Micah R Ledbetter's questions

I have a server that I want to be accessible on the public Internet via SSH only, but I want it to be able to connect out to a VPN, and bind services to its VPN interface.

I'm using Linode to host a Ubuntu 16.04.2 LTS VM, ZeroTier for my VPN layer, and Docker in Swarm mode (with just a single node) for the services.

Running ifconfig -a on the VM returns this (public IPs redacted for privacy):

docker0   Link encap:Ethernet  HWaddr 02:42:f7:e7:e6:1e
          inet addr:172.17.0.1  Bcast:0.0.0.0  Mask:255.255.0.0
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

docker_gwbridge Link encap:Ethernet  HWaddr 02:42:ad:82:56:0f
          inet addr:172.18.0.1  Bcast:0.0.0.0  Mask:255.255.0.0
          inet6 addr: fe80::42:adff:fe82:560f/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6083 errors:0 dropped:0 overruns:0 frame:0
          TX packets:16927 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:6364682 (6.3 MB)  TX bytes:49725061 (49.7 MB)

eth0      Link encap:Ethernet  HWaddr f2:3c:91:a7:c3:ac
          inet addr:<REDACTED>  Bcast:<REDACTED>  Mask:255.255.255.0
          inet6 addr: <REDACTED>/64 Scope:Global
          inet6 addr: <REDACTED>/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:94675 errors:0 dropped:0 overruns:0 frame:0
          TX packets:47778 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:59390529 (59.3 MB)  TX bytes:14765979 (14.7 MB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:54171 errors:0 dropped:0 overruns:0 frame:0
          TX packets:54171 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1
          RX bytes:6243573 (6.2 MB)  TX bytes:6243573 (6.2 MB)

veth8323309 Link encap:Ethernet  HWaddr 82:b3:ec:d8:8c:9b
          inet6 addr: fe80::80b3:ecff:fed8:8c9b/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:15 errors:0 dropped:0 overruns:0 frame:0
          TX packets:538 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:1248 (1.2 KB)  TX bytes:22932 (22.9 KB)

veth602daf7 Link encap:Ethernet  HWaddr 82:7e:cf:b3:cb:a4
          inet6 addr: fe80::807e:cfff:feb3:cba4/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3065 errors:0 dropped:0 overruns:0 frame:0
          TX packets:11154 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:6187902 (6.1 MB)  TX bytes:794193 (794.1 KB)

zt0       Link encap:Ethernet  HWaddr 42:08:c2:e8:fc:93
          inet addr:192.168.196.106  Bcast:192.168.196.255  Mask:255.255.255.0
          inet6 addr: fe80::4008:c2ff:fee8:fc93/64 Scope:Link
          inet6 addr: fc7b:7a95:194:6f84:bf9a::1/40 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:2800  Metric:1
          RX packets:442 errors:0 dropped:0 overruns:0 frame:0
          TX packets:279 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:52165 (52.1 KB)  TX bytes:46603 (46.6 KB)

My Docker compose file looks like this:

version: "3"
services:
  jenkins:
    image: jenkins/jenkins:lts
    ports:
      - "80:8080"
    volumes:
      - jenkins_home:/var/jenkins_home
    deploy:
      replicas: 1
volumes:
  jenkins_home:

However, I can't seem to get the iptables rules right. I had expected to be able to do this:

# Allow established connections, including outbound connections this server initiated, to continue to receive replies
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow SSH on eth0
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

# Allow UDP 9993 on eth0 (required for ZeroTier)
iptables -A INPUT -i eth0 -p udp --dport 9993 -j ACCEPT
iptables -A OUTPUT -p udp --dport 9993 -j ACCEPT

# Reject everything that hasn't already been accepted (rules are applied in order)
iptables -A INPUT -i eth0 -j REJECT

However, when I deploy and start my Docker Swarm service, I end up being able to access the service via the address on eth0 from a remote host that's not on the VPN, from the VPN address on zt0 from a remote host that is on the VPN, but not from localhost on the VM itself.

What am I doing wrong here? How can I get iptables rules that will prevent traffic from the public Internet but allow it from only the ZeroTier VPN?

I have a Powershell DSC custom resource, embedded in a module. The full code is available here if you want to see it, but that may not be necessary; my problem isn't (I think) in the code I wrote, but in how to access it.

