[strongSwan] revisiting problem with linux to VPN using network-manager-strongswan 1.4.5-2.1

Noel Kuntze noel.kuntze at thermi.consulting
Thu Jul 29 14:07:12 CEST 2021


Hello David,

Yes, that shows that it is working.

Kind regards
Noel

Am 28.07.21 um 22:31 schrieb David H Durgee:
> I did a bit more checking and found references to "ip xfrm policy list" and "ip xfrm state list" as possible sources of the confirmation of operation I am seeking.  I ran these commands with the VPN up and have attached the output of these commands.
>
> I am not trained in reading these reports, but what I see does appear to indicate that the VPN is indeed functioning and handling the traffic as requested.  If someone who is trained could confirm this for me I would appreciate it.
>
> Dave
>
>> Noel Kuntze wrote:  Hello David,
>>
>> strongSwan by default builds policy based tunnels, not route based tunnels.
>> Thus no interface is needed or created.
>> Read up on how IPsec works on the wiki to get an understanding for it.
>>
>> GUI indicators are not inherently related to if any tunnel exists, or works.
>>
>> Kind regards
>> Noel
>>
>> Am 01.07.21 um 20:31 schrieb David H Durgee:
>>> I thought it might make sense to revisit this after the progress that has been made. It now appears that the connection is being established:
>>>
>>>> Jun 29 11:21:34 Z560 charon-nm: 11[IKE] authentication of 'durgeeenterprises.publicvm.com' with EAP successful
>>>> Jun 29 11:21:34 Z560 charon-nm: 11[IKE] IKE_SA Durgee Enterprises, LLC[7] established between 192.168.1.114[dhdurgee]...108.31.28.59[durgeeenterprises.publicvm.com]
>>>> Jun 29 11:21:34 Z560 charon-nm: 11[IKE] scheduling rekeying in 35705s
>>>> Jun 29 11:21:34 Z560 charon-nm: 11[IKE] maximum IKE_SA lifetime 36305s
>>>> Jun 29 11:21:34 Z560 charon-nm: 11[IKE] installing new virtual IP 10.10.10.1
>>>> Jun 29 11:21:34 Z560 avahi-daemon[750]: Registering new address record for 10.10.10.1 on wlp5s0.IPv4.
>>>> Jun 29 11:21:34 Z560 charon-nm: 11[CFG] selected proposal: ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ
>>>> Jun 29 11:21:34 Z560 charon-nm: 11[IKE] CHILD_SA Durgee Enterprises, LLC{4} established with SPIs c8cad4e5_i c3f2eec4_o and TS 10.10.10.1/32 === 0.0.0.0/0
>>>> Jun 29 11:21:34 Z560 charon-nm: 11[IKE] peer supports MOBIKE
>>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.6991] vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee Enterprises, LLC",0]: VPN connection: (IP Config Get) reply received.
>>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.6997] vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee Enterprises, LLC",0]: VPN plugin: state changed: started (4)
>>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.6997] vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee Enterprises, LLC",0]: VPN connection: (IP4 Config Get) reply received
>>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7003] vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee Enterprises, LLC",0]: Data: VPN Gateway: 108.31.28.59
>>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7003] vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee Enterprises, LLC",0]: Data: Tunnel Device: (null)
>>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7003] vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee Enterprises, LLC",0]: Data: IPv4 configuration:
>>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7003] vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee Enterprises, LLC",0]: Data:   Internal Address: 10.10.10.1
>>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7004] vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee Enterprises, LLC",0]: Data:   Internal Prefix: 32
>>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7004] vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee Enterprises, LLC",0]: Data:   Internal Point-to-Point Address: 10.10.10.1
>>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7004] vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee Enterprises, LLC",0]: Data:   Internal DNS: 8.8.8.8
>>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7004] vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee Enterprises, LLC",0]: Data:   Internal DNS: 8.8.4.4
>>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7004] vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee Enterprises, LLC",0]: Data:   DNS Domain: '(none)'
>>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7004] vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee Enterprises, LLC",0]: Data: No IPv6 configuration
>>>> Jun 29 11:21:34 Z560 NetworkManager[758]: <info> [1624980094.7013] vpn-connection[0x562fdb93c2f0,72e4370d-ecfb-4e33-8572-5cf04431abb9,"Durgee Enterprises, LLC",0]: VPN connection: (IP Config Get) complete
