Comments (13)
Please download and run pscollect from this github and provide the output here. Please have all firewall rules for wg and openvpn enabled so the iptables rules uesd by those VPNs are enabled.
from pistrong.
from pistrong.
The output on screen after pscollect is
[sudo] password for pi:
*** Gathering diagnostic information for pistrong/strongSwan ***
...Environmental details
...apt-cache policy strongswan
...systemctl status strongswan
...pistrong config [minus smtp credentials]
...pistrong showca
...pistrong list --full
...copy /etc/swanctl/pistrong/makeCA.log
...copy /etc/swanctl/conf.d/pistrong-CAServerConnection.conf
...ls -lR /etc/swanctl
...ip configuration information
Error: ipv4: FIB table does not exist.
Dump terminated
...iptables filter table
...iptables nat table
...journalctl for charon and swanctl
Done.
As far as I know the firewall settings (if any, port forwarding is set on the router) for wg and openvpn are unaltered. I should say that I have not yet tried to use the pistrong certs etc on my phone
from pistrong.
Thanks for the pscollect output. I was hoping that it might show something obvious in the iptables output, but of course, no joy. There don't appear to be any packets that hit the two strongSwan iptables rules in the POSTROUTING table, so this is very confusing. Are you saying that if you remove the two rules for 10.1.10.0/24 in the POSTROUTING table that wg and ovpn then work correctly?
Another question from your initial post: You said that you're using "a commercial IKEV2 connection to a paid VPN provider". Is that via pistrong/strongSwan or something else? I don't see any traces of that in the iptables listing unless it's in a docker container.
Are either wg or ovpn using subnet 10.1.10.0/24 for anything? Doesn't look like it from the iptables output, but want to confirm that.
I may need to set up a similar configuration for in-depth examination. If that's the case, and to set your expectations, I won't be able to do that for about a week.
from pistrong.
from pistrong.
from pistrong.
Hi, I'm back. I see that this issue is closed. Did you resolve it? If not, please re-open and LMK the current status. Thanks
from pistrong.
from pistrong.
Now reopened, I have not attempted to resolve it since we were last in touch. Thanks for your interest and let me know if I can provide further information.
from pistrong.
I have a configuration set up as:
+--------+ +--------+
| pi3 | <-------router1-------><-------router2----->| pi4 |
+--------+ +--------+
configuration:
Pi3: IP=192.168.16.2
Router1 LAN IP: 192.168.16.1
Router1 WAN IP: 2.2.2.2
Pi4: IP=192.168.32.2
Router2 LAN IP: 192.168.32.2
Router2 WAN IP: 2.2.2.3
The Pis are set up as a site-to-site tunnel, which is different than the client/server VPN you configured, but the iptables rules are similar.
On this configuration I'm able to bring up BOTH wg and strongswan tunnels, at the same time.
Traffic passes fine between them. Pi3 is able to ping the wg private address of Pi4 (10.8.0.2), and also the remote LAN address of the Pi over strongswan.
I can't add a client/server VPN to this configuration at the moment, and it will be a while before I am able to do so. With that said, besides the client/server VPN difference, I note that you also have docker installed.
WRT to openvpn, the only thing I know about it is the slowest and most complex by far of wg/strongswan/ovpn. I don't have the time to chase down any ovpn-related issues.
So, here are some things we can try with your system to help nail it down.
- Shut down all VPNs the server
- Start wg server
- grab the output from
sudo iptables -L -v -n > iptables-wg-no-traffic.txt
andsudo iptables -t nat -L -v -n >> iptables-wg-no-traffic.txt
- Connect to the wg server
- While the connection is up and passing traffic generated from the remote end, grab the output from
sudo iptables -L -v -n > iptables-wg-with-traffic.txt
andsudo iptables -t nat -L -v -n >> iptables-wg-with-traffic.txt
- Stop wg server
- Start the strongswan server and grab the iptables outputs as above, but obviously to a different file
- Start the wg server and grab the iptables outputs again, and again, to another different file
- Post those files here
If you can do all of the above without docker started, that would be EXTREMELY helpful. I'm not convinced that docker is the culprit, but docker does mess with iptables and adds a level of complexity that I simply don't have time to muck with.
from pistrong.
from pistrong.
from pistrong.
Closing for lack of a repro. OP, if you can provide a repro on a clean system so that I can replicate it here, please re-open with all details.
from pistrong.
Related Issues (8)
- Pistrong Setup Help (VPN Server Local LAN Subnet/Can't Detect Gateway IP Address) HOT 22
- Linux mint not recognised for dependency installation in install script. HOT 7
- client install fails HOT 11
- iOS Devices Can't Connect To VPN/Pistrong HOT 4
- Site to Site VPN on same subnet HOT 2
- Site to Site Tunnel Routing issues? HOT 13
- smtpuser HOT 6
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from pistrong.