In my case, I'm using DSC Push Mode. There's a normal Powershell script I use to install required modules, compile the configuration, and start it. In that script, I add the location of my module to $env:PSModulePath. After doing that, I can then see the module and import it in my interactive shell like this:

PS> Get-Module -ListAvailable | Where-Object -Property Name -eq cWinTrialLab | Import-Module
PS> Get-DscResource -Module cWinTrialLab

ImplementedAs   Name                      ModuleName                     Version    Properties
-------------   ----                      ----------                     -------    ----------
PowerShell      cWtlShortcut              cWinTrialLab                   0.0.1      {Ensure, ShortcutPath, TargetPath, DependsOn...}

So I create a test configuration file:

Configuration TestConfig {

    Import-DscResource -ModuleName PSDesiredStateConfiguration
    Import-DscResource -ModuleName cWinTrialLab

    Node localhost {

        cWtlShortcut "TestShortcut" {
            Ensure = "Present"
            ShortcutPath = "$env:USERPROFILE\Desktop\TestShortcut.lnk"
            TargetPath = "C:\Windows\system32\cmd.exe"
        }

    }
}

And I try to use it:

PS> . .\testDscConfig.ps1
PS> TestConfig
PS> Start-DscConfiguration -Wait -Force TestConfig

Compiling the MOF appears to work, but actually starting the configuration fails with:

The PowerShell DSC resource cWtlShortcut from module <cWinTrialLab,0.0.1> does not exist at the PowerShell module path nor is it registered as a WMI DSC resource.
At $Home\Documents\psyops\submod\wintriallab\azure\test.ps1:13 char:1
+ Start-DscConfiguration -Wait -Force TestConfig
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (root/Microsoft/...gurationManager:String) [], CimException
    + FullyQualifiedErrorId : DscResourceNotFound
    + PSComputerName        : localhost

What could cause this?

1. I have made sure that there is only one copy of the module in all folders in my $env:PSModulePath.
2. Something appears to be working; it can determine the correct version of my module in the error message (and when I change the version on my module's .psd1 file, the version reported in the error message changes as well)
3. I don't believe it's related to Why can't DSC find a resource that's installed? because I'm using push mode, and there are no module versioning issues.

4. Could it be related to a nonstandard entry in $env:PSModulePath? I've tried copying the module to $env:ProgramFiles\WindowsPowershell\Modules, but then I get an error I really don't understand: Importing module cWinTrialLab failed with error - File C:\Program Files\WindowsPowerShell\Modules\cWinTrialLab\cWtlShortcut\cWtlShortcut.psm1 cannot be loaded because running scripts is disabled on this system. For more information, see about_Execution_Policies. For the record:

   PS> Get-ExecutionPolicy -List
           Scope ExecutionPolicy
           ----- ---------------
   MachinePolicy       Undefined
      UserPolicy       Undefined
         Process       Undefined
     CurrentUser    Unrestricted
    LocalMachine    Unrestricted
   

5. Maybe it's something wrong with my directory layout? I haven't actually seen an example of a module containing multiple class-based DSC resources in the wild, so I'm kind of guessing as to the layout.
6. (If there is an example of this kind of module - a single module, containing multiple class-based DSC resources - a link to it would be really helpful.)

Finally, I'm using Powershell 5.1 on Windows 10 with all updates applied from Windows Update. (Ultimately, I'll be deploying my configuration on a Server 2016 machine.)

What else could I be missing?

I have an Azure template that, among other things, defines a Public IP Address. I want to list that IP address in the template's output, but after the first deployment, I get an error message:

Message: Unable to evaluate template outputs: 'builderConnectionInformation'. Please see error details and deployment operations. Please see https://aka.ms/arm-debug for usage details.
Exception Details:
        Error Code: DeploymentOutputEvaluationFailed
        Message: The template output 'builderConnectionInformation' is not valid: The language expression property 'ipAddress' doesn't exist, available properties are 'provisioningState, resourceGuid, publicIPAllocationMethod, idleTimeoutInMinutes'..
        Target: builderConnectionInformation

However, if I redeploy, it shows the output I wanted just fine:

Deployment completed. Outputs:
- builderConnectionInformation = {'Username': 'ExampleAdministrator', 'Password': '<PASSWORD>', 'Public IP Address': '1.2.3.4'}

