OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • English Forums »
  • Virtual private networks »
  • No luck in setting up a 'road warrior' IPsec VPN for iPhone
« previous next »
  • Print
Pages: [1]

Author Topic: No luck in setting up a 'road warrior' IPsec VPN for iPhone  (Read 567 times)

gctwnl

  • Jr. Member
  • **
  • Posts: 60
  • Karma: 0
    • View Profile
No luck in setting up a 'road warrior' IPsec VPN for iPhone
« on: November 27, 2022, 06:14:26 pm »
I'm migrating from EdgeMax to opnsense (DEC695).

I have a couple of iOS devices that can currently connect to the EdgeMax to create a VPN connection to my LAN. But I can't get opnsense configured so that they can keep connecting when I switch the EdgeMax for opnsense.

These are set like this on iOS:
  • Description: whatever
  • Server: the reverse-DNS-able DNS name of the fixed IP address
  • Account: username
  • RSA SecurID: <off>
  • Password: userpassword
  • Secret: PSK-key
  • Send All Traffic: <on>
  • Proxy: <off>

I can get a connection from the iOS device it seems, but not completely.

IPsec debug log shows (this seems to be the problem):
Code: [Select]
2022-11-27T18:00:33 Informational charon 11[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit

In full:
Code: [Select]
2022-11-27T18:00:35 Informational charon 11[IKE] <con1|1> deleting IKE_SA con1[1] between 213.125.118.50[213.125.118.50]...77.63.95.239[0.0.0.0]
2022-11-27T18:00:35 Informational charon 11[IKE] <con1|1> received DELETE for IKE_SA con1[1]
2022-11-27T18:00:35 Informational charon 11[ENC] <con1|1> parsed INFORMATIONAL_V1 request 3005588752 [ HASH D ]
2022-11-27T18:00:35 Informational charon 11[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (108 bytes)
2022-11-27T18:00:33 Informational charon 11[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:33 Informational charon 11[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:30 Informational charon 14[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:30 Informational charon 14[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:27 Informational charon 14[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:27 Informational charon 14[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:25 Informational charon 14[IKE] <con1|1> sending keep alive to 77.63.95.239[30476]
2022-11-27T18:00:24 Informational charon 13[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:24 Informational charon 13[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:20 Informational charon 13[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:20 Informational charon 13[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:17 Informational charon 13[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:17 Informational charon 13[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:14 Informational charon 13[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:14 Informational charon 13[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:11 Informational charon 13[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:11 Informational charon 13[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:08 Informational charon 13[IKE] <con1|1> received retransmit of request with ID 112451562, but no response to retransmit
2022-11-27T18:00:08 Informational charon 13[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:05 Informational charon 13[NET] <con1|1> sending packet: from 213.125.118.50[4500] to 77.63.95.239[30476] (92 bytes)
2022-11-27T18:00:05 Informational charon 13[ENC] <con1|1> generating INFORMATIONAL_V1 request 2505490210 [ HASH N(INVAL_ID) ]
2022-11-27T18:00:05 Informational charon 13[IKE] <con1|1> no matching CHILD_SA config found for 77.63.95.239/32[udp/61811] === 213.125.118.50/32[udp/l2f]
2022-11-27T18:00:05 Informational charon 13[ENC] <con1|1> parsed QUICK_MODE request 112451562 [ HASH SA No ID ID NAT-OA NAT-OA ]
2022-11-27T18:00:05 Informational charon 13[NET] <con1|1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (428 bytes)
2022-11-27T18:00:04 Informational charon 14[NET] <con1|1> sending packet: from 213.125.118.50[4500] to 77.63.95.239[30476] (92 bytes)
2022-11-27T18:00:04 Informational charon 14[ENC] <con1|1> generating ID_PROT response 0 [ ID HASH ]
2022-11-27T18:00:04 Informational charon 14[IKE] <con1|1> maximum IKE_SA lifetime 28465s
2022-11-27T18:00:04 Informational charon 14[IKE] <con1|1> scheduling reauthentication in 27925s
2022-11-27T18:00:04 Informational charon 14[IKE] <con1|1> IKE_SA con1[1] established between 213.125.118.50[213.125.118.50]...77.63.95.239[0.0.0.0]
2022-11-27T18:00:04 Informational charon 14[CFG] <1> selected peer config "con1"
2022-11-27T18:00:04 Informational charon 14[CFG] <1> looking for pre-shared key peer configs matching 213.125.118.50...77.63.95.239[0.0.0.0]
