[strongSwan] revisiting problem with linux to VPN using network-manager-strongswan 1.4.5-2.1
David H Durgee
dhdurgee at verizon.net
Wed Jul 28 22:31:22 CEST 2021
I did a bit more checking and found references to "ip xfrm policy list"
and "ip xfrm state list" as possible sources of the confirmation of
operation I am seeking. I ran these commands with the VPN up and have
attached the output of these commands.
I am not trained in reading these reports, but what I see does appear to
indicate that the VPN is indeed functioning and handling the traffic as
requested. If someone who is trained could confirm this for me I would
appreciate it.
Dave
> Noel Kuntze wrote: Hello David,
>
> strongSwan by default builds policy based tunnels, not route based
> tunnels.
> Thus no interface is needed or created.
> Read up on how IPsec works on the wiki to get an understanding for it.
>
> GUI indicators are not inherently related to if any tunnel exists, or
> works.
>
> Kind regards
> Noel
>
> Am 01.07.21 um 20:31 schrieb David H Durgee:
>> I thought it might make sense to revisit this after the progress that
>> has been made. It now appears that the connection is being established:
>>
>>> Jun 29 11:21:34 Z560 charon-nm: 11[IKE] authentication of
>>> 'durgeeenterprises.publicvm.com' with EAP successful
>>> Jun 29 11:21:34 Z560 charon-nm: 11[IKE] IKE_SA Durgee Enterprises,
>>> LLC[7] established between
>>> 192.168.1.114[dhdurgee]...108.31.28.59[durgeeenterprises.publicvm.com]
>>> Jun 29 11:21:34 Z560 charon-nm: 11[IKE] scheduling rekeying in 35705s
>>> Jun 29 11:21:34 Z560 charon-nm: 11[IKE] maximum IKE_SA lifetime 36305s
>>> Jun 29 11:21:34 Z560 charon-nm: 11[IKE] installing new virtual IP
>>> 10.10.10.1
>>> Jun 29 11:21:34 Z560 avahi-daemon[750]: Registering new address
>>> record for 10.10.10.1 on wlp5s0.IPv4.
>>> Jun 29 11:21:34 Z560 charon-nm: 11[CFG] selected proposal:
>>> ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ
>>> Jun 29 11:21:34 Z560 charon-nm: 11[IKE] CHILD_SA Durgee Enterprises,
>>> LLC{4} established with SPIs c8cad4e5_i c3f2eec4_o and TS
>>> 10.10.10.1/32 === 0.0.0.0/0
>>> Jun 29 11:21:34 Z560 charon-nm: 11[IKE] peer supports MOBIKE
>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.6991]
>>> vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee
>>> Enterprises, LLC",0]: VPN connection: (IP Config Get) reply received.
>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.6997]
>>> vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee
>>> Enterprises, LLC",0]: VPN plugin: state changed: started (4)
>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.6997]
>>> vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee
>>> Enterprises, LLC",0]: VPN connection: (IP4 Config Get) reply received
>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7003]
>>> vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee
>>> Enterprises, LLC",0]: Data: VPN Gateway: 108.31.28.59
>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7003]
>>> vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee
>>> Enterprises, LLC",0]: Data: Tunnel Device: (null)
>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7003]
>>> vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee
>>> Enterprises, LLC",0]: Data: IPv4 configuration:
>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7003]
>>> vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee
>>> Enterprises, LLC",0]: Data: Internal Address: 10.10.10.1
>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7004]
>>> vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee
>>> Enterprises, LLC",0]: Data: Internal Prefix: 32
>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7004]
>>> vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee
>>> Enterprises, LLC",0]: Data: Internal Point-to-Point Address:
>>> 10.10.10.1
>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7004]
>>> vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee
>>> Enterprises, LLC",0]: Data: Internal DNS: 8.8.8.8
>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7004]
>>> vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee
>>> Enterprises, LLC",0]: Data: Internal DNS: 8.8.4.4
>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7004]
>>> vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee
>>> Enterprises, LLC",0]: Data: DNS Domain: '(none)'
>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7004]
>>> vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee
>>> Enterprises, LLC",0]: Data: No IPv6 configuration
>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7013]
>>> vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee
>>> Enterprises, LLC",0]: VPN connection: (IP Config Get) complete
>>
>> Unfortunately I am not seeing a tunnel interface being created and
