Questions[ipsec](ubuntu)

I'm trying to create an L2TP/IPSEC VPN server in 20.04 that uses LDAP for user authentication.

I'm assuming Strongswan does this.

Where, in Strongswan or other configs would I add the LDAP server info?

Or does it just use SSSD or PAM or something else and you just point Strongswan to that?

I'm specifically looking for LDAP, not Radius. I know radius is possible.

Any help would be appreciated. I realize there are a few questions close to this one. But all their answers require a GUI. This a cloud server, so no gui. Thanks!

I'm using the Gnome Network manager to connect to my office VPN. It's using StrongSwan IPSec.

It connects fine, but all my internet traffic is routed through the office. I don't want this, I only want to see the IP addresses of my office without all my internet traffic going through the office. Also, if possible, to use the office DNS to resolve the office server names (but this is less important).

The following settings are set:

• Gateway Address: IP address of the office
• Certificates: All working, I'm using "Certificate/private key".
• Options: All options are enabled.
• IPv4: I tried a view settings here, but currently only "Automatic (DHCP)" is selected.
• IPv6: Disabled.

UPDATE: My ip -r output is:

default via 192.168.188.1 dev enp3s0 proto dhcp metric 100 
169.254.0.0/16 dev enp3s0 scope link metric 1000 
192.168.2.103 dev enp3s0 proto kernel scope link src 192.168.2.103 metric 50 
192.168.2.103 dev enp3s0 proto kernel scope link src 192.168.2.103 metric 100 
192.168.188.0/24 dev enp3s0 proto kernel scope link src 192.168.188.21 metric 100 

I set up my system according to a tutorial I found on the Internet.

I basically installed the necessary dependencies:

sudo apt install network-manager 
sudo apt install network-manager-l2tp
sudo apt install network-manager-strongswan

And configured them by applying changes on the following files (VPN_SERVER_IP, VPN_IPSEC_PSK, VPN_USERNAME, VPN_PASSWORD are replaced by the real values; XXX.XXX.XXX.XXX in the logs down below is the IP address of the VPN server)

/etc/ipsec.conf:

conn %default
  ikelifetime=60m
  keylife=20m
  rekeymargin=3m
  keyingtries=1
  keyexchange=ikev1
  authby=secret
  ike=aes128-sha1-modp1024,3des-sha1-modp1024!
  esp=aes128-sha1-modp1024,3des-sha1-modp1024!

conn myvpn
  keyexchange=ikev1
  left=%defaultroute
  auto=add
  authby=secret
  type=transport
  leftprotoport=17/1701
  rightprotoport=17/1701
  right=$VPN_SERVER_IP

/etc/ipsec.secrets:

: PSK "$VPN_IPSEC_PSK"

/etc/xl2tpd/xl2tpd.conf:

[lac myvpn]
lns = $VPN_SERVER_IP
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tpd.client
length bit = yes

/etc/ppp/options.l2tpd.client:

ipcp-accept-local
ipcp-accept-remote
refuse-eap
require-chap
noccp
noauth
mtu 1280
mru 1280
noipdefault
defaultroute
usepeerdns
debug
lock
connect-delay 5000
name $VPN_USERNAME
password $VPN_PASSWORD

/etc/NetworkManager/NetworkManager.conf (default, nothing changed):

[main]
plugins=ifupdown,keyfile

[ifupdown]
managed=false

[device]
wifi.scan-rand-mac-address=no

When I want to connect to VPN I do /etc/init.d/network-manager start, nothing extraordinary shows up in the logs:

