0

I'm in the exact same situation as sashok_bg here : I'm trying to access my Freebox pro VPN through Swanstrong client vpn on Debian.

So far, with what has been said in his converstation with ecdsa, and modifying my config file accordingly, I've managed to have this error :

initiating IKE_SA vpn-test[1] to <remote_ip>
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
sending packet: from <local_ip>[500] to <remote_ip>[500] (936 bytes)
received packet: from <remote_ip>[500] to <local_ip>[500] (280 bytes)
parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ]
selected proposal: IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256
local host is behind NAT, sending keep alives
remote host is behind NAT
sending cert request for "C=US, O=Let's Encrypt, CN=R3"
no IDi configured, fall back on IP address
establishing CHILD_SA vpn-test{1}
generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
sending packet: from <local_ip>[4500] to 8<remote_ip>[4500] (368 bytes)
received packet: from <remote_ip>[4500] to <local_ip>[4500] (80 bytes)
parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]
received AUTHENTICATION_FAILED notify error
establishing connection 'vpn-test' failed

This is my ipsec.conf file :

config setup
  charondebug="ike 2, knl 2, cfg 2, net 2, esp 2, dmn 2, 0"

conn vpn-test
  keyexchange=ikev2
  leaftauth=eap
  rightauth=pubkey
  left=<local_ip>
  right=<remote_ip>
  eap_identity=<username>
  auto=add

And this is what me ipsec.secrets file contains :

<username> : EAP "<pass>"
<local_ip> <remote_ip> : EAP "<pass>"

This is the "documentation" given by the ISP about the VPN : https://support-pro.free.fr/comment-se-connecter-au-vpn-depuis-mon-peripherique-android/

And I must say, this is the first time I set up an client vpn like that. I don't have access to logs or certs of the router vpn.

3
  • A few things you can try (maybe try each individually first): rightid=<hostname of your router>, leftid=<username>
    – ecdsa
    Commented Apr 19 at 9:57
  • Thanks for your help ecdsa. I tried both individually and together. The noticeable change was with the router id, which gives a certificate exchange which doesn't work : no issuer certificate found for "C=US, O=Let's Encrypt, CN=R3" issuer is "C=US, O=Internet Security Research Group, CN=ISRG Root X1" no trusted RSA public key found for <router_id> generating INFORMATIONAL request 2 [ N(AUTH_FAILED) ] sending packet: from <local_ip>[4500] to >remote_ip>[4500] (80 bytes) establishing connection 'vpn-test' failed
    – Alex
    Commented Apr 19 at 10:53
  • You need to install the missing CA certificate (ISRG Root X1) in /etc/ipsec.d/cacerts/. If you have the ca-certificates package installed on your Debian system, then you can copy it from /etc/ssl/certs/ISRG_Root_X1.pem. Otherwise, you can also download it from Let's Encrypt.
    – ecdsa
    Commented Apr 22 at 6:35

0

You must log in to answer this question.

Browse other questions tagged .