peer config 'RemotePeers' 
10[IKE] authentication of 'myPeer1' with pre-shared key successful 
10[IKE] peer supports MOBIKE 
10[IKE] authentication of 'XXX.XXX.166.2' (myself) with pre-shared key 
10[IKE] IKE_SA RemotePeers[1] established between 192.168.1.55[XXX.XXX.166.2]...80.14.87.221[myPeer1] 
10[IKE] scheduling rekeying in 13593s 
10[IKE] maximum IKE_SA lifetime 15033s 
10[IKE] peer requested virtual IP %any 
10[CFG] assigning new lease to 'myPeer1' 
10[IKE] assigning virtual IP 10.10.10.1 to peer 'myPeer1' 
10[IKE] CHILD_SA RemotePeersVPN{1} established with SPIs ca64039c_i c33dcf71_o and TS XXX.XXX.166.2/32 === 10.10.10.1/32 
10[ENC] generating IKE_AUTH response 1 [ IDr AUTH CPRP(ADDR) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_6_ADDR) ] 
10[NET] sending packet: from 192.168.1.55[4500] to 80.14.87.221[58737] (288 bytes) 
05[IKE] sending keep alive to 80.14.87.221[58737] 
08[NET] received packet: from 80.14.87.221[58737] to 192.168.1.55[4500] (128 bytes) 
08[ENC] parsed INFORMATIONAL request 2 [ N(NATD_S_IP) N(NATD_D_IP) ] 
08[ENC] generating INFORMATIONAL response 2 [ N(NATD_S_IP) N(NATD_D_IP) ] 
08[NET] sending packet: from 192.168.1.55[4500] to 80.14.87.221[58737] (128 bytes) 
---------- 
Status of IKE charon daemon (strongSwan 5.5.1, Linux 4.19.66-v7+, armv7l): 
XXX.XXX.166.2: 
RemotePeers: 192.168.1.55...%any IKEv2 
RemotePeers: local: uses pre-shared key authentication 
RemotePeers: remote: uses pre-shared key authentication 
RemotePeersVPN: child: 192.168.1.55/32 XXX.XXX.166.2/32 === dynamic TUNNEL 
Security Associations (1 up, 0 connecting): 
RemotePeers[1]: ESTABLISHED 7 minutes ago, 192.168.1.55[XXX.XXX.166.2]...80.14.87.221[myPeer1] 
RemotePeers[1]: IKEv2 SPIs: 51aac4f5007e70b6_i 88876b56d5d9029d_r*, rekeying in 3 hours 
RemotePeers[1]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048 
RemotePeersVPN{1}: INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: ca64039c_i c33dcf71_o 
RemotePeersVPN{1}: AES_CBC_256/HMAC_SHA2_256_128, 0 bytes_i, 0 bytes_o, rekeying in 47 minutes 
RemotePeersVPN{1}: XXX.XXX.166.2/32 === 10.10.10.1/32 


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20200330/6bdee815/attachment.html>


More information about the Users mailing list