Hot answers tagged

16

For anyone else having issues, I was finally able to resolve the matter after making an edit in the registry and then rebooting. Thanks to the guide posted here at Github. Run the following from an elevated command prompt: REG ADD HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d 0x2 /f Also make ...


15

The IPsec stack integrated in the Linux kernel since 2.6 (NETKEY) was originally based on the KAME stack (at least in regards to the API). The source code is part of the kernel repository, where the main components are found in the net/xfrm folder, including the implementation of the Netlink/XFRM configuration interface. The alternative and standardized (but ...


13

1) You may visit any site that shows you the (public) IP address your request comes from, a common example being http://checkip.dyndns.org/ If it shows the same IP while you're connected to the VPN and when you're disconnected, your traffic seems not to be routed through your company's VPN. The IP address shown will be the one assigned to your home internet ...


6

I just encounterd the same problem today and I seems its caused by the latest security update of debian wheezy for openswan. When you do a dpkg -l | grep openswan I assume you have 1:2.6.37-3+deb7u1 installed. To get it working with your iPad/ IPhone again you have to downgrade openswan on your server with apt-get install openswan=1:2.6.37-3. Of course ...


5

In the beginning (long ago before the BSD IPsec implementation has been integrated into the Linux kernel) it was not possible to use a IPsec VPN over a NAT gateway, because it was not possible to NAT IPsec. IPsec has been developed for IPv6, which does not know NAT anymore and using IPsec for IPv4 has always been some kind of hack. Not having NAT for the so ...


4

Android since 4.0 supports plain IPsec out of the box. And there are several apps for 4.x that provide other VPN protocols on unrooted devices (e.g. IKEv2/IPsec with the strongSwan VPN Client). Since Windows 7 you can use the built-in IKEv2/IPsec client. Granted racoon does not support IKEv2, but there are other open-source implementations that do (e.g. ...


4

For routers, use traceroute (the tools comes with Windows under the name tracert.exe). It rebuilds the path by sending packets with short lives (i.e. with a low "maximum number of hops") and inspecting the post-mortem ICMP packets which are sent back went a packet dies of old age (i.e. has reached its maximum number of allowed hops). Unfortunately, some ...


3

You've configured leftfirewall=yes in your iOS connection but not in the other. With this option enabled additional firewall rules are installed for each connected client. Also, if there is no NAT between the gateway and the clients you'll have to allow ESP traffic in the INPUT and OUTPUT chains as traffic won't be UDP encapsulated. -A INPUT -i eth0 -p esp ...


3

The IETF (the Internet standards body) made IPSec support a requirement of IPv6 support. You don't have a fully IPv6-compliant host if it doesn't also support IPSec. However, you don't have to actually use IPSec all the time just because you're using IPv6. No, SSL/TLS only protects the transport layer (layer 4) and above. If you want to protect layer 3 (the ...


3

There is a workaround with AppleScript that works for me.


2

I got another script on github. Instead of simulating click and input, this script access the process and simply triggers the actions. While the first time the script runs, OSX may ask for accessibility.


2

You may have checked already but I am suggesting this only because it sounds like a credential issue... If you are using a Domain account you may have to specify the domain with your username. Example: DOMAIN\JSmith instead of just JSmith Some RDP clients have a field specifically for Domain to authenticate you properly with the computer. With other RDP ...


2

11[CFG] id '%any' not confirmed by certificate, defaulting to 'C=US, O=NimbleX VPN Server, CN=vpn-test.nimblex.net' As you can see, your local identity defaults to the subject DN of the certificate. However, the peer proposes vpn-test.nimblex.net as identity but no such config is found: 14[CFG] looking for peer configs matching 172.31.9.29[vpn-test....


2

Here is how i fixed it: 1. echo 0 > /proc/sys/net/ipv4/ip_forward 2. ipsec verify 3. echo 1 > /proc/sys/net/ipv4/ip_forward Then it should work. Hope that i could help :P


2

Have similar problem with IPSec/IKE. It seems that RasMan service completely disrespects IPSec policies configured via Windows Firewall. And the best I was able to came up with is AES-SHA1-DH2048 through registry mangling. I stored it as .reg file, there's comments so things should be pretty clear. REGEDIT4 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\...