Deployment details

I'm using a Python script and calling the Azure Python SDK to deploy. The whole script is here; the relevant bits are:

    result = resource.resource_groups.create_or_update(
        parsed.group_name, {'location': parsed.group_location})

    template_params = {
        'storageAccountName': parsed.storage_account_name,
        'builderVmAdminPassword': parsed.builder_vm_admin_password,
        'builderVmSize': parsed.builder_vm_size}
    template_params = {k: {'value': v} for k, v in template_params.items()}
    deploy_params = {
        'mode': 'incremental',
        'template': template,
        'parameters': template_params}
    async_operation = resource.deployments.create_or_update(
        parsed.group_name, parsed.deployment_name, deploy_params)
    result = async_operation.result()

    msg = "Deployment completed. Outputs:"
    for k, v in result.properties.outputs.items():
        msg += f"\n- {k} = {str(v['value'])}"
    print(msg)

A representation of my template can be found here. (Note: I actually am using a YAML template, but it's converted to a Python object before being used the same way that JSON is, and it works otherwise, so I don't think that's the problem.) The relevant parts (of the converted JSON template, since that's what everyone will be familiar with) are:

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  ...
  "parameters": {
    "builderVmAdminPassword": {
      "type": "securestring"
    },
    ...
  },
  "variables": {
    "apiVersion": "2015-06-15",
    "builderVmAdminUsername": "WinTrialAdmin",
    "pubIpAddrName": "builderPubIp",
    "pubIpAddrType": "Dynamic",
    ...
  },
  "resources": [
    ...
    {
      "type": "Microsoft.Network/publicIPAddresses",
      "name": "[variables('pubIpAddrName')]",
      "apiVersion": "[variables('apiVersion')]",
      "location": "[resourceGroup().location]",
      "properties": {
        "publicIPAllocationMethod": "[variables('pubIpAddrType')]"
      }
    },
    ....
  ],
  "outputs": {
    "builderConnectionInformation": {
      "type": "object",
      "value": {
        "Username": "[variables('builderVmAdminUsername')]",
        "Password": "[parameters('builderVmAdminPassword')]",
        "Public IP Address": "[reference(variables('pubIpAddrName')).ipAddress]"
      }
    }
  }

What I've tried

I wondered if perhaps the public IP wasn't finished being allocated at the time the template deployment returns, but I didn't see a way to deal with that problem if that's what's happening - the only thing that occurred to me was to use a dependsOn property of the output, but outputs do not support a dependsOn property.

I have also found some information saying that instead of

"[reference(variables('pubIpAddrName')).ipAddress]"

I should use:

"[reference(variables('pubIpAddrName')).properties.ipAddress]"

However, that gives a similar result whether its the first time I have deployed, or any subsequent time. Here's the exact message for an initial deployment - note that it does not list ipAddress as an available property:

Message: Unable to evaluate template outputs: 'builderConnectionInformation'. Please see error details and deployment operations. Please see https://aka.ms/arm-debug for usage details.
Exception Details:
        Error Code: DeploymentOutputEvaluationFailed
        Message: The template output 'builderConnectionInformation' is not valid: The language expression property 'properties' doesn't exist, available properties are 'provisioningState, resourceGuid, publicIPAllocationMethod, idleTimeoutInMinutes'..
        Target: builderConnectionInformation

And here's the exact message from subsequent deployments - note that it does list an ipAddress property:

Message: Unable to evaluate template outputs: 'builderConnectionInformation'. Please see error details and deployment operations. Please see https://aka.ms/arm-debug for usage details.
Exception Details:
        Error Code: DeploymentOutputEvaluationFailed
        Message: The template output 'builderConnectionInformation' is not valid: The language expression property 'properties' doesn't exist, available properties are 'provisioningState, resourceGuid, ipAddress, publicIPAllocationMethod, idleTimeoutInMinutes, ipConfiguration'..
        Target: builderConnectionInformation

Summary

How can I make sure that the public IP address is always returned, even on the first deployment?

I am building some Windows VMs with Vagrant, and the Vagrant provisioner will create some users. I'd like to be able to commit the passwords for those users to source control, but obviously I don't want to commit them in plain text.

On Linux, I know I can create a hashed password on my local machine, and then later create a new user with that hashed password - the server I'm creating the user on never has to even see the plaintext password.

# Create the password hash: 
hashpass=$(echo 'P@ssword123' | mkpasswd --method=sha-512 --stdin)

# Make a new user with the hash:
useradd --password "$hashpass" <new username>

Is it possible to do this in Windows?

