Trying to upgrade my ikev1/l2tp connection to ikev2.
Fwiw my ikev1/l2tp client config only works once i add a route after the connection comes up. Tho i didn’t need to do anything about the firewall. (All i’ve ever done with the firewall is --add-port=24800/tcp for synergy.)
The ikev2 config is different tho. No l2tp. My strongswan client config gets the ikev2 connection up but gets no traffic through. Strangely meanwhile firewall-cmd --set-log-denied=all shows no related drops or rejects.
Yet traffic does get through, without me adding a route, if i either disable firewalld or move enp3s0 to the trusted zone, neither of which is smart. Can anyone tell me what to do so the firewall allows ikev2 tunnel traffic?
i’m using strongswan-ipsec for direct access to strongswan features, and configuring PSK, tho at this point i’m wondering if perhaps NetworkManager-strongswan implements the missing firewall magic, tho annoyingly it does not support PSK.
+ zypper --color --no-refresh se ngsw
Loading repository data...
Reading installed packages...
S | Name | Summary | Type
---+----------------------------------+-------------------------------------------------------------+--------
| NetworkManager-applet-strongswan | NetworkManager VPN support for strongSwan | package
| NetworkManager-strongswan | NetworkManager VPN support for strongSwan | package
| NetworkManager-strongswan-lang | Translations for package NetworkManager-strongswan | package
| plasma6-nm-strongswan | strongSwan support for plasma6-nm | package
i | strongswan | IPsec-based VPN solution | package
| strongswan-doc | Documentation for strongSwan | package
| strongswan-fips | Config file to disable non FIPS-140-2 algos in strongSwan | package
i+ | strongswan-ipsec | Old-style "ipsec" interface (stroke/starter) for strongSwan | package
| strongswan-mysql | MySQL plugin for strongSwan | package
| strongswan-nm | NetworkManager plugin for strongSwan | package
| strongswan-sqlite | SQLite plugin for strongSwan | package
…might mean there’s a hope it might handle whatever the firewall needs, but something amidst NetworkManager-strongswan, NetworkManager-applet-strongswan or plasma6-nm-strongswan is hitting some authorization agent issue:
May 10 08:54:49 e540 NetworkManager[1565]: <warn> [1746885289.8246] vpn[0x55b77a72b180,686a2149-0e04-4b4e-9663-e5db74132ab6,"7nm"]: secrets: failed to request VPN secrets #3: No agents were available for this request.
May 10 08:54:49 e540 kded6[4245]: org.kde.plasma.nm.kded: Unhandled VPN connection state change: NetworkManager::VpnConnection::NeedAuth
if i ignore networkmanager and just use ipsec up it passes authorization, but, traffic only gets through if the firewall is disabled.
When the tunnel comes up enp3s0 gets an additional address, from the leftsourceip pool on the remote network, and table 220 gets a route for it. Traffic flows properly through that route but only when the firewall is disabled.
(This box is the gateway for 3 separate wifi zones, hence the 3 addresses. in the route tables you can see the gateway for this box, and said gateway, not wlp4s0, also handles the wifi.)
before tunnel:
+2025-05-12Mon09:28:06+ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: wlp4s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether 26:e8:81:7f:5c:15 brd ff:ff:ff:ff:ff:ff permaddr 48:51:b7:b1:da:14
altname wlx4851b7b1da14
3: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 68:f7:28:40:f3:46 brd ff:ff:ff:ff:ff:ff
altname enx68f72840f346
inet 10.3.3.7/27 brd 10.3.3.31 scope global noprefixroute enp3s0
valid_lft forever preferred_lft forever
inet 10.3.7.7/28 brd 10.3.7.15 scope global noprefixroute enp3s0
valid_lft forever preferred_lft forever