>>>
>>> Unfortunately I am not seeing a tunnel interface being created and routing added:
>>>
>>>> enp6s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
>>>>         ether b8:70:f4:2c:6b:9f  txqueuelen 1000  (Ethernet)
>>>>         RX packets 1143393  bytes 1164336056 (1.1 GB)
>>>>         RX errors 0  dropped 20  overruns 0  frame 0
>>>>         TX packets 912738  bytes 112966285 (112.9 MB)
>>>>         TX errors 0  dropped 0 overruns 0  carrier 0 collisions 0
>>>>
>>>> lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
>>>>         inet 127.0.0.1  netmask 255.0.0.0
>>>>         inet6 ::1  prefixlen 128  scopeid 0x10<host>
>>>>         loop  txqueuelen 1000  (Local Loopback)
>>>>         RX packets 95404  bytes 9207887 (9.2 MB)
>>>>         RX errors 0  dropped 0  overruns 0  frame 0
>>>>         TX packets 95404  bytes 9207887 (9.2 MB)
>>>>         TX errors 0  dropped 0 overruns 0  carrier 0 collisions 0
>>>>
>>>> wlp5s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
>>>>         inet 192.168.1.114  netmask 255.255.255.0  broadcast 192.168.1.255
>>>>         inet6 fe80::562f:7604:6d84:57ca  prefixlen 64 scopeid 0x20<link>
>>>>         ether ac:81:12:a4:5e:43  txqueuelen 1000  (Ethernet)
>>>>         RX packets 5644  bytes 4264877 (4.2 MB)
>>>>         RX errors 0  dropped 0  overruns 0  frame 62520
>>>>         TX packets 6377  bytes 1007195 (1.0 MB)
>>>>         TX errors 0  dropped 0 overruns 0  carrier 0 collisions 0
>>>>         device interrupt 17
>>>>
>>>> dhdurgee at z560:~/Downloads$ route
>>>> Kernel IP routing table
>>>> Destination     Gateway         Genmask         Flags Metric Ref Use Iface
>>>> default         _gateway        0.0.0.0         UG    20600 0        0 wlp5s0
>>>> link-local      0.0.0.0         255.255.0.0     U     1000 0        0 wlp5s0
>>>> 192.168.1.0     0.0.0.0         255.255.255.0   U     600 0        0 wlp5s0
>>>> dhdurgee at z560:~/Downloads$
>>>
>>> In case it is needed for reference, here is the ipsec.conf on the server side:
>>>
>>>> config setup
>>>>   charondebug="ike 1, knl 1, cfg 1"
>>>>   uniqueids=no
>>>>
>>>> conn ikev2-vpn
>>>>   auto=add
>>>>   compress=no
>>>>   type=tunnel
>>>>   keyexchange=ikev2
>>>>   fragmentation=yes
>>>>   forceencaps=yes
>>>> ike=aes256-sha1-modp2048,aes256-sha1-modp1024,3des-sha1-modp1024!
>>>>   esp=aes256-sha1,3des-sha1!
>>>>   dpdaction=clear
>>>>   dpddelay=300s
>>>>   rekey=no
>>>>   left=%any
>>>>   leftid=@durgeeenterprises.publicvm.com
>>>>   leftcert=/etc/ipsec.d/certs/vpn-server-cert.pem
>>>>   leftsendcert=always
>>>>   leftsubnet=0.0.0.0/0
>>>>   right=%any
>>>>   rightid=%any
>>>>   rightauth=eap-mschapv2
>>>>   rightsourceip=10.10.10.0/24
>>>>   rightdns=8.8.8.8,8.8.4.4
>>>>   rightsendcert=never
>>>>   eap_identity=%identity
>>>
>>> Here is the connection definition from /etc/NewtorkManager/system-connections:
>>>
>>>> [connection]
>>>> id=Durgee Enterprises, LLC
>>>> uuid=72e4370d-ecfb-4e33-8572-5cf04431abb9
>>>> type=vpn
>>>> autoconnect=false
>>>> permissions=user:dhdurgee:;
>>>>
>>>> [vpn]
>>>> address=durgeeenterprises.publicvm.com
>>>> certificate=/home/dhdurgee/Downloads/vpn_root_certificate.pem
>>>> encap=no
>>>> ipcomp=no
>>>> method=eap
>>>> password-flags=1
>>>> proposal=no
>>>> user=dhdurgee
>>>> virtual=yes
>>>> service-type=org.freedesktop.NetworkManager.strongswan
>>>>
>>>> [ipv4]
>>>> dns-search=
>>>> method=auto
>>>>
>>>> [ipv6]
>>>> addr-gen-mode=stable-privacy
>>>> dns-search=
>>>> ip6-privacy=0
>>>> method=auto
>>>>
>>>> [proxy]
>>>
>>> The listed connection was created via the GUI.  I have screenshots of the four pages from the GUI available for email as they violate size restrictions of posting here..
>>>
>>> As the VPN connection is already working with android and windows systems I want to make no changes to the ipsec.conf on the server. All changes should be made to the linux connection.
>>>
>>> I can only assume there are revisions to be made, hopefully via the GUI.  Obviously if the GUI cannot address what is needed I can edit the connection directly.
>>>
>>> Alternatively, am I misunderstanding what I am seeing and the tunnel is actually being established?  I see only the WiFi icon on the bar at the bottom of the screen just as I do when opening the WiFi connection. With another VPN service, now discontinued, I showed a different icon indicating the secured tunnel was open.  This other discontinued service likewise created a tun interface and established a route via that interface.
>>>
>>> If more information is required please let me know.
>>>
>>> Dave
>>>
>>>
>>
>


-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://lists.strongswan.org/pipermail/users/attachments/20210729/c6162a2a/attachment.sig>


More information about the Users mailing list