Problem testing IPSec VPN

Support
1

Hi there!
I have problem testing IPSec VPN. When red interface has static IP address it’s ok. But if red is DHCP or PPPOE, there is no opportunity to choose it in IPSec setup. Drop-down list contains only green interface, and if it is choosen, tunnel doesn’t work.

2

Maybe a tip to be able to test this:
Many VPS providers offer a 1 week trial period for a VPS. You can freely install any image and have a public IP address. If you install a CentOS 6.x instance and install NS on top of that, you can create a VPN from your homeserver (or VM) to that instance.
I have VPS at https://www.directvps.nl/ and they offer a 1week testing period for all their VPS’s

3

AFAIK, when one of the vpn endpoint has a dynamic ip, the tunnel config needs to be changed to work only in one direction, from the dynamic ip to the static side.
I can suggest to use the interface to create a skeleton config choosing the green interface and then try to follow some guide on the net to modify ipsec.conf and bring the tunnel up.
If the changed needed in ipsec.conf are “confined” we could develop an enhancement to the standard ipsec interface to allow dynamic IPs.

In the past, I worked on a tunnel like your and I used left=%any to make it work.
Unfortunately, I no longer have it to have a look.

1 Like
4

My ISP assign to all my offices a public IP’s, which are absolutely accessible. So each my office has a constant address, assigned by ISP via DHCP. My second ISP also gave me a fixed IP via PPPoE. So all my offices actually have a static public IP.
When red is DHCP, I can anyway set static. But when red is PPPoE…

5

Here’s what I did.

  • define the vpn selecting the green Local IP edit /etc/ipsec.conf and
  • change left=green_ip with left=%eth1, where eth1 is my red dhcp
    interface

Please, let me know if you succeed. If yes, I’ll try to extend the user interface.

1 Like
6

Thank you! I’ll try it and then post any result.

7

@giacomo just finished working on an updated ipsec panel that permits usage of non-static red interfaces.
See http://dev.nethserver.org/issues/3326 for details.
I will be really grateful if you could test the new package (available tomorrow as an update or now from the testing repository).

1 Like
8

I think i’m late for two weeks with answer. Sorry. But anyway…
It’s all about release i’ve tested.
If red is static - it’s all right. If red is dhcp, i can’t choose it in ipsec settings. But! If first i set red to static and save changes, then change red back to dhcp, i get possibility to choose red dhcp in ipsec. I tested this in virtual (VirtualBox) and physical environment.
And i tryed to do as written before (again virtually and physically):

  • define the vpn selecting the green Local IP edit /etc/ipsec.conf
  • change left=green_ip with left=%eth1, where eth1 is red dhcp interface.
    It doesn’t work. Tunnel satays down, any changes of .conf are not effective. And after changing conf GUI settings was like before.

And i tryed to connect NS with pfSense via IPSec - successfully. Tunnel was stable. ping was short.

9

If you update the system you will be able to select any kind of red.
We modified the ipsec vpn panel after your issue.
Thank you.

2 Likes
10

@buddha thanks for having improved our product highlighting this issue! :+1: well done
And also to @filippo_carletti @giacomo for having implemented it