inet 10.3.1.7/25 brd 10.3.1.127 scope global noprefixroute enp3s0
valid_lft forever preferred_lft forever
+2025-05-12Mon09:28:06+ ip -4 r
default via 10.3.3.3 dev enp3s0 proto static metric 100
10.3.1.0/25 dev enp3s0 proto kernel scope link src 10.3.1.7 metric 100
10.3.3.0/27 dev enp3s0 proto kernel scope link src 10.3.3.7 metric 100
10.3.7.0/28 dev enp3s0 proto kernel scope link src 10.3.7.7 metric 100
+2025-05-12Mon09:28:06+ ip r show table all
default via 10.3.3.3 dev enp3s0 proto static metric 100
10.3.1.0/25 dev enp3s0 proto kernel scope link src 10.3.1.7 metric 100
10.3.3.0/27 dev enp3s0 proto kernel scope link src 10.3.3.7 metric 100
10.3.7.0/28 dev enp3s0 proto kernel scope link src 10.3.7.7 metric 100
local 10.3.1.7 dev enp3s0 table local proto kernel scope host src 10.3.1.7
broadcast 10.3.1.127 dev enp3s0 table local proto kernel scope link src 10.3.1.7
local 10.3.3.7 dev enp3s0 table local proto kernel scope host src 10.3.3.7
broadcast 10.3.3.31 dev enp3s0 table local proto kernel scope link src 10.3.3.7
local 10.3.7.7 dev enp3s0 table local proto kernel scope host src 10.3.7.7
broadcast 10.3.7.15 dev enp3s0 table local proto kernel scope link src 10.3.7.7
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
+2025-05-12Mon09:28:06+ ip -6 r
+2025-05-12Mon09:28:06+ ip xfrm policy
src ::/0 dst ::/0
socket in priority 0 ptype main
src ::/0 dst ::/0
socket out priority 0 ptype main
src ::/0 dst ::/0
socket in priority 0 ptype main
src ::/0 dst ::/0
socket out priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0 ptype main
+2025-05-12Mon09:28:06+ ip xfrm state
+2025-05-12Mon09:28:06+ ipsec statusall
Status of IKE charon daemon (strongSwan 6.0.1, Linux 6.14.1-1-default, x86_64):
uptime: 28 minutes, since May 12 09:00:00 2025
malloc: sbrk 3080192, mmap 0, used 997232, free 2082960
worker threads: 10 of 16 idle, 6/0/0/0 working, job queue: 0/0/0/0, scheduled: 0
loaded plugins: charon ldap pkcs11 blowfish md4 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pgp dnskey sshkey pem openssl gcrypt pkcs8 af-alg fips-prf gmp agent xcbc cmac kdf ctr ccm gcm dr>
Listening IP addresses:
10.3.3.7
10.3.7.7
10.3.1.7
Connections:
7: %any...209.23.153.217 IKEv1/2
7: local: [mg010000] uses EAP_MSCHAPV2 authentication
7: remote: [green] uses pre-shared key authentication
7: child: dynamic === 192.168.128.0/21 TUNNEL
8: %any...209.23.153.218 IKEv1/2
8: local: [mg010000] uses EAP_MSCHAPV2 authentication
8: remote: [green] uses pre-shared key authentication
8: child: dynamic === 192.168.128.0/21 TUNNEL
Security Associations (0 up, 0 connecting):
none
with tunnel:
+2025-05-12Mon11:04:25+ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: wlp4s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether 26:e8:81:7f:5c:15 brd ff:ff:ff:ff:ff:ff permaddr 48:51:b7:b1:da:14
altname wlx4851b7b1da14
3: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 68:f7:28:40:f3:46 brd ff:ff:ff:ff:ff:ff
altname enx68f72840f346
inet 10.3.3.7/27 brd 10.3.3.31 scope global noprefixroute enp3s0
valid_lft forever preferred_lft forever
inet 10.3.7.7/28 brd 10.3.7.15 scope global noprefixroute enp3s0
valid_lft forever preferred_lft forever
inet 10.3.1.7/25 brd 10.3.1.127 scope global noprefixroute enp3s0
valid_lft forever preferred_lft forever
inet 192.168.128.242/32 scope global enp3s0
valid_lft forever preferred_lft forever
+2025-05-12Mon11:04:25+ ip -4 r
default via 10.3.3.3 dev enp3s0 proto static metric 100
10.3.1.0/25 dev enp3s0 proto kernel scope link src 10.3.1.7 metric 100
10.3.3.0/27 dev enp3s0 proto kernel scope link src 10.3.3.7 metric 100
10.3.7.0/28 dev enp3s0 proto kernel scope link src 10.3.7.7 metric 100
+2025-05-12Mon11:04:25+ ip r show table all
