IPSec with strongswan doesn't connect

Question

I'm trying to set up and IPSEC server with strong swan on 18.04

My ipsec.conf is:

# ipsec.conf - strongSwan IPsec configuration file
config setup
   charondebug="cfg 2"

conn ikev2-vpn
    auto=add
    compress=no
    type=tunnel
    keyexchange=ikev2
    fragmentation=no
    forceencaps=yes
    ike=aes256-sha1-modp1024,3des-sha1-modp1024!
    esp=aes256-sha1,3des-sha1!
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%any
    [email protected]
    leftcert=/etc/ssl/certs/domain.com.pem
    leftsendcert=always
    leftsubnet=0.0.0.0/0
    right=%any
    rightid=%any
    rightauth=eap-mschapv2
    rightdns=192.168.1.1
    rightsourceip=10.11.12.0/24
    rightsendcert=never
    eap_identity=%identity

My ipsec.secrets is

# This file holds shared secrets or RSA private keys for authentication.

# RSA private key for this host, authenticating it to any other host
# which knows the public part.

domain.com : RSA /etc/ssl/private/strongswan.key
user %any% : EAP "pass"

I have ufw set up to allow the traffic through, as far as I know:

administrator@fserver:~$ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
80,443/tcp (Apache Full)   ALLOW IN    Anywhere
22/tcp (OpenSSH)           ALLOW IN    Anywhere
137,138/udp (Samba)        ALLOW IN    Anywhere
139,445/tcp (Samba)        ALLOW IN    Anywhere
3389/tcp                   ALLOW IN    Anywhere
8085/tcp                   ALLOW IN    Anywhere
35000:36000/tcp            ALLOW IN    Anywhere                   # deluge
10000:20000/tcp            ALLOW IN    Anywhere                   # ftp passive
20:21/tcp                  ALLOW IN    Anywhere                   # ftp
990/tcp                    ALLOW IN    Anywhere                   # ftp tls
192.168.1.2/esp            ALLOW IN    Anywhere
500                        ALLOW IN    Anywhere                   # ipsec
4500                       ALLOW IN    Anywhere                   # ipsec
192.168.1.2/ah             ALLOW IN    Anywhere
80,443/tcp (Apache Full (v6)) ALLOW IN    Anywhere (v6)
22/tcp (OpenSSH (v6))      ALLOW IN    Anywhere (v6)
137,138/udp (Samba (v6))   ALLOW IN    Anywhere (v6)
139,445/tcp (Samba (v6))   ALLOW IN    Anywhere (v6)
3389/tcp (v6)              ALLOW IN    Anywhere (v6)
8085/tcp (v6)              ALLOW IN    Anywhere (v6)
35000:36000/tcp (v6)       ALLOW IN    Anywhere (v6)              # deluge
10000:20000/tcp (v6)       ALLOW IN    Anywhere (v6)              # ftp passive
20:21/tcp (v6)             ALLOW IN    Anywhere (v6)              # ftp
990/tcp (v6)               ALLOW IN    Anywhere (v6)              # ftp tls
500 (v6)                   ALLOW IN    Anywhere (v6)              # ipsec
4500 (v6)                  ALLOW IN    Anywhere (v6)              # ipsec

Unfortunately, I can't connect on windows 10. When I attempt to connect on windows, it sits on "Verifying your Sign-in Info" then stops with an error message that the connection could not be made because the server stopped responding.

My syslog shows:

