Hot answers tagged

24

For anyone else having issues, I was finally able to resolve the matter after making an edit in the registry and then rebooting. Thanks to the guide posted here at Github. Run the following from an elevated command prompt: REG ADD HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d 0x2 /f Also make ...


20

1) You may visit any site that shows you the (public) IP address your request comes from, a common example being http://checkip.dyndns.org/ Edit from 2020: Some more information can be obtained by going to https://ipinfo.io/ - that can give you a hint on which connection is being used - if you see the name of your private ISP there, or the name of your ...


15

The IPsec stack integrated in the Linux kernel since 2.6 (NETKEY) was originally based on the KAME stack (at least in regards to the API). The source code is part of the kernel repository, where the main components are found in the net/xfrm folder, including the implementation of the Netlink/XFRM configuration interface. The alternative and standardized (but ...


6

I just encounterd the same problem today and I seems its caused by the latest security update of debian wheezy for openswan. When you do a dpkg -l | grep openswan I assume you have 1:2.6.37-3+deb7u1 installed. To get it working with your iPad/ IPhone again you have to downgrade openswan on your server with apt-get install openswan=1:2.6.37-3. Of course ...


5

In the beginning (long ago before the BSD IPsec implementation has been integrated into the Linux kernel) it was not possible to use a IPsec VPN over a NAT gateway, because it was not possible to NAT IPsec. IPsec has been developed for IPv6, which does not know NAT anymore and using IPsec for IPv4 has always been some kind of hack. Not having NAT for the so ...


4

Android since 4.0 supports plain IPsec out of the box. And there are several apps for 4.x that provide other VPN protocols on unrooted devices (e.g. IKEv2/IPsec with the strongSwan VPN Client). Since Windows 7 you can use the built-in IKEv2/IPsec client. Granted racoon does not support IKEv2, but there are other open-source implementations that do (e.g. ...


3

You can disable IPSec and always connect to l2tp only. Start a registry editor (regedit.exe) and navigate to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Parameters. From the Edit menu, select "New", "DWORD Value". Enter the name of "ProhibitIpSec" and press Enter. Double-click the new value, set it to 1, and click OK. Restart the ...


3

I got another script on github. Instead of simulating click and input, this script access the process and simply triggers the actions. While the first time the script runs, OSX may ask for accessibility.


3

There is a workaround with AppleScript that works for me.


2

Here is how i fixed it: 1. echo 0 > /proc/sys/net/ipv4/ip_forward 2. ipsec verify 3. echo 1 > /proc/sys/net/ipv4/ip_forward Then it should work. Hope that i could help :P


2

Why IPSec transport still exist if almost always it could be changed to tunneling and vice versa? I don't see Transport mode IPSec used in the general population of networked device user today. I think it never built up enough momentum to be universally deployed. Software and network vendors had motivation to sell Tunnel mode implementations (plus extensive ...


2

11[CFG] id '%any' not confirmed by certificate, defaulting to 'C=US, O=NimbleX VPN Server, CN=vpn-test.nimblex.net' As you can see, your local identity defaults to the subject DN of the certificate. However, the peer proposes vpn-test.nimblex.net as identity but no such config is found: 14[CFG] looking for peer configs matching 172.31.9.29[vpn-test....


2

Have similar problem with IPSec/IKE. It seems that RasMan service completely disrespects IPSec policies configured via Windows Firewall. And the best I was able to came up with is AES-SHA1-DH2048 through registry mangling. I stored it as .reg file, there's comments so things should be pretty clear. REGEDIT4 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\...


2

That error message probably means that there is some level of connection between Windows and the Ubiquiti but they failed to find a common encryption method. For phase1 (key exchange) Windows (version 1803) is proposing the following encryption methods (in this priority order): SHA1 + AES-CBC-256 + ECP384 SHA1 + AES-CBC-128 + ECP256 SHA1 + AES-CBC-256 + ...


1

As an illustration of what can be done, consider: https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/69308-asdm-restrict-remot-net-access.html Since the tunnel does of necessity broker every packet that passes through the tunnel in either direction, it can restrict what packets can be sent and what combinations of IP-...