2022-11-27T18:00:04 Informational charon 14[ENC] <1> parsed ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
2022-11-27T18:00:04 Informational charon 14[NET] <1> received packet: from 77.63.95.239[30476] to 213.125.118.50[4500] (108 bytes)
2022-11-27T18:00:04 Informational charon 14[NET] <1> sending packet: from 213.125.118.50[500] to 77.63.95.239[30475] (396 bytes)
2022-11-27T18:00:04 Informational charon 14[ENC] <1> generating ID_PROT response 0 [ KE No NAT-D NAT-D ]
2022-11-27T18:00:04 Informational charon 14[IKE] <1> remote host is behind NAT
2022-11-27T18:00:04 Informational charon 14[IKE] <1> local host is behind NAT, sending keep alives
2022-11-27T18:00:04 Informational charon 14[ENC] <1> parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]
2022-11-27T18:00:04 Informational charon 14[NET] <1> received packet: from 77.63.95.239[30475] to 213.125.118.50[500] (380 bytes)
2022-11-27T18:00:04 Informational charon 14[NET] <1> sending packet: from 213.125.118.50[500] to 77.63.95.239[30475] (160 bytes)
2022-11-27T18:00:04 Informational charon 14[ENC] <1> generating ID_PROT response 0 [ SA V V V V ]
2022-11-27T18:00:04 Informational charon 14[CFG] <1> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
2022-11-27T18:00:04 Informational charon 14[IKE] <1> 77.63.95.239 is initiating a Main Mode IKE_SA
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received DPD vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received FRAGMENTATION vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike-02 vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike-03 vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike-04 vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike-05 vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike-06 vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike-07 vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike-08 vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received draft-ietf-ipsec-nat-t-ike vendor ID
2022-11-27T18:00:04 Informational charon 14[IKE] <1> received NAT-T (RFC 3947) vendor ID
2022-11-27T18:00:04 Informational charon 14[ENC] <1> parsed ID_PROT request 0 [ SA V V V V V V V V V V V V ]
2022-11-27T18:00:04 Informational charon 14[NET] <1> received packet: from 77.63.95.239[30475] to 213.125.118.50[500] (788 bytes)
2022-11-27T17:58:05 Informational charon 01[CFG] added configuration 'con1'
2022-11-27T17:58:05 Informational charon 01[CFG] adding virtual IP address pool 192.168.2.160/27
2022-11-27T17:58:05 Informational charon 01[CFG] received stroke: add connection 'con1'
2022-11-27T17:58:05 Informational charon 00[JOB] spawning 16 worker threads
2022-11-27T17:58:05 Informational charon 00[LIB] loaded plugins: charon aes des blowfish rc2 sha2 sha1 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs12 pgp dnskey sshkey pem openssl pkcs8 fips-prf curve25519 xcbc cmac hmac kdf gcm drbg attr kernel-pfkey kernel-pfroute resolve socket-default stroke vici updown eap-identity eap-md5 eap-mschapv2 eap-radius eap-tls eap-ttls eap-peap xauth-generic xauth-eap xauth-pam whitelist addrblock counters
2022-11-27T17:58:05 Informational charon 00[CFG] loaded 0 RADIUS server configurations
2022-11-27T17:58:05 Informational charon 00[CFG] expanding file expression '/usr/local/etc/ipsec.secrets.opnsense.d/*.secrets' failed
2022-11-27T17:58:05 Informational charon 00[CFG]   loaded IKE secret for %any
2022-11-27T17:58:05 Informational charon 00[CFG]   loaded IKE secret for gerbeniphone
2022-11-27T17:58:05 Informational charon 00[CFG] loading secrets from '/usr/local/etc/ipsec.secrets'
2022-11-27T17:58:05 Informational charon 00[CFG] loading crls from '/usr/local/etc/ipsec.d/crls'
2022-11-27T17:58:05 Informational charon 00[CFG] loading attribute certificates from '/usr/local/etc/ipsec.d/acerts'
2022-11-27T17:58:05 Informational charon 00[CFG] loading ocsp signer certificates from '/usr/local/etc/ipsec.d/ocspcerts'
2022-11-27T17:58:05 Informational charon 00[CFG] loading aa certificates from '/usr/local/etc/ipsec.d/aacerts'
2022-11-27T17:58:05 Informational charon 00[CFG] loading ca certificates from '/usr/local/etc/ipsec.d/cacerts'
2022-11-27T17:58:05 Informational charon 00[NET] enabling UDP decapsulation for IPv6 on port 4500 failed
2022-11-27T17:58:05 Informational charon 00[KNL] unable to set UDP_ENCAP: Invalid argument
2022-11-27T17:58:05 Informational charon 00[DMN] Starting IKE charon daemon (strongSwan 5.9.8, FreeBSD 13.1-RELEASE-p2, amd64)
2022-11-27T17:58:01 Informational charon 00[DMN] SIGINT received, shutting down
Logged
  • Print
Pages: [1]
« previous next »
  • OPNsense Forum »
  • English Forums »
  • Virtual private networks »
  • No luck in setting up a 'road warrior' IPsec VPN for iPhone
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2024 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy     | XHTML | RSS | WAP2