1

I am attempting to establish a VPN connection between two regions in AWS EC2 (two virtual machines) using StrongSwan within Docker. However, I am getting a ton of errors when trying to start the connection.

The commands sudo ipsec start --nofork and sudo ipsec restart give the following errors, respectively:

Starting strongSwan 5.3.5 IPsec [starter]...
ipsec_starter[374]: Starting strongSwan 5.3.5 IPsec [starter]...

00[LIB] expanding file pattern '/etc/strongswan.d/charon/*.conf' failed: Permission denied
00[LIB] expanding file pattern '/etc/strongswan.d/*.conf' failed: Permission denied
00[DMN] Starting IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-1065-aws, x86_64)
00[LIB] feature CUSTOM:libcharon in critical plugin 'charon' has unmet dependency: NONCE_GEN
00[LIB] feature CUSTOM:libcharon-receiver in critical plugin 'charon' has unmet dependency: HASHER:HASH_SHA1
00[LIB] feature CUSTOM:libcharon-sa-managers in critical plugin 
'charon' has unmet dependency: HASHER:HASH_SHA1 00[LIB] failed to load 3 critical plugin features
00[DMN] initialization failed - aborting charon
charon has quit: initialization failed
ipsec_starter[374]: charon has quit: initialization failed

charon refused to be started
ipsec_starter[374]: charon refused to be started

ipsec starter stopped
ipsec_starter[374]: ipsec starter stopped

and

Stopping strongSwan IPsec failed: starter is not running
Starting strongSwan 5.3.5 IPsec [starter]...
ipsec_starter[389]: Starting strongSwan 5.3.5 IPsec [starter]...

root@b65e01b190f6:/etc# ipsec_starter[408]: charon has quit: 
initialization failed

ipsec_starter[408]: charon refused to be started

ipsec_starter[408]: ipsec starter stopped

(The second one hangs after the last command and must be exited with Ctrl+C)

To fix some errors, I commented out the line:

load_modular = yes

in the file:

/etc/strongswan.conf

Now running the same commands output:

Starting strongSwan 5.3.5 IPsec [starter]...
ipsec_starter[413]: Starting strongSwan 5.3.5 IPsec [starter]...

00[LIB] expanding file pattern '/etc/strongswan.d/charon/*.conf' failed: Permission denied
00[LIB] expanding file pattern '/etc/strongswan.d/*.conf' failed: Permission denied
00[DMN] Starting IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-1065-aws, x86_64)
00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
00[LIB] opening directory '/etc/ipsec.d/cacerts' failed: Permission denied
00[CFG]   reading directory failed
00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
00[LIB] opening directory '/etc/ipsec.d/aacerts' failed: Permission denied
00[CFG]   reading directory failed
00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
00[LIB] opening directory '/etc/ipsec.d/ocspcerts' failed: Permission denied
00[CFG]   reading directory failed
00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
00[LIB] opening directory '/etc/ipsec.d/acerts' failed: Permission denied
00[CFG]   reading directory failed
00[CFG] loading crls from '/etc/ipsec.d/crls'
00[LIB] opening directory '/etc/ipsec.d/crls' failed: Permission denied
00[CFG]   reading directory failed
00[CFG] loading secrets from '/etc/ipsec.secrets'
00[CFG]   loaded IKE secret for B.B.B.B X.X.X.X
00[LIB] loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac ccm gcm attr kernel-netlink resolve socket-default connmark stroke updown
00[LIB] dropped capabilities, running as uid 0, gid 0
00[JOB] spawning 16 worker threads
charon (426) started after 20 ms
ipsec_starter[413]: charon (426) started after 20 ms

11[CFG] received stroke: add connection 'A-to-B'
11[CFG] left nor right host is our side, assuming left=local
11[CFG] algorithm 'sha_256' not recognized
11[CFG] skipped invalid proposal string: aes256-sha_256-modp1024
11[CFG] added configuration 'A-to-B'
13[CFG] received stroke: initiate 'A-to-B'
13[IKE] initiating IKE_SA A-to-B[1] to X.X.X.X
13[IKE] configured DH group MODP_NONE not supported
13[MGR] tried to check-in and delete nonexisting IKE_SA

and

Stopping strongSwan IPsec failed: starter is not running
Starting strongSwan 5.3.5 IPsec [starter]...
ipsec_starter[444]: Starting strongSwan 5.3.5 IPsec [starter]...

root@b65e01b190f6:/etc# ipsec_starter[463]: charon (464) started after 20 ms

Now both commands hang there and so I'm not sure if commenting out that line helped at all.

The expanding file pattern '/etc/strongswan.d/charon/*.conf' failed: Permission denied lines likely cause many of my errors but I'm not sure how to fix that since I am already root within Docker.