I want to configure Windows Server 2012, and its Windows 7 and Windows 8 VPN clients, with an SSTP VPN that uses split tunneling and off-subnet addressing, but I'm running into a problem: the RRAS server will not send packets to VPN clients from any machine other than itself.

My VPN server is running on Amazon's "Virtual Private Cloud", so it has only one NIC with an IP address on a private, RFC1918 network shared with all my other Amazon VPC servers, and a public IP which forwards all traffic to that private address via NAT (Amazon calls this "Elastic IP").

I've installed RRAS and set up a VPN. The private subnet on Amazon is 172.16.0.0/17 (this is what I'm calling the "Amazon LAN"), but I want all the VPN clients to use the range 10.128.0.0/20 (what I'm calling the "VPN LAN").

In my Amazon control panel, I've done the following:

• Disabled the source/destination check for the VPN server
• Added an entry into the route tables for the 10.128.0.0/20 pool that points to the network interface of the VPN server.

Inside the Routing and Remote Access MMC, inside the properties menu for the server name, I've done the following:

• General tab -> IPv4 Router (checked), enabled for LAN and demand-dial routing
• General tab -> IPv4 Remote Access Server (checked)
• IPv4 tab -> Enable IPv4 Forwarding (checked)
• IPv4 tab -> Static Address Pool, and specify 10.128.0.1-10.128.15.154

On my client and all my servers, I've made sure that ICMP is explicitly allowed in the firewall, or the firewall is disabled entirely (not the permanent plan, of course).

On the client, to enable split tunneling, I've gone to the properties for the VPN connection -> Networking -> IPv4 -> Propeties -> Advanced -> IP Settings tab, and unchecked "Use default gateway on remote network", and checked "Disable class based route addition".

At this point, my clients can connect using the Windows 7/8 VPN client. They are assigned an IP from the 10.128.0.0/20 pool, but since they aren't automatically setting any routes, they can't talk to the remote network. I can set routes to the remote network, and to the VPN network, like this (on the client):

route add 172.16.0.0/17 <VPN IP ADDRESS> 
route add 10.128.0.0/20 <VPN IP ADDRESS> 

Now the client can ping the VPN LAN address of the VPN server (10.128.0.1), and also its Amazon LAN address (172.16.1.32). It runs into a problem, though, when trying to talk to other machines on the Amazon LAN: pings don't receive replies.

So, for example, if the client tries to ping a system that I know is up and responds to pings like 172.16.0.113, it won't see those replies (it says "Request timed out"). Wireshark on the VPN server confirms that it sees the ping from the client, and it even sees a reply sent from 172.16.0.113, but that reply apparently never makes it back to the client.

Furthermore, if I ping the client's VPN LAN address from 172.16.0.113, Wireshark on the VPN server sees the ping, but doesn't see a reply.

So, to recap:

• The VPN server can ping other machines on the Amazon LAN (172.16.0.0/17) and receive replies, and other machines on that network can do the same to it.
• A VPN client can ping the server's Amazon LAN address and receive replies, after the clients adds the proper route as described previously.
• A VPN client can ping the server's VPN LAN address of 10.128.0.1, and the VPN server can ping the client's VPN LAN address in the 10.128.0.0/20 range, after the client adds the route proper route as described previously.
• A VPN client can send pings to a machine on the Amazon LAN, but when those machines send replies, they stop at the VPN server - they don't get forwarded on to the client, resulting in "Request timed out" messages on the client. Conversely, when a machine on the Amazon LAN tries to ping the client's 10.128.0.0/20 VPN LAN address, the VPN server sees the ping, but the client never does and therefore doesn't generate a reply.

Why isn't the VPN server sending packets from the Amazon LAN down to its clients on the VPN LAN? It can definitely talk to the clients on the VPN LAN, and routing is enabled, and it's willing to route the packets from VPN LAN -> Amazon LAN, but not the reverse. What am I missing here?

Routes

Here are the routing tables from a VPN client. The client is a VirtualBox VM running Windows 8. It's vbox adapter's IP address is 10.0.2.15 on a /24. This client is behind NAT (actually, it's behind double-NAT, because the vbox adapter is NAT'd to my local network, which is NAT'd to the Internet). This route table is from after manually adding the routes to 10.128.0.0/20 and 172.16.0.0/17.

