Strongswan IPSEC VPN for Windows 7 road warrior config

up vote
0
down vote

favorite

Following the Strongswan wiki link for configuring Strongswan for Windows 7 clients:
http://wiki.strongswan.org/projects/strongswan/wiki/Win7EapMultipleConfig

I used the sample files as-is with no changes except for strongswan.conf.

[ipsec.conf]

same as on wiki

[ipsec.secrets]

same as on wiki

[strongswan.conf]

# diff /etc/strongswan.conf /etc/strongswan.conf.template

4,6c4,7

<   dns1 = 8.8.8.8

<   dns2 = 8.8.4.4

<   nbns1 = 192.168.0.1

---

>   dns1 = 62.2.17.60

>   dns2 = 62.2.24.162

>   nbns1 = 10.10.1.1

>   nbns2 = 10.10.0.1

dns servers 8.8.8.8 and .4.4 are Google DNS servers. 192.168.0.1 is the router IP.

THE PROBLEM

I can log into the VPN fine with Windows 7, but the remote client does not have any connectivity. The client gets dhcp IP from Strongswan: 10.10.3.1, the netmask is 255.255.255.255, the default gateway is 0.0.0.0. From the remote PC, I can ping the Strongswan server IP (192.168.0.50) but nothing else, not even the router at 192.168.0.1.

Thank you.

edited Mar 16 '17 at 1:09

Ghostdog12

1510

asked Sep 21 '13 at 0:51

Lawrence Chiu

123

I found the answer here: pluieglaciale.wordpress.com/2010/11/09/… Needed two more commands to make it all work echo 1 > /proc/sys/net/ipv4/ip_forward iptables -A POSTROUTING -t nat -j SNAT --to-source 192.168.0.1
– Lawrence Chiu
Sep 21 '13 at 3:20

add a comment |

up vote
0
down vote

favorite

Following the Strongswan wiki link for configuring Strongswan for Windows 7 clients:
http://wiki.strongswan.org/projects/strongswan/wiki/Win7EapMultipleConfig

I used the sample files as-is with no changes except for strongswan.conf.

[ipsec.conf]

same as on wiki

[ipsec.secrets]

same as on wiki

[strongswan.conf]

# diff /etc/strongswan.conf /etc/strongswan.conf.template

4,6c4,7

<   dns1 = 8.8.8.8

<   dns2 = 8.8.4.4

<   nbns1 = 192.168.0.1

---

>   dns1 = 62.2.17.60

>   dns2 = 62.2.24.162

>   nbns1 = 10.10.1.1

>   nbns2 = 10.10.0.1

dns servers 8.8.8.8 and .4.4 are Google DNS servers. 192.168.0.1 is the router IP.

THE PROBLEM

Thank you.

edited Mar 16 '17 at 1:09

Ghostdog12

1510

asked Sep 21 '13 at 0:51

Lawrence Chiu

123

I found the answer here: pluieglaciale.wordpress.com/2010/11/09/… Needed two more commands to make it all work echo 1 > /proc/sys/net/ipv4/ip_forward iptables -A POSTROUTING -t nat -j SNAT --to-source 192.168.0.1
– Lawrence Chiu
Sep 21 '13 at 3:20

add a comment |

up vote
0
down vote

favorite

Following the Strongswan wiki link for configuring Strongswan for Windows 7 clients:
http://wiki.strongswan.org/projects/strongswan/wiki/Win7EapMultipleConfig

I used the sample files as-is with no changes except for strongswan.conf.

[ipsec.conf]

same as on wiki

[ipsec.secrets]

same as on wiki

[strongswan.conf]

# diff /etc/strongswan.conf /etc/strongswan.conf.template

4,6c4,7

<   dns1 = 8.8.8.8

<   dns2 = 8.8.4.4

<   nbns1 = 192.168.0.1

---

>   dns1 = 62.2.17.60

>   dns2 = 62.2.24.162

>   nbns1 = 10.10.1.1

>   nbns2 = 10.10.0.1

dns servers 8.8.8.8 and .4.4 are Google DNS servers. 192.168.0.1 is the router IP.

