0

I am attempting to create a Home VPN connection using a raspberry pi 4. I followed directions on https://www.digitalocean.com/community/tutorials/how-to-set-up-an-ikev2-vpn-server-with-strongswan-on-ubuntu-20-04 which seemed very promising. I am able to connect via VPN within my home network but not outside of it. I'm not sure what exactly I'm doing wrong. My router is a Verizon MI424WR router without a VPN passthrough as far as I am aware. Is a VPN passthrough required for a IKev2 connection type?

Ipsec.conf

config setup
    charondebug="ike 1, knl 1, cfg 0"
    uniqueids=no

conn ikev2-vpn
    auto=add
    compress=no
    type=tunnel
    keyexchange=ikev2
    fragmentation=yes
    forceencaps=yes
    ike=aes256-sha1-modp2048,3des-sha1-modp2048!
    esp=aes256-sha1,3des-sha1!
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%any
    leftid=<Public IP address>
    #leftid=<Internal Address>
    leftcert=/etc/ipsec.d/certs/vpn-server-cert.pem
    leftsendcert=always
    leftsubnet=0.0.0.0/0
    right=%any
    rightid=%any
    rightauth=eap-mschapv2
    rightdns=8.8.8.8,8.8.4.4
    rightsourceip=10.10.10.0/24
    rightsendcert=never
    eap_identity=%identity

ipsec.secrets

# This file holds shared secrets or RSA private keys for authentication.

RSA private key for this host, authenticating it to any other host


which knows the public part.


this file is managed with debconf and will contain the automatically created private key


include /var/lib/strongswan/ipsec.secrets.inc
<Public IP address> : RSA "vpn-server-key.pem"


user1 : EAP "password1"
user2 : EAP "password2"
user3 : EAP "password3"

Thanks!

1 Answers1

0

From your question, which doesn't include any information on how your network is set up, I would deduct that you will have to forward UDP port 500 and 4500 from your WAN router to your VPN host. Maybe protocol type 50 has to be forwarded, too, depending on your routers configuration and/or options.

Note that it is (usually) not easy to do IPSec through NAT (or port forwarding, which is worse). Chances are high that OpenVPN with SSL or IKv2 VPN (with StrongSwan) would be a better choice for you.

bjoster
  • 375