I have a requirement to set up IPsec VPN between my company's droplet and a network owned by partner company that uses another provider. Tooling:

  • Debian (my droplet) with IP e.g and local address e.g
  • IPsec-Tools & Racoon (Racoon in itself is not required - LibreSwan or StrongSwan are also acceptable, though I have a feeling that might not be the issue)
  • mode = Tunnel
  • ESP

I've created a test environment in order to try out the tooling and feasibility of the task, consisting of 2 Droplets that I managed to connect according to the points above, and managed to achieve what I wanted (while testing with my own droplets).

Onto the real case - here's the description of the remote server (owned by the partner company):

  • entry point has a firewall (my droplet is white-listed) - e.g public IP
  • service running on my droplet needs to connect to a service behind this public IP, e.g internal IP
  • remote network has mapped my internal address in their network interface

I have managed to set up a VPN tunnel between my droplet and the remote network, according to:

  • racoonctl show-sa ipsec showing both in and out directions of the tunnel, with esp mode=tunnel and state=mature
  • racoonctl -l show-sa isakmp is showing correct destination and Phase 2 = 1, also logs are reporting that connection is successfully made

However, when I try to ping the address, it hangs, and when partner service pings my internal IP (that I mapped in Security Association Database) they tell me this IP is unreachable. I don't see ESP packets going out.

I have following suspicions:

  • my and/or partner networks are using NAT, while we both configured our VPNs with NAT Traversal = OFF;
  • DigitalOcean does not allow IPsec VPNs to other providers, due to some internal networking rules to protect our droplets Can someone point me in the right direction? I would be most grateful to whomever could share some knowledge on this topic with me.

Help is appreciated!

  • Are you strictly required to use racoon, rather than something from the current era such as strongSwan or LibreSwan? – grawity Jan 28 at 12:16
  • Do you see ESP packets going out from your system, and does the other system see them coming in? Does the other system have a route for your internal address through eth0? – grawity Jan 28 at 12:19
  • @grawity I'm not required to use Racoon - LibreSwan or StrongSwan are acceptable if they work (though I have a feeling that might not be the issue). I don't see ESP packets going out. Other system has route mapping for my internal address. (I updated my post) – rdj Jan 28 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.