THE PROBLEM

Thank you.

edited Mar 16 '17 at 1:09

Ghostdog12

1510

asked Sep 21 '13 at 0:51

Lawrence Chiu

123

Following the Strongswan wiki link for configuring Strongswan for Windows 7 clients:
http://wiki.strongswan.org/projects/strongswan/wiki/Win7EapMultipleConfig

I used the sample files as-is with no changes except for strongswan.conf.

[ipsec.conf]

same as on wiki

[ipsec.secrets]

same as on wiki

[strongswan.conf]

# diff /etc/strongswan.conf /etc/strongswan.conf.template

4,6c4,7

<   dns1 = 8.8.8.8

<   dns2 = 8.8.4.4

<   nbns1 = 192.168.0.1

---

>   dns1 = 62.2.17.60

>   dns2 = 62.2.24.162

>   nbns1 = 10.10.1.1

>   nbns2 = 10.10.0.1

dns servers 8.8.8.8 and .4.4 are Google DNS servers. 192.168.0.1 is the router IP.

THE PROBLEM

Thank you.

windows-7 vpn ipsec

edited Mar 16 '17 at 1:09

Ghostdog12

1510

asked Sep 21 '13 at 0:51

Lawrence Chiu

123

edited Mar 16 '17 at 1:09

Ghostdog12

1510

asked Sep 21 '13 at 0:51

Lawrence Chiu

123

edited Mar 16 '17 at 1:09

Ghostdog12

1510

edited Mar 16 '17 at 1:09

Ghostdog12

1510

edited Mar 16 '17 at 1:09

Ghostdog12

1510

asked Sep 21 '13 at 0:51

Lawrence Chiu

123

asked Sep 21 '13 at 0:51

Lawrence Chiu

123

asked Sep 21 '13 at 0:51

Lawrence Chiu

123

I found the answer here: pluieglaciale.wordpress.com/2010/11/09/… Needed two more commands to make it all work echo 1 > /proc/sys/net/ipv4/ip_forward iptables -A POSTROUTING -t nat -j SNAT --to-source 192.168.0.1
– Lawrence Chiu
Sep 21 '13 at 3:20

add a comment |

I found the answer here: pluieglaciale.wordpress.com/2010/11/09/… Needed two more commands to make it all work echo 1 > /proc/sys/net/ipv4/ip_forward iptables -A POSTROUTING -t nat -j SNAT --to-source 192.168.0.1
– Lawrence Chiu
Sep 21 '13 at 3:20

I found the answer here: pluieglaciale.wordpress.com/2010/11/09/… Needed two more commands to make it all work echo 1 > /proc/sys/net/ipv4/ip_forward iptables -A POSTROUTING -t nat -j SNAT --to-source 192.168.0.1
– Lawrence Chiu
Sep 21 '13 at 3:20

add a comment |

1 Answer
1

active

oldest

votes

up vote
0
down vote

http://pluieglaciale.wordpress.com/2010/11/09/how-to-setup-strongswan-proxy-on-single-ip-vps-for-windows-7-client/

All Solution credit goes to above blog.

(below is copy and paste from blog)

Enable IPv4 forwarding in the kernel. You can do this by the following statement:

echo 1 > /proc/sys/net/ipv4/ip_forward

However, to make it persistent, ie do it automatically on reboot, modify /etc/sysctl.conf and uncomment the equivalent line.

Next, enable the NAT. Replace the placeholder with the actual IP address of the VPN server.

iptables -A POSTROUTING -t NAT -j SNAT --to-source ‹VPN IP Address>

This line tells netfilter to rewrite packets so the source IP is replaced with the VPN’s IP address. In my case, ‹VPN IP Address> = 192.168.0.50

edited Sep 21 '13 at 22:04

answered Sep 21 '13 at 20:18

Lawrence Chiu

123

add a comment |

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f648283%2fstrongswan-ipsec-vpn-for-windows-7-road-warrior-config%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
0
down vote

http://pluieglaciale.wordpress.com/2010/11/09/how-to-setup-strongswan-proxy-on-single-ip-vps-for-windows-7-client/

All Solution credit goes to above blog.