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0         10.0.2.2        10.0.2.15     10
         10.0.2.0    255.255.255.0         On-link         10.0.2.15    266
        10.0.2.15  255.255.255.255         On-link         10.0.2.15    266
       10.0.2.255  255.255.255.255         On-link         10.0.2.15    266
       10.128.0.0    255.255.240.0         On-link        10.128.0.3     15
       10.128.0.3  255.255.255.255         On-link        10.128.0.3    266
    10.128.15.255  255.255.255.255         On-link        10.128.0.3    266
    54.213.67.179  255.255.255.255         10.0.2.2        10.0.2.15     11
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
       172.16.0.0    255.255.128.0         On-link        10.128.0.3     15
   172.16.127.255  255.255.255.255         On-link        10.128.0.3    266
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         10.0.2.15    266
        224.0.0.0        240.0.0.0         On-link        10.128.0.3    266
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link         10.0.2.15    266
  255.255.255.255  255.255.255.255         On-link        10.128.0.3    266
===========================================================================
Persistent Routes:
  None

Here are the routing tables from the RRAS server, which is running Windows Server 2012. This server is also behind NAT, as discussed above. It only has one NIC. Its private IP address is 172.16.1.32, on a /23 (that is itself part of a larger /17 network; I believe it's fair to ignore the parts of the /17 outside of the /23, since other machines on the /23 can't reach or be reached by VPN clients either).

The VPN virtual adapter has its own address, 10.128.0.1, which is assigned automatically the first time a client connects. The routes for 10.128.0.1 (to itself) and 10.128.0.2 (to its only client) that you see are also added automatically at that time. No routes are added to the VPN server manually.

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       172.16.0.1      172.16.1.32     10
       10.128.0.1  255.255.255.255         On-link        10.128.0.1    286
       10.128.0.2  255.255.255.255       10.128.0.2       10.128.0.1     31
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  169.254.169.250  255.255.255.255       172.16.0.1      172.16.1.32     10
  169.254.169.251  255.255.255.255       172.16.0.1      172.16.1.32     10
  169.254.169.254  255.255.255.255       172.16.0.1      172.16.1.32     10
       172.16.0.0    255.255.254.0         On-link       172.16.1.32     11
      172.16.1.32  255.255.255.255         On-link       172.16.1.32    266
     172.16.1.255  255.255.255.255         On-link       172.16.1.32    266
       172.16.2.0    255.255.254.0      172.168.0.1      172.16.1.32     11
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link       172.16.1.32    266
        224.0.0.0        240.0.0.0         On-link        10.128.0.1    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link       172.16.1.32    266
  255.255.255.255  255.255.255.255         On-link        10.128.0.1    286
===========================================================================
Persistent Routes:
  None

Here are the routing tables for another machine on the server's private network, also running Server 2012. It has one NIC, which has a private IP address of 172.16.1.177 - which means it's on the same /23 that the VPN server is. (Note that the route to the 10.128.0.0/20 is set on the gateway, which is controlled by Amazon, so you won't see it here. I have added the correct route to Amazon, evidenced by the fact that Wireshark on the VPN server sees the packets.)

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       172.16.0.1     172.16.1.177     10
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  169.254.169.250  255.255.255.255       172.16.0.1     172.16.1.177     10
  169.254.169.251  255.255.255.255       172.16.0.1     172.16.1.177     10
  169.254.169.254  255.255.255.255       172.16.0.1     172.16.1.177     10
       172.16.0.0    255.255.254.0         On-link      172.16.1.177    266
     172.16.1.177  255.255.255.255         On-link      172.16.1.177    266
     172.16.1.255  255.255.255.255         On-link      172.16.1.177    266
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      172.16.1.177    266
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      172.16.1.177    266
===========================================================================
Persistent Routes:
  None

Here are the routes in the Amazon console. I do think these are correct - the traffic is making it back to the VPN server, after all, only to disappear inside of it - but in case someone wants to see them, here they are. (Amazon does things a little weird. eni-2f3e8244 / i-77e26440 refers to the NIC on the VPN server, and igw-d4bc27bc refers to the Amazon-controlled Internet NAT/gateway that all of my instances use to talk to the Internet.)

10.128.0.0/20   eni-2f3e8244 / i-77e26440   
172.16.0.0/17   local   
0.0.0.0/0       igw-d4bc27bc

I have a server running strongSwan on an Amazon EC2 instance that I want to connect to with Windows 7. The strongSwan server is on a private network (IP address 172.16.1.15 on the network 172.16.0.0/17) and has traffic forwarded to its private address from a public IP address - this is what Amazon calls "Elastic IP".