2

That error message probably means that there is some level of connection between Windows and the Ubiquiti but they failed to find a common encryption method. For phase1 (key exchange) Windows (version 1803) is proposing the following encryption methods (in this priority order): SHA1 + AES-CBC-256 + ECP384 SHA1 + AES-CBC-128 + ECP256 SHA1 + AES-CBC-256 + ...


1

Most Time Exceeded messages are from someone running traceroute. Aside from that it could indicate a few relatively rare things, like you have a routing loop, or you have a machine with a too-low default TTL value, or really do have an excessively long route that's not a loop. In general, don't block ICMP messages. It's a newbie mistake new firewall admins ...


1

One of the things I've noticed is an error in /etc/ipsec.secrets. My configuration is as follows: <outside world> | V public ip | V router (private IP 10.0.100.1) | V 10.0.1.1 (ubuntu IP) My /etc/ipsec.secrets looks like this: 10.0.1.1 %any: PSK "whateverpassword" My /etc/ipsec.conf looks ...


1

After a couple of days of searching the web I stumbled across this article https://support.microsoft.com/en-au/help/312840/error-message-error-720-no-ppp-control-protocols-configured which prompted me to remove and re-install the TCP protocols/protocols. I went into Device Manager and removed the drivers as per the image below. Restarted the machine The ...


1

In my case at least, the problem was that I had protostack=auto in the config setup section of /etc/ipsec.conf, which is how it came by default. The corresponding comment in the default configuration file suggests this should work: "which IPsec stack to use. auto will try netkey, then klips then mast". In fact, the problem was that auto apparently does not ...


1

If your testing only involves devices that are located behind your router (ie on your LAN) then you will not need to open any ports on your router. This means you will be safe from external port scanning. If you are running any firewalls on your devices then you will need to add an exception for this port, otherwise you should already be good to go. You ...


1

Generally, IPSec NAT-Traversal (NAT-T) is used, where all the IPSec packets get wrapped in UDP packets on port 4500. The outer, unencrypted UDP/IP headers get modified by the NAT, but the IPSec headers inside do not. The receiving host strips away the outer UDP/IP headers and then handles the inner IPSec packet in the normal way.


1

Why IPSec transport still exist if almost always it could be changed to tunneling and vice versa? I don't see Transport mode IPSec used in the general population of networked device user today. I think it never built up enough momentum to be universally deployed. Software and network vendors had motivation to sell Tunnel mode implementations (plus extensive ...


1

Hi All, I found the answer my self. Below are the steps: 1.Block all Ips on Port 80 netsh ipsec static add filterlist name=filterlist_198.18.84.161 netsh ipsec static add filter filterlist=filterlist_198.18.84.161 srcaddr=any dstaddr=Me protocol=tcp srcport=0 dstport=80 netsh ipsec static add filteraction name=action_198.18.84.161 action=block netsh ...


1

Ok, this is kind of embarrassing, but I was putting the wrong group name in my client! It's a bit annoying that the log doesn't actually tell you this :(


1

Yes, this is possible. Many public WIFi spots do not provide normal Internet access but instead only provide access to a small subset, such as HTTP[s] on ports 80 and 81. They fail when you want to use other services. Sometimes in surprising ways (e.g. when trying to parse everything though a transparent proxy).


1

The short answer is to look at your route table. Any tunnel-based VPN will add a new virtual interface of some sort, and routes. See if your default gateway changes. See if any static routes get added for specific networks. Run a traceroute tool of your choice (eg mtr hostname), which shows you the path a series of packets followed to reach a particular ...


1

For your situation I would recommend PFSense, because you didn't mention anything about having a firewall in place, and I would definitely put a firewall in place of anything at my house. Also, PFSense has OpenVPN built in, so that is also a plus. It's also free. Other solutions may work also, PFSense is not the only one, but I've had good experiences with ...


1

you'd need definite answers to the following questions before you can proceed: can you ping the router from the linux box? if you can, can you traceroute from the linux box to the router? from the above questions, I want to make sure that a. your traffic goes to the windows box indeed and then the router, not directly to the router. the tracert will tell ...


Only top voted, non community-wiki answers of a minimum length are eligible