(below is copy and paste from blog)

Enable IPv4 forwarding in the kernel. You can do this by the following statement:

echo 1 > /proc/sys/net/ipv4/ip_forward

However, to make it persistent, ie do it automatically on reboot, modify /etc/sysctl.conf and uncomment the equivalent line.

Next, enable the NAT. Replace the placeholder with the actual IP address of the VPN server.

iptables -A POSTROUTING -t NAT -j SNAT --to-source ‹VPN IP Address>

This line tells netfilter to rewrite packets so the source IP is replaced with the VPN’s IP address. In my case, ‹VPN IP Address> = 192.168.0.50

edited Sep 21 '13 at 22:04

answered Sep 21 '13 at 20:18

Lawrence Chiu

123

add a comment |

up vote
0
down vote

http://pluieglaciale.wordpress.com/2010/11/09/how-to-setup-strongswan-proxy-on-single-ip-vps-for-windows-7-client/

All Solution credit goes to above blog.

(below is copy and paste from blog)

Enable IPv4 forwarding in the kernel. You can do this by the following statement:

echo 1 > /proc/sys/net/ipv4/ip_forward

However, to make it persistent, ie do it automatically on reboot, modify /etc/sysctl.conf and uncomment the equivalent line.

Next, enable the NAT. Replace the placeholder with the actual IP address of the VPN server.

iptables -A POSTROUTING -t NAT -j SNAT --to-source ‹VPN IP Address>

This line tells netfilter to rewrite packets so the source IP is replaced with the VPN’s IP address. In my case, ‹VPN IP Address> = 192.168.0.50

edited Sep 21 '13 at 22:04

answered Sep 21 '13 at 20:18

Lawrence Chiu

123

add a comment |

up vote
0
down vote

http://pluieglaciale.wordpress.com/2010/11/09/how-to-setup-strongswan-proxy-on-single-ip-vps-for-windows-7-client/

All Solution credit goes to above blog.

(below is copy and paste from blog)

Enable IPv4 forwarding in the kernel. You can do this by the following statement:

echo 1 > /proc/sys/net/ipv4/ip_forward

However, to make it persistent, ie do it automatically on reboot, modify /etc/sysctl.conf and uncomment the equivalent line.

Next, enable the NAT. Replace the placeholder with the actual IP address of the VPN server.

iptables -A POSTROUTING -t NAT -j SNAT --to-source ‹VPN IP Address>

This line tells netfilter to rewrite packets so the source IP is replaced with the VPN’s IP address. In my case, ‹VPN IP Address> = 192.168.0.50

edited Sep 21 '13 at 22:04

answered Sep 21 '13 at 20:18

Lawrence Chiu

123

http://pluieglaciale.wordpress.com/2010/11/09/how-to-setup-strongswan-proxy-on-single-ip-vps-for-windows-7-client/

All Solution credit goes to above blog.

(below is copy and paste from blog)

Enable IPv4 forwarding in the kernel. You can do this by the following statement:

echo 1 > /proc/sys/net/ipv4/ip_forward

However, to make it persistent, ie do it automatically on reboot, modify /etc/sysctl.conf and uncomment the equivalent line.

Next, enable the NAT. Replace the placeholder with the actual IP address of the VPN server.

iptables -A POSTROUTING -t NAT -j SNAT --to-source ‹VPN IP Address>

This line tells netfilter to rewrite packets so the source IP is replaced with the VPN’s IP address. In my case, ‹VPN IP Address> = 192.168.0.50

edited Sep 21 '13 at 22:04

answered Sep 21 '13 at 20:18

Lawrence Chiu

123

edited Sep 21 '13 at 22:04

answered Sep 21 '13 at 20:18

Lawrence Chiu

123

answered Sep 21 '13 at 20:18

Lawrence Chiu

123

answered Sep 21 '13 at 20:18

Lawrence Chiu

123

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Super User!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

Some of your past answers have not been well-received, and you're in danger of being blocked from answering.

Please pay close attention to the following guidance:

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Csdrhrt