Jul  3 11:20:51 fserver charon: 13[NET] received packet: from 142.68.61.15[500] to 192.168.1.2[500] (1144 bytes)
Jul  3 11:20:51 fserver charon: 13[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) V V V V ]
Jul  3 11:20:51 fserver ipsec[4349]: 06[ENC] generating INFORMATIONAL_V1 request 3859798652 [ N(NO_PROP) ]
Jul  3 11:20:51 fserver ipsec[4349]: 06[NET] sending packet: from 192.168.1.2[500] to 216.218.206.70[50231] (40 bytes)
Jul  3 11:20:51 fserver ipsec[4349]: 08[NET] received packet: from 216.218.206.98[28703] to 192.168.1.2[500] (64 bytes)
Jul  3 11:20:51 fserver ipsec[4349]: 08[ENC] parsed ID_PROT request 0 [ SA ]
Jul  3 11:20:51 fserver ipsec[4349]: 08[CFG] looking for an ike config for 192.168.1.2...216.218.206.98
Jul  3 11:20:51 fserver ipsec[4349]: 08[IKE] no IKE config found for 192.168.1.2...216.218.206.98, sending NO_PROPOSAL_CHOSEN
Jul  3 11:20:51 fserver ipsec[4349]: 08[ENC] generating INFORMATIONAL_V1 request 1302012061 [ N(NO_PROP) ]
Jul  3 11:20:51 fserver ipsec[4349]: 08[NET] sending packet: from 192.168.1.2[500] to 216.218.206.98[28703] (40 bytes)
Jul  3 11:20:51 fserver ipsec[4349]: 10[NET] received packet: from 142.68.61.15[500] to 192.168.1.2[500] (1144 bytes)
Jul  3 11:20:51 fserver ipsec[4349]: 10[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) V V V V ]
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG] looking for an ike config for 192.168.1.2...142.68.61.15
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG]   candidate: %any...%any, prio 28
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG] found matching ike config: %any...%any with prio 28
Jul  3 11:20:51 fserver ipsec[4349]: 10[IKE] received MS NT5 ISAKMPOAKLEY v9 vendor ID
Jul  3 11:20:51 fserver ipsec[4349]: 10[IKE] received MS-Negotiation Discovery Capable vendor ID
Jul  3 11:20:51 fserver ipsec[4349]: 10[IKE] received Vid-Initial-Contact vendor ID
Jul  3 11:20:51 fserver ipsec[4349]: 10[ENC] received unknown vendor ID: 01:52:8b:bb:c0:06:96:12:18:49:ab:9a:1c:5b:2a:51:00:00:00:02
Jul  3 11:20:51 fserver ipsec[4349]: 10[IKE] 142.68.61.15 is initiating an IKE_SA
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG] selecting proposal:
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG] selecting proposal:
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG] selecting proposal:
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG] selecting proposal:
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG] selecting proposal:
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG] selecting proposal:
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG] selecting proposal:
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG] selecting proposal:
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG] selecting proposal:
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG] selecting proposal:
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG]   proposal matches
Jul  3 11:20:51 fserver charon: 13[CFG] looking for an ike config for 192.168.1.2...142.68.61.15
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG] received proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:3DES_CBC/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC_128/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_CBC_192/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_192/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_GCM_16_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_GCM_16_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_GCM_16_128/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_GCM_16_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_GCM_16_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_GCM_16_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG] configured proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Jul  3 11:20:51 fserver ipsec[4349]: 10[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Jul  3 11:20:51 fserver ipsec[4349]: 10[IKE] local host is behind NAT, sending keep alives
Jul  3 11:20:51 fserver ipsec[4349]: 10[IKE] remote host is behind NAT
Jul  3 11:20:51 fserver ipsec[4349]: 10[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
Jul  3 11:20:51 fserver ipsec[4349]: 10[NET] sending packet: from 192.168.1.2[500] to 142.68.61.15[500] (312 bytes)
Jul  3 11:20:51 fserver ipsec[4349]: 11[IKE] sending keep alive to 142.68.61.15[500]
Jul  3 11:20:51 fserver ipsec[4349]: 12[JOB] deleting half open IKE_SA with 142.68.61.15 after timeout
Jul  3 11:20:51 fserver ipsec[4349]: 13[NET] received packet: from 142.68.61.15[500] to 192.168.1.2[500] (1144 bytes)
Jul  3 11:20:51 fserver ipsec[4349]: 13[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) V V V V ]
Jul  3 11:20:51 fserver ipsec[4349]: 13[CFG] looking for an ike config for 192.168.1.2...142.68.61.15
Jul  3 11:20:51 fserver ipsec[4349]: 13[CFG]   candidate: %any...%any, prio 28
Jul  3 11:20:51 fserver ipsec[4349]: 13[CFG] found matching ike config: %any...%any with prio 28
Jul  3 11:20:51 fserver charon: 13[CFG]   candidate: %any...%any, prio 28
Jul  3 11:20:51 fserver ipsec[4349]: 13[IKE] received MS NT5 ISAKMPOAKLEY v9 vendor ID
Jul  3 11:20:51 fserver charon: 13[CFG] found matching ike config: %any...%any with prio 28
Jul  3 11:20:51 fserver charon: 13[IKE] received MS NT5 ISAKMPOAKLEY v9 vendor ID
Jul  3 11:20:51 fserver charon: 13[IKE] received MS-Negotiation Discovery Capable vendor ID
Jul  3 11:20:51 fserver charon: 13[IKE] received Vid-Initial-Contact vendor ID
Jul  3 11:20:51 fserver charon: 13[ENC] received unknown vendor ID: 01:52:8b:bb:c0:06:96:12:18:49:ab:9a:1c:5b:2a:51:00:00:00:02
Jul  3 11:20:51 fserver charon: 13[IKE] 142.68.61.15 is initiating an IKE_SA
Jul  3 11:20:51 fserver charon: 13[CFG] selecting proposal:
Jul  3 11:20:51 fserver charon: 13[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver charon: 13[CFG] selecting proposal:
Jul  3 11:20:51 fserver charon: 13[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver charon: 13[CFG] selecting proposal:
Jul  3 11:20:51 fserver charon: 13[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver charon: 13[CFG] selecting proposal:
Jul  3 11:20:51 fserver charon: 13[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver charon: 13[CFG] selecting proposal:
Jul  3 11:20:51 fserver charon: 13[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver charon: 13[CFG] selecting proposal:
Jul  3 11:20:51 fserver charon: 13[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver charon: 13[CFG] selecting proposal:
Jul  3 11:20:51 fserver charon: 13[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver charon: 13[CFG] selecting proposal:
Jul  3 11:20:51 fserver charon: 13[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver charon: 13[CFG] selecting proposal:
Jul  3 11:20:51 fserver charon: 13[CFG]   no acceptable ENCRYPTION_ALGORITHM found
Jul  3 11:20:51 fserver charon: 13[CFG] selecting proposal:
Jul  3 11:20:51 fserver charon: 13[CFG]   proposal matches
Jul  3 11:20:51 fserver charon: 13[CFG] received proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:3DES_CBC/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC_128/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_CBC_192/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_192/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_GCM_16_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_GCM_16_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_GCM_16_128/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_GCM_16_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_GCM_16_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_GCM_16_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024
Jul  3 11:20:51 fserver charon: 13[CFG] configured proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Jul  3 11:20:51 fserver charon: 13[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Jul  3 11:20:51 fserver charon: 13[IKE] local host is behind NAT, sending keep alives
Jul  3 11:20:51 fserver charon: 13[IKE] remote host is behind NAT
Jul  3 11:20:51 fserver charon: 13[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
Jul  3 11:20:51 fserver charon: 13[NET] sending packet: from 192.168.1.2[500] to 142.68.61.15[500] (312 bytes)
Jul  3 11:21:11 fserver charon: 15[IKE] sending keep alive to 142.68.61.15[500]
Jul  3 11:21:21 fserver charon: 01[JOB] deleting half open IKE_SA with 142.68.61.15 after timeout