I am including part of my Dockerfile as well incase that may help:

FROM ubuntu:16.04

RUN apt update && apt install -y --no-install-recommends apt-utils
RUN apt -y install sudo
RUN apt upgrade -y
RUN apt install strongswan -y
RUN apt install nano -y
RUN apt install openssh-client -y
RUN apt install kmod
RUN echo "IdentityFile ~/.ssh/id_rsa" >> /etc/ssh/ssh_config
RUN sudo rm /etc/ipsec.conf
RUN touch /etc/ipsec.conf
RUN echo "# basic configuration" >> /etc/ipsec.conf \
    && echo "config setup" >> /etc/ipsec.conf \
    && echo '    charondebug="all"' >> /etc/ipsec.conf \
    && echo "    uniqueids=yes" >> /etc/ipsec.conf \
    && echo "    strictcrlpolicy=no" >> /etc/ipsec.conf \
    && echo "" >> /etc/ipsec.conf \
    && echo "conn A-to-B" >> /etc/ipsec.conf \
    && echo "    authby=secret" >> /etc/ipsec.conf \
    && echo "    left=A.A.A.A" >> /etc/ipsec.conf \
    && echo "    leftid=B.B.B.B" >> /etc/ipsec.conf \
    && echo "    leftsubnet=A.C.C.C/16" >> /etc/ipsec.conf \
    && echo "    right=X.X.X.X" >> /etc/ipsec.conf \
    && echo "    rightsubnet=Y.Y.Y.Y/16" >> /etc/ipsec.conf \
    && echo "    ike=aes256-sha_256-modp1024!" >> /etc/ipsec.conf \
    && echo "    esp=aes256-sha2_256!" >> /etc/ipsec.conf \
    && echo "    keyingtries=0" >> /etc/ipsec.conf \
    && echo "    ikelifetime=1h" >> /etc/ipsec.conf \
    && echo "    lifetime=8h" >> /etc/ipsec.conf \
    && echo "    dpddelay=30" >> /etc/ipsec.conf \
    && echo "    dpdtimeout=120" >> /etc/ipsec.conf \
    && echo "    dpdaction=restart" >> /etc/ipsec.conf \
    && echo "    auto=start" >> /etc/ipsec.conf
RUN sudo rm /etc/ipsec.secrets
RUN touch /etc/ipsec.secrets
RUN echo "'B.B.B.B X.X.X.X : PSK "mykey"' >> /etc/ipsec.secrets
RUN echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
RUN sudo sysctl -p /etc/sysctl.conf

The Dockerfile on the other instance is pretty much the same thing with the IPs swapped.

EDIT: UPDATE (NOT PART OF ORIGINAL QUESTION)

I switched encryption algorithms because mod1024 is not strong enough for strongSwan's standards anymore. I am now using:

ike=aes128gcm16-prfsha256-ecp256,aes256gcm16-prfsha384-ecp384!
esp=aes128gcm16-ecp256,aes256gcm16-ecp384!

and that fixed a few errors. I also was using the command:

sudo docker run -itv ~:/mnt/ nameHere bash

but added the tag --cap-add=NET_ADMIN and all the pre-connecting errors have gone away. However, there is a new error when trying to connect where the connection will time out after 5 attempts.

root@aaaaaaaaaa:/etc# sudo ipsec start --nofork
Starting strongSwan 5.3.5 IPsec [starter]...
ipsec_starter[482]: Starting strongSwan 5.3.5 IPsec [starter]...

00[DMN] Starting IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-1065-aws, x86_64)
00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
00[CFG] loading crls from '/etc/ipsec.d/crls'
00[CFG] loading secrets from '/etc/ipsec.secrets'
00[CFG]   loaded IKE secret for X.X.X.X Y.Y.Y.Y
00[LIB] loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown
00[LIB] dropped capabilities, running as uid 0, gid 0
00[JOB] spawning 16 worker threads
charon (495) started after 20 ms
ipsec_starter[482]: charon (495) started after 20 ms

11[CFG] received stroke: add connection 'A-to-B'
11[CFG] left nor right host is our side, assuming left=local
11[CFG] added configuration 'A-to-B'
13[CFG] received stroke: initiate 'A-to-B'
13[IKE] initiating IKE_SA A-to-B[1] to Y.Y.Y.Y
13[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HASH_ALG) ]
13[NET] sending packet: from X.X.X.X[500] to Y.Y.Y.Y[500] (284 bytes)
10[NET] error writing to socket: Invalid argument
15[IKE] retransmit 1 of request with message ID 0
15[NET] sending packet: from X.X.X.X (private ip)[500] to Y.Y.Y.Y (public ip of other connection)[500] (284 bytes)
10[NET] error writing to socket: Invalid argument
.
.
.
04[IKE] retransmit 5 of request with message ID 0
04[NET] sending packet: from X.X.X.X (private ip)[500] to Y.Y.Y.Y (public ip of other connection)[500] (284 bytes)
10[NET] error writing to socket: Invalid argument
03[IKE] giving up after 5 retransmits
03[IKE] establishing IKE_SA failed, peer not responding

And it is now hanging here until I kill it with another CTRL+C. Any ideas would be greatly appreciated.

  • The last error might be because you configured a local IP address that's not actually available in the container (i.e. x.x.x.x is not a valid address to send packets from). – ecdsa Sep 11 '18 at 9:32
  • I got this working in a normal virtual machine so I do not think it would be that. I now think the error is my inability to set net.ipv4.ip_forward=1 using the sysctl -p command. Here is the build error: sysctl: setting key "net.ipv4.ip_forward": Read-only file system. Any idea how I can set that during my build instead of having to run it in a privileged container? – vtbiggi Sep 12 '18 at 15:50
  • I think adding --sysctl net.ipv4.ip_forward=1 to my docker run ... is a decent enough fix but the connection still doesn't work in a container – vtbiggi Sep 12 '18 at 16:37

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.