>> routing added:
>>
>>> enp6s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
>>> ether b8:70:f4:2c:6b:9f txqueuelen 1000 (Ethernet)
>>> RX packets 1143393 bytes 1164336056 (1.1 GB)
>>> RX errors 0 dropped 20 overruns 0 frame 0
>>> TX packets 912738 bytes 112966285 (112.9 MB)
>>> TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
>>>
>>> lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
>>> inet 127.0.0.1 netmask 255.0.0.0
>>> inet6 ::1 prefixlen 128 scopeid 0x10<host>
>>> loop txqueuelen 1000 (Local Loopback)
>>> RX packets 95404 bytes 9207887 (9.2 MB)
>>> RX errors 0 dropped 0 overruns 0 frame 0
>>> TX packets 95404 bytes 9207887 (9.2 MB)
>>> TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
>>>
>>> wlp5s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
>>> inet 192.168.1.114 netmask 255.255.255.0 broadcast
>>> 192.168.1.255
>>> inet6 fe80::562f:7604:6d84:57ca prefixlen 64 scopeid
>>> 0x20<link>
>>> ether ac:81:12:a4:5e:43 txqueuelen 1000 (Ethernet)
>>> RX packets 5644 bytes 4264877 (4.2 MB)
>>> RX errors 0 dropped 0 overruns 0 frame 62520
>>> TX packets 6377 bytes 1007195 (1.0 MB)
>>> TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
>>> device interrupt 17
>>>
>>> dhdurgee at z560:~/Downloads$ route
>>> Kernel IP routing table
>>> Destination Gateway Genmask Flags Metric Ref Use
>>> Iface
>>> default _gateway 0.0.0.0 UG 20600 0
>>> 0 wlp5s0
>>> link-local 0.0.0.0 255.255.0.0 U 1000 0
>>> 0 wlp5s0
>>> 192.168.1.0 0.0.0.0 255.255.255.0 U 600 0 0
>>> wlp5s0
>>> dhdurgee at z560:~/Downloads$
>>
>> In case it is needed for reference, here is the ipsec.conf on the
>> server side:
>>
>>> config setup
>>> charondebug="ike 1, knl 1, cfg 1"
>>> uniqueids=no
>>>
>>> conn ikev2-vpn
>>> auto=add
>>> compress=no
>>> type=tunnel
>>> keyexchange=ikev2
>>> fragmentation=yes
>>> forceencaps=yes
>>> ike=aes256-sha1-modp2048,aes256-sha1-modp1024,3des-sha1-modp1024!
>>> esp=aes256-sha1,3des-sha1!
>>> dpdaction=clear
>>> dpddelay=300s
>>> rekey=no
>>> left=%any
>>> leftid=@durgeeenterprises.publicvm.com
>>> leftcert=/etc/ipsec.d/certs/vpn-server-cert.pem
>>> leftsendcert=always
>>> leftsubnet=0.0.0.0/0
>>> right=%any
>>> rightid=%any
>>> rightauth=eap-mschapv2
>>> rightsourceip=10.10.10.0/24
>>> rightdns=8.8.8.8,8.8.4.4
>>> rightsendcert=never
>>> eap_identity=%identity
>>
>> Here is the connection definition from
>> /etc/NewtorkManager/system-connections:
>>
>>> [connection]
>>> id=Durgee Enterprises, LLC
>>> uuid=72e4370d-ecfb-4e33-8572-5cf04431abb9
>>> type=vpn
>>> autoconnect=false
>>> permissions=user:dhdurgee:;
>>>
>>> [vpn]
>>> address=durgeeenterprises.publicvm.com
>>> certificate=/home/dhdurgee/Downloads/vpn_root_certificate.pem
>>> encap=no
>>> ipcomp=no
>>> method=eap
>>> password-flags=1
>>> proposal=no
>>> user=dhdurgee
>>> virtual=yes
>>> service-type=org.freedesktop.NetworkManager.strongswan
>>>
>>> [ipv4]
>>> dns-search=
>>> method=auto
>>>
>>> [ipv6]
>>> addr-gen-mode=stable-privacy
>>> dns-search=
>>> ip6-privacy=0
>>> method=auto
>>>
>>> [proxy]
>>
>> The listed connection was created via the GUI. I have screenshots of
>> the four pages from the GUI available for email as they violate size
>> restrictions of posting here..
>>
>> As the VPN connection is already working with android and windows
>> systems I want to make no changes to the ipsec.conf on the server.
>> All changes should be made to the linux connection.
>>
>> I can only assume there are revisions to be made, hopefully via the
>> GUI. Obviously if the GUI cannot address what is needed I can edit
>> the connection directly.
>>
>> Alternatively, am I misunderstanding what I am seeing and the tunnel
>> is actually being established? I see only the WiFi icon on the bar
>> at the bottom of the screen just as I do when opening the WiFi
>> connection. With another VPN service, now discontinued, I showed a
>> different icon indicating the secured tunnel was open. This other
>> discontinued service likewise created a tun interface and established
>> a route via that interface.
>>
>> If more information is required please let me know.
>>
>> Dave
>>
>>
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: vpn-policy.log
Type: text/x-log
Size: 1543 bytes
Desc: not available
URL: <http://lists.strongswan.org/pipermail/users/attachments/20210728/8fedcb00/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: vpn-state.log
Type: text/x-log
Size: 812 bytes
Desc: not available
URL: <http://lists.strongswan.org/pipermail/users/attachments/20210728/8fedcb00/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4492 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.strongswan.org/pipermail/users/attachments/20210728/8fedcb00/attachment-0002.bin>
More information about the Users
mailing list