It looks like windows doesn't send any more packets. I've forwarded ports 500 and 4500.

Maybe it's that ufw isn't set up properly, and I'm willing to dig into iptables, but would rather not if I don't have to.

ecdsa · Accepted Answer · 2018-07-04 09:04:49Z

0

If you can rule out a firewall blocking the requests, a possible reason for this is IP fragmentation (you could check with tcpdump/Wireshark to see if messages are sent/received).

If the IKE_AUTH message gets too big (e.g. because of large client certificates, or lots of certificate requests) it is split up into multiple IP fragments. Such fragments often are dropped by firewalls/routers.

An option to avoid this is using IKEv2 fragmentation, but not all clients support this extension yet. For instance, Windows 10 did not support it until the 2018 spring update. But if you update your client you should be able to set fragmentation=yes to use IKEv2 fragmentation.

answered Jul 4, 2018 at 9:04

ecdsa

2942 silver badges6 bronze badges

I did try disabling ufw altogether and no luck. So it's not that. I had fragmentation on before but it didn't help. I'd actually read that turning it off was a possible solution.
– Kayson
Jul 4, 2018 at 12:18
Wherever you read that, it's wrong (there is basically never a reason to disable fragmentation). But since you don't use the latest version of Windows 10 (you'd see a N(FRAG_SUP) notify in the IKE_SA_INIT request if you did) enabling it won't help either. To rule out that any intermediate firewall/router blocks packets on port 4500 try capturing traffic on the server and look for IP fragments with such a UDP header (there are some routers that mistreat IKE packets if functions like IPsec passthrough etc. are enabled).
– ecdsa
Jul 4, 2018 at 13:09
turns out I fat-fingered the portforward. Now it gets the connection going but windows complains about the ike authentication credentials. new problem i guess
– Kayson
Jul 4, 2018 at 20:03
Yes, could be a number of things (e.g. a missing CA certificate, some parameters in the server certificate unsuitable, incorrect username/password etc.). Either create a new question, or add the new server logs to this one so we can have a look at which stage the client aborts (the exact error message on the client could help too, although, these are usually not as helpful as one would like).
– ecdsa
Jul 5, 2018 at 8:11

Add a comment |

Abhimanyu · Accepted Answer · 2020-06-04 04:32:55Z

0

It seems like you are missing some plugins. Try installing libcharon-extra-plugins in your ubuntu.

sudo apt-get install libcharon-extra-plugins

answered Jun 4, 2020 at 4:32

Abhimanyu

1

Add a comment |

Kayson · Accepted Answer · 2020-06-05 16:44:59Z

0

The initial problem, as mentioned in comments, was a typo in the port forwarding. The subsequent problem was due to the Let's Encrypt intermediate certificates not being sent over, despite being a part of the chain file. Had to manually place it in /etc/ipsec.d/cacerts.

I highly recommend using the Strongswan mobile app for debug as it has very useful log info, compared to Windows which was mostly useless.

answered Jun 5, 2020 at 16:44

Kayson

1111 silver badge3 bronze badges

Add a comment |

Stack Exchange Network

IPSec with strongswan doesn't connect

3 Answers 3

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
networking
server
ipsec
.

Hot Network Questions

IPSec with strongswan doesn't connect

3 Answers 3

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged networkingserveripsec.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
networking
server
ipsec
.