192.168.128.0/21 via 10.3.3.3 dev enp3s0 table 220 proto static src 192.168.128.242
default via 10.3.3.3 dev enp3s0 proto static metric 100
10.3.1.0/25 dev enp3s0 proto kernel scope link src 10.3.1.7 metric 100
10.3.3.0/27 dev enp3s0 proto kernel scope link src 10.3.3.7 metric 100
10.3.7.0/28 dev enp3s0 proto kernel scope link src 10.3.7.7 metric 100
local 10.3.1.7 dev enp3s0 table local proto kernel scope host src 10.3.1.7
broadcast 10.3.1.127 dev enp3s0 table local proto kernel scope link src 10.3.1.7
local 10.3.3.7 dev enp3s0 table local proto kernel scope host src 10.3.3.7
broadcast 10.3.3.31 dev enp3s0 table local proto kernel scope link src 10.3.3.7
local 10.3.7.7 dev enp3s0 table local proto kernel scope host src 10.3.7.7
broadcast 10.3.7.15 dev enp3s0 table local proto kernel scope link src 10.3.7.7
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
local 192.168.128.242 dev enp3s0 table local proto kernel scope host src 192.168.128.242
+2025-05-12Mon11:04:25+ ip -6 r
+2025-05-12Mon11:04:25+ ip xfrm policy
src 192.168.128.242/32 dst 192.168.128.0/21
dir out priority 372863 ptype main
tmpl src 10.3.3.7 dst 209.23.153.217
proto esp spi 0xc90a9054 reqid 1 mode tunnel
src 192.168.128.0/21 dst 192.168.128.242/32
dir fwd priority 372863 ptype main
tmpl src 209.23.153.217 dst 10.3.3.7
proto esp reqid 1 mode tunnel
src 192.168.128.0/21 dst 192.168.128.242/32
dir in priority 372863 ptype main
tmpl src 209.23.153.217 dst 10.3.3.7
proto esp reqid 1 mode tunnel
src ::/0 dst ::/0
socket in priority 0 ptype main
src ::/0 dst ::/0
socket out priority 0 ptype main
src ::/0 dst ::/0
socket in priority 0 ptype main
src ::/0 dst ::/0
socket out priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0 ptype main
+2025-05-12Mon11:04:25+ ip xfrm state
src 10.3.3.7 dst 209.23.153.217
proto esp spi 0xc90a9054 reqid 1 mode tunnel
replay-window 0 flag af-unspec
aead rfc4106(gcm(aes)) 0xa21863a42381a2525a0802b697555c054a951167e60a93e28a492e5120ab0652567f333a 128
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
dir out
src 209.23.153.217 dst 10.3.3.7
proto esp spi 0xc41696a9 reqid 1 mode tunnel
replay-window 32 flag af-unspec
aead rfc4106(gcm(aes)) 0x248417b322cf3200d96c94fa737bfac1c985bdf1757b5a1df5da902434837c6ce5213881 128
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
dir in
+2025-05-12Mon11:04:25+ ipsec statusall
Status of IKE charon daemon (strongSwan 6.0.1, Linux 6.14.1-1-default, x86_64):
uptime: 25 seconds, since May 12 11:04:00 2025
malloc: sbrk 3223552, mmap 0, used 1319120, free 1904432
worker threads: 10 of 16 idle, 6/0/0/0 working, job queue: 0/0/0/0, scheduled: 3
loaded plugins: charon ldap pkcs11 blowfish md4 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pgp dnskey sshkey pem openssl gcrypt pkcs8 af-alg fips-prf gmp agent xcbc cmac kdf ctr ccm gcm dr>
Listening IP addresses:
10.3.3.7
10.3.7.7
10.3.1.7
Connections:
7: %any...209.23.153.217 IKEv1/2
7: local: [mg010000] uses EAP_MSCHAPV2 authentication
7: remote: [green] uses pre-shared key authentication
7: child: dynamic === 192.168.128.0/21 TUNNEL
8: %any...209.23.153.218 IKEv1/2
8: local: [mg010000] uses EAP_MSCHAPV2 authentication
8: remote: [green] uses pre-shared key authentication
8: child: dynamic === 192.168.128.0/21 TUNNEL
Security Associations (1 up, 0 connecting):
7[1]: ESTABLISHED 10 seconds ago, 10.3.3.7[mg010000]...209.23.153.217[green]
7[1]: IKEv2 SPIs: 862a2cb777d6afb1_i* a9bd0ec4f7eca07d_r, EAP reauthentication in 2 hours
7[1]: IKE proposal: AES_GCM_16_256/PRF_HMAC_SHA2_384/ECP_384
7{1}: INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c41696a9_i c90a9054_o
7{1}: AES_GCM_16_256, 0 bytes_i, 0 bytes_o, rekeying in 44 minutes
7{1}: 192.168.128.242/32 === 192.168.128.0/21