ifupdown configuration found.
<info>  [1559053123.4216] devices added (path: /sys/devices/virtual/net/lo, iface: lo)
<info>  [1559053123.4216] device added (path: /sys/devices/virtual/net/lo, iface: lo): no ifupdown configuration found.
<info>  [1559053123.4216] end _init.
<info>  [1559053123.4216] settings: loaded plugin ifupdown: (C) 2008 Canonical Ltd.  To report bugs please use the NetworkManager mailing list. (/usr/lib/x86_64-linux-gnu/NetworkManager/libnm-settings-plugin-ifupdown.so)
<info>  [1559053123.4217] settings: loaded plugin keyfile: (c) 2007 - 2016 Red Hat, Inc.  To report bugs please use the NetworkManager mailing list.
May 28 16:18:43 phenom nm-dispatcher: req:1 'hostname': new request (1 scripts)
<info>  [1559053123.4217] (735157440) ... get_connections.
May 28 16:18:43 phenom nm-dispatcher: req:1 'hostname': start running ordered scripts...
<info>  [1559053123.4217] (735157440) ... get_connections (managed=false): return empty list.
<info>  [1559053123.4218] get unmanaged devices count: 0
<info>  [1559053123.4218] manager: rfkill: WiFi enabled by radio killswitch; enabled by state file
<info>  [1559053123.4218] manager: rfkill: WWAN enabled by radio killswitch; enabled by state file
<info>  [1559053123.4218] manager: Networking is enabled by state file
<info>  [1559053123.4219] dhcp-init: Using DHCP client 'dhclient'
<info>  [1559053123.4220] Loaded device plugin: NMBondDeviceFactory (internal)
<info>  [1559053123.4220] Loaded device plugin: NMBridgeDeviceFactory (internal)
<info>  [1559053123.4220] Loaded device plugin: NMDummyDeviceFactory (internal)
<info>  [1559053123.4220] Loaded device plugin: NMEthernetDeviceFactory (internal)
<info>  [1559053123.4220] Loaded device plugin: NMInfinibandDeviceFactory (internal)
<info>  [1559053123.4221] Loaded device plugin: NMIPTunnelDeviceFactory (internal)
<info>  [1559053123.4221] Loaded device plugin: NMMacsecDeviceFactory (internal)
<info>  [1559053123.4221] Loaded device plugin: NMMacvlanDeviceFactory (internal)
<info>  [1559053123.4221] Loaded device plugin: NMPppDeviceFactory (internal)
<info>  [1559053123.4221] Loaded device plugin: NMTunDeviceFactory (internal)
<info>  [1559053123.4221] Loaded device plugin: NMVethDeviceFactory (internal)
<info>  [1559053123.4221] Loaded device plugin: NMVlanDeviceFactory (internal)
<info>  [1559053123.4222] Loaded device plugin: NMVxlanDeviceFactory (internal)
<info>  [1559053123.4229] Loaded device plugin: NMWwanFactory (/usr/lib/x86_64-linux-gnu/NetworkManager/libnm-device-plugin-wwan.so)
<info>  [1559053123.4234] Loaded device plugin: NMBluezManager (/usr/lib/x86_64-linux-gnu/NetworkManager/libnm-device-plugin-bluetooth.so)
<info>  [1559053123.4236] Loaded device plugin: NMWifiFactory (/usr/lib/x86_64-linux-gnu/NetworkManager/libnm-device-plugin-wifi.so)
<info>  [1559053123.4242] Loaded device plugin: NMTeamFactory (/usr/lib/x86_64-linux-gnu/NetworkManager/libnm-device-plugin-team.so)
<info>  [1559053123.4244] Loaded device plugin: NMAtmManager (/usr/lib/x86_64-linux-gnu/NetworkManager/libnm-device-plugin-adsl.so)
<info>  [1559053123.4252] device (lo): carrier: link connected
<info>  [1559053123.4258] manager: (lo): new Generic device (/org/freedesktop/NetworkManager/Devices/1)
<info>  [1559053123.4262] device (enp5s0): carrier: link connected
<info>  [1559053123.4285] manager: (enp5s0): new Ethernet device (/org/freedesktop/NetworkManager/Devices/2)
<info>  [1559053123.4335] modem-manager: ModemManager available
<info>  [1559053123.4336] manager: startup complete

ipsec up myvpn also seems successful:

