Differences

This shows you the differences between two versions of the page.

--- network_stuff:vpn_troubleshooting [2020/04/12 15:04] – jotasandoku
+++ network_stuff:vpn_troubleshooting [2023/11/02 14:38] (current) – external edit 127.0.0.1
@@ Line 70: / Line 70: @@
-----
-**OPENVPN SERVER RASPBERRY PI**
-[[https://dzone.com/articles/how-to-setup-an-openvpn-server-on-a-raspberry-pi]]\\
-  curl -L https://install.pivpn.io | bash
-  # set it as static, you shoud have configured the dhcp reservation and port forwarding in the gw before this!
-  pivpn add nopass # to create profiles. IMPORTANT: in the .ovpn you have the static pub ip, Replece it with the DNS entry!
-  #
-  /var/log/openvpn-status.log       # just 3-4 lines with status
-  /var/log/openvpn.log
-  /etc/openvpn/server.conf
-  # all fields nicely explained here : https://github.com/OpenVPN/openvpn/blob/master/sample/sample-config-files/server.conf
@@ Line 144: / Line 132: @@
   May  9 05:16:22 observium xl2tpd: xl2tpd[23954]: Connection 61860 closed to 148.64.56.150, port 1701 (Timeout)
+LIBRESWAN STRONGSWAN NOTES:
+  * [[https://docs.cloud.mycompany2.com/en-us/iaas/Content/Network/Concepts/libreswan.htm]]
+  * [[https://dc77312.wordpress.com/2019/01/08/libreswan-ipsec-vpn-on-centos-7-and-windows-10/]]
+  * pluto is is an IKE ("IPsec Key Exchange") daemon
+  yum install libreswan
+  ipsec initnss
+  systemctl enable ipsec
+  systemctl start ipsec
+  # Use this to add and bring up the tunnel and see the exchange!
+  ipsec auto --add mycompany2-tunnel-1
+  ipsec auto --up mycompany2-tunnel-1
+  * In the vnic: "tick skip Source/Dest Checks"
+  * modify  /etc/sysctl.conf for forwarding [[https://www.tecmint.com/setup-ipsec-vpn-with-strongswan-on-centos-rhel-8/|External Link]]. In '/etc/sysctl.d' create a file named 50-libreswan.conf with that content
+  # https://libreswan.org/man/ipsec.conf.5.html
+  conn mycompany2-tunnel-1
+       left=10.156.0.23
+       # leftid=193.123.39.207 # This is the public IP (nat-t)
+       right=148.64.56.151
+       authby=secret
+       leftsubnet=10.181.181.0/24
+       rightsubnet=10.8.0.8/23
+       auto=start
+       mark=5/0xffffffff # Needs to be unique across all tunnels
+       vti-interface=vti0
+       vti-routing=no
+       ikev2=insist # To use IKEv2, change to ikev2=insist
+       ike=aes_cbc256-sha2_384;modp1536     # "cipher-hash;modpgroup,.."IKE encryption/authentication algorithm (and dh-modpgroup) to be used for the connection (phase 1 aka ISAKMP SA).
+       phase2alg=aes_gcm256;modp1536  # (alias esp) . Algorithms that will be offered/accepted for a phase2 negotiatio (~transform set) .format for ESP is ENC-AUTH followed by one optional PFSgroup. For instance, "3des-md5" or "aes256-sha1;modp2048" or "aes-sha1,aes-md5". When specifying multiple algorithms, specify the PFSgroup last, e.g. "3des-md5,aes256-sha1;modp2048".
+       encapsulation=yes
+       ikelifetime=28800s
+       salifetime=3600s
+  cat /etc/ipsec.d/oci-ipsec.secrets
+  my-pub-ip x-end-pub-ip : PSK "a64-charslongrandomstringgeneratedwithpwgenoropensslorothertool"
+----
+CLASSY IPSEC-VPN TROUBLESHOOT:
+  * [[http://www.twine-networks.com/blog/posts/5-troubleshooting-ipsec-log-messages]]
+  * [[https://www.blackhole-networks.com/IKE_Modes/ikev1-quick.html]]

dokucama

User Tools

Site Tools

Differences

Page Tools