I want to assign the clients addresses from another private subnet - 10.127.0.0/22 - and route traffic between the two private subnets. Note that the 172.16.0.0/17 subnet is managed by Amazon, but the 10.127.0.0/22 subnet isn't managed by anything right now (other than my ipsec.conf).

My Windows clients do connect to the VPN, but cannot connect to any hosts on the private network. My theory is that it is related to a problem with either the client routing or a lack of some iptables invocation on the server, but I'm not very knowledgeable in either domain and I've gotten stuck.

• I have installed Ubuntu 12.04 and strongswan-ikev2 on the server.
• ipsec version reports Linux strongSwan U4.5.2/K3.2.0-52-virtual
• Note that both the client and server are behind NAT (the client because it is on a local office network, and the server because it is in Amazon's cloud). I have unblocked UDP ports 500 and 4500 in the Amazon dashboard, and on the client's firewall.
• I have enabled IPv4 forwarding on the server: echo 1 > /proc/sys/net/ipv4/ip_forward
• I have gone into Amazon's VPC administrative UI for the 172.16.0.0/17 subnet and allowed all traffic to/from the 10.127.0.0/23 subnet.

• This is /etc/ipsec.conf:

  config setup
      plutostart=no
  
  conn %default
      keyexchange=ikev2
      dpdaction=clear
      dpddelay=300s
      rekey=no
  
  conn dlpvpn
      left=172.16.1.15
      leftauth=pubkey
      leftcert=openssl-cert.pem
      leftid=vpn.example.com
      leftsubnet=172.16.0.0/17
      right=%any
      rightsourceip=10.127.0.0/22
      rightauth=eap-mschapv2
      rightsendcert=never
      eap_identity=%any
      auto=add
  

• This is /etc/ipsec.secrets:

  : RSA openssl-key.rsa
  TESTDOMAIN\testuser : EAP "testpassword"
  

• This is /etc/strongswan.conf:

  charon {
      threads = 16
      dns1 = 172.16.3.246
  }
  

• I want to use split tunneling - where only traffic for the private 172.16.0.0/17 network goes over the VPN, and traffic bound for the Internet uses the client's local gateway. To do this, I have unchecked "Use default gateway on remote network", and checked "Disable class based route addition" on the Windows client.

• The connection completes sucessfully. ipconfig /all shows:

  PPP adapter strongswan:
  
     Description . . . . . . . . . . . : strongswan
     IPv4 Address. . . . . . . . . . . : 10.127.0.1(Preferred)
     Subnet Mask . . . . . . . . . . . : 255.255.255.255
     Default Gateway . . . . . . . . . :
     DNS Servers . . . . . . . . . . . : 172.16.3.246
  

• However, I can't ping any host on the 172.16.0.0/17 network. In fact, if I do an nslookup, it attempts to contact the DNS server I specified in strongswan.conf, but Wireshark on that DNS server shows that it received nothing. I can't even ping the 172.16.1.15 address of the strongSwan server itself.

• It's my understanding that route rules must be added manually on Windows. However, what do they need to be? The only answer that I could come up with was to try adding the route for the 172.16.0.0/17 network to use the VPN server's address as the gateway using the command route add 172.16.0.0/17 172.16.1.15 if 45. However, that didn't change anything - traffic from my VPN client did not make it to the 172.16.0.0/17 network.

I'd appreciate any help. Thanks.

I have an AWS instance that I want to be a VPN server. It will connect Windows 7 clients to a private network in the Amazon cloud.

• I have installed Ubuntu 12.04 and the strongswan-ikev2 package.
• ipsec version reports Linux strongSwan U4.5.2/K3.2.0-52-virtual
• Note that both the client and server are behind NAT (the client because it is on a local office network, and the server because it is in Amazon's cloud). I have unblocked UDP ports 500 and 4500 on both the Amazon dashboard and the client's firewall.

• This is /etc/ipsec.conf:

  config setup
      plutostart=no
  
  conn %default
      keyexchange=ikev2
      ike=aes256-sha1-modp1024!
      esp=aes256-sha1!
      dpdaction=clear
      dpddelay=300s
      rekey=no
  
  conn win7vpn
      left=%any
      leftsubnet=<amazon VPC CIDR block>
      leftauth=pubkey
      leftcert=openssl-cert.pem
      leftid=<vpn server public dns name>
      right=%any
      rightsourceip=<amazon private IP address, which elastic ip is forwarded to>
      rightauth=eap-mschapv2
      rightsendcert=never
      eap_identity=%any
      auto=add
  

• This is /etc/ipsec.secrets:

  : RSA openssl-key.rsa
  TESTDOMAIN\testuser : EAP "testpassword"
  

• I have added the CA certificate that signed the server's host cert to the local machine (not user) cert store so that Windows can authenticate the server.