initiating Main Mode IKE_SA myvpn[1] to 82.161.237.247
generating ID_PROT request 0 [ SA V V V V V ]
sending packet: from 192.168.10.56[500] to 82.161.237.247[500] (212 bytes)
received packet: from 82.161.237.247[500] to 192.168.10.56[500] (136 bytes)
parsed ID_PROT response 0 [ SA V V V ]
received XAuth vendor ID
received DPD vendor ID
received NAT-T (RFC 3947) vendor ID
generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
sending packet: from 192.168.10.56[500] to 82.161.237.247[500] (244 bytes)
received packet: from 82.161.237.247[500] to 192.168.10.56[500] (244 bytes)
parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]
local host is behind NAT, sending keep alives
generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
sending packet: from 192.168.10.56[4500] to 82.161.237.247[4500] (108 bytes)
received packet: from 82.161.237.247[4500] to 192.168.10.56[4500] (76 bytes)
parsed ID_PROT response 0 [ ID HASH ]
IKE_SA myvpn[1] established between 192.168.10.56[192.168.10.56]...82.161.237.247[82.161.237.247]
scheduling reauthentication in 3420s
maximum IKE_SA lifetime 3600s
generating QUICK_MODE request 1511457566 [ HASH SA No KE ID ID NAT-OA NAT-OA ]
sending packet: from 192.168.10.56[4500] to 82.161.237.247[4500] (364 bytes)
received packet: from 82.161.237.247[4500] to 192.168.10.56[4500] (332 bytes)
parsed QUICK_MODE response 1511457566 [ HASH SA No KE ID ID NAT-OA NAT-OA ]
CHILD_SA myvpn{1} established with SPIs c970ab39_i cf32f312_o and TS 192.168.10.56/32[udp/l2f] === 82.161.237.247/32[udp/l2f]
generating QUICK_MODE request 1511457566 [ HASH ]
sending packet: from 192.168.10.56[4500] to 82.161.237.247[4500] (60 bytes)
connection 'myvpn' established successfully

So in general it looks like there are no errors, but I am unable to verify whether I actually made the connection or not. The biggest issue is that no ppp0 device shows up when I execute ip link:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp5s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 6c:f0:49:70:55:16 brd ff:ff:ff:ff:ff:ff

Because of that I am unable do define which traffic should go through the VPN server. How can I ensure that ppp0 device shows up and the IP address is assigned to it by the DHCP/VPN server?

My network setup is somewhat complex, so let's explain it.

But first keep in mind that everything works perfectly with ubuntu 16.04, nixOs, several flavours of Arch based distribs, and windows 10.

here it is :

[HOME NETWORK] <--l2tp-ipsec-VPN---> [OFFICE NETWORK - with a DNS] <---Site2SiteVPN----> [some other cloud resource]

Expected result example :

• establish vpn connection from home to office
• acquire an IP in the expected range (172. instead of 192..., )
• obtain a correct DNS config
• SSH or HTTPS to "some other cloud resource" => SHOULD work

On Ubuntu 18.04 :

sudo apt-get install network-manager-l2tp-gnome

then configure connexion, connect : Yeah ! the 'lock' appears near the network icon. Looks promising so far.

A new interface ppp0 appears, with an IP that seems OK

When checking 'whatsmyip.org' it now displays my office IP. Looks fine

ip addr
...
...
12: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1400 qdisc fq_codel state UNKNOWN group default qlen 3
  link/ppp
  inet 172.x.x.x peer 172.255.255.0/32 scope global ppp0

Now here is the issue : - impossible to reach any resource on "some other cloud resource"

http connecion times out, ssh does never answer. ...

I saw this issue on 3 different PCs, from 2 different locations. All of them used to work with 16.04.

Connexion IS established, no error appear on vpn server, or on networkmanager logs, but it's as if all connexions were not using the ppp0 interface.

Made me think of some kind on 'connexion priority' but I didn't find any way to play with that.

Any suggestion would be highly welcome.

Thanks!

PS : I also checked with 'route' command : ppp0 appears with top priority

What is the package that contain the implementation of IPsec and what is the package that contain the implementation of cypher algorithms that IPsec uses for enctiption?