1

You should check out Strongswan which is the recommended IPSec initiator-responder in Ubuntu. You can install it from Ubuntu's repository i.e.: sudo apt-get install strongswan. There are many ways to configure it: editing the legacy ipsec.conf file or using the swanctl tool. To install swanctl simply use sudo apt-get install strongswan-swanctl. If you're ...


1

forticlient 6 for linux does NOT do vpn. check this out instead : https://github.com/adrienverge/openfortivpn


1

I had the same issue on 3 Windows 10 PCs. The above registry fix did not work initially. The only thing the 3 PCs had in common is that they were all upgraded from Windows 7 at some stage. Microsoft support suggested doing an in-place reinstall of Windows 10 from DVD or USB stick using their media creation tool. That kept all my apps and data, in the same ...


1

Most Time Exceeded messages are from someone running traceroute. Aside from that it could indicate a few relatively rare things, like you have a routing loop, or you have a machine with a too-low default TTL value, or really do have an excessively long route that's not a loop. In general, don't block ICMP messages. It's a newbie mistake new firewall admins ...


1

After a couple of days of searching the web I stumbled across this article https://support.microsoft.com/en-au/help/312840/error-message-error-720-no-ppp-control-protocols-configured which prompted me to remove and re-install the TCP protocols/protocols. I went into Device Manager and removed the drivers as per the image below. Restarted the machine The ...


1

The problem was indeed with Apple's keychain, i couldn't sort it out so i decided to reset the keychain (Keychain Access > Preferences > Reset My Default Keychain) and it worked, the only (minor) drawback was that i needed to add all my passwords again. I couldn't figure out what caused the problem in the first place, so if anyone has any idea what could ...


1

In my case at least, the problem was that I had protostack=auto in the config setup section of /etc/ipsec.conf, which is how it came by default. The corresponding comment in the default configuration file suggests this should work: "which IPsec stack to use. auto will try netkey, then klips then mast". In fact, the problem was that auto apparently does not ...


1

If your testing only involves devices that are located behind your router (ie on your LAN) then you will not need to open any ports on your router. This means you will be safe from external port scanning. If you are running any firewalls on your devices then you will need to add an exception for this port, otherwise you should already be good to go. You ...


1

Generally, IPSec NAT-Traversal (NAT-T) is used, where all the IPSec packets get wrapped in UDP packets on port 4500. The outer, unencrypted UDP/IP headers get modified by the NAT, but the IPSec headers inside do not. The receiving host strips away the outer UDP/IP headers and then handles the inner IPSec packet in the normal way.


1

Hi All, I found the answer my self. Below are the steps: 1.Block all Ips on Port 80 netsh ipsec static add filterlist name=filterlist_198.18.84.161 netsh ipsec static add filter filterlist=filterlist_198.18.84.161 srcaddr=any dstaddr=Me protocol=tcp srcport=0 dstport=80 netsh ipsec static add filteraction name=action_198.18.84.161 action=block netsh ...


1

Ok, this is kind of embarrassing, but I was putting the wrong group name in my client! It's a bit annoying that the log doesn't actually tell you this :(


1

One of the things I've noticed is an error in /etc/ipsec.secrets. My configuration is as follows: <outside world> | V public ip | V router (private IP 10.0.100.1) | V 10.0.1.1 (ubuntu IP) My /etc/ipsec.secrets looks like this: 10.0.1.1 %any: PSK "whateverpassword" My /etc/ipsec.conf looks ...


1

Yes, this is possible. Many public WIFi spots do not provide normal Internet access but instead only provide access to a small subset, such as HTTP[s] on ports 80 and 81. They fail when you want to use other services. Sometimes in surprising ways (e.g. when trying to parse everything though a transparent proxy).


1

The short answer is to look at your route table. Any tunnel-based VPN will add a new virtual interface of some sort, and routes. See if your default gateway changes. See if any static routes get added for specific networks. Run a traceroute tool of your choice (eg mtr hostname), which shows you the path a series of packets followed to reach a particular ...


Only top voted, non community-wiki answers of a minimum length are eligible