I then try to connect to the server using the Windows 7 client as prescribed here, with one exception - I'm using the DNS name rather than the IP address. I enter the username, domain, and password in my ipsec.secrets file, and it tries to connect.

When it does, I get strongSwan logs that look like this. I munged these a bit for both censorship and clarity; CLIENTPUB/CLIENTPRIV are the client's public and private IP addresses and AMAZONPRIV is the server's private IP address (which is what the server's public IP - Amazon calls this an "Elastic IP" - forwards to).

Sep  4 00:16:17 localhost charon: 14[IKE] CLIENTPUB is initiating an IKE_SA
Sep  4 00:16:17 localhost charon: 14[NET] received packet: from CLIENTPUB[500] to AMAZONPRIV[500]
Sep  4 00:16:17 localhost charon: 14[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
Sep  4 00:16:17 localhost charon: 14[IKE] CLIENTPUB is initiating an IKE_SA
Sep  4 00:16:17 localhost charon: 14[IKE] local host is behind NAT, sending keep alives
Sep  4 00:16:17 localhost charon: 14[IKE] remote host is behind NAT
Sep  4 00:16:17 localhost charon: 14[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]
Sep  4 00:16:17 localhost charon: 14[NET] sending packet: from AMAZONPRIV[500] to CLIENTPUB[500]
Sep  4 00:16:17 localhost charon: 15[NET] received packet: from CLIENTPUB[4500] to AMAZONPRIV[4500]
Sep  4 00:16:17 localhost charon: 15[ENC] unknown attribute type INTERNAL_IP4_SERVER
Sep  4 00:16:17 localhost charon: 15[ENC] parsed IKE_AUTH request 1 [ IDi CERTREQ N(MOBIKE_SUP) CP(ADDR DNS NBNS SRV) SA TSi TSr ]
Sep  4 00:16:17 localhost charon: 15[IKE] received cert request for "C=US, ST=TX, O=Test CA, CN=Test CA"
Sep  4 00:16:17 localhost charon: 15[IKE] received 316 cert requests for an unknown ca
Sep  4 00:16:17 localhost charon: 15[CFG] looking for peer configs matching AMAZONPRIV[%any]...CLIENTPUB[CLIENTPRIV]
Sep  4 00:16:17 localhost charon: 15[CFG] selected peer config 'dlpvpn'
Sep  4 00:16:17 localhost charon: 15[IKE] initiating EAP-Identity request
Sep  4 00:16:17 localhost charon: 15[IKE] peer supports MOBIKE
Sep  4 00:16:17 localhost charon: 15[IKE] authentication of 'C=US, ST=TX, O=DLP Test CA, CN=vpn.example.com' (myself) with RSA signature successful
Sep  4 00:16:17 localhost charon: 15[IKE] sending end entity cert "C=US, ST=TX, O=DLP Test CA, CN=vpn.example.com"
Sep  4 00:16:17 localhost charon: 15[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]
Sep  4 00:16:17 localhost charon: 15[NET] sending packet: from AMAZONPRIV[4500] to CLIENTPUB[4500]

At this point, Windows pops up an error message immediately:

Verifying user name and password...
Error 13801: IKE authentication credentials are unacceptable

After a few seconds, charon tries again and then closes the connection.

Sep  4 00:16:37 localhost charon: 16[IKE] sending keep alive
Sep  4 00:16:37 localhost charon: 16[NET] sending packet: from AMAZONPRIV[4500] to CLIENTPUB[4500]
Sep  4 00:16:47 localhost charon: 03[JOB] deleting half open IKE_SA after timeout

And that's it.

As far as I can tell, I'm following all of the instructions on the strongSwan wiki.

What am I doing wrong here?

Edit: this is definitely a problem with certificates. I disabled the extended validation checks by editing the registry and rebooting as described in MSKB926182 (lol if you wanted a link to that) and I can now connect to my VPN server with no errors. I'll figure out how to generate certs that satisfy the requirements and add an answer. Thanks to @ecdsa for the pointer to the cert page on the strongSwan wiki that got me pointed in the right direction.