We are running Ubuntu 16.04, clean install with latest StrongSWAN. We are creating a IPSEC tunnel between AWS and the droplet. The tunnel is up however we cannot connect to any ports on any AWS servers from the DO droplet.
We verified no firewall rules on the AWS side and no firewall or ufw enabled on the DO side. This same scenario with AWS on one side and hardware VPN’s on the other is working, it seems something specific to either the StrongSWAN config or DO infrastructure.
Here is the VPN status:
Security Associations (1 up, 0 connecting): Tunnel1[1]: ESTABLISHED 26 seconds ago, 162.243.5.4[162.243.5.4]…52.72.253.197[52.72.253.197] Tunnel1{1}: INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c849a6e6_i d4644947_o Tunnel1{1}: 0.0.0.0/0 === 0.0.0.0/0
VPN Config:
config setup # strictcrlpolicy=yes uniqueids = no
conn Tunnel1 auto=start left=%defaultroute leftid=162.243.5.4 right=52.72.253.197 type=tunnel leftauth=psk rightauth=psk keyexchange=ikev1 ike=aes128-sha1-modp1024 ikelifetime=8h esp=aes128-sha1-modp1024 lifetime=1h keyingtries=%forever leftsubnet=0.0.0.0/0 rightsubnet=0.0.0.0/0 dpddelay=10s dpdtimeout=30s dpdaction=restart mark=100
We have gone down so many paths to try to determine what is going on from the CIDR being too close to the DO Private IP to outdated StrongSWAN files. Any help is greatly appreciated. There must be something incredibly obvious we missed even though we have had 4 pairs of eyes on it for two days.
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
Is it a known issue that DO to AWS IPSEC tunnels cannot work? I have not found a single example of someone being successful in this using StrongSWAN or any other soft VPN based in Digital Ocean. Any insight at all? Thank you.
Hi. While this is not my area of expertise I shared your question on our internal Slack here at DO and one of our infrastructure engineers had some suggestions to share:
we'd first need to know what traffic they are trying to pass through the tunnel. If they are trying to do a simple host to host VPN then I'd guess that the `leftsubnet` and `rightsubnet` declarations are incorrect.
It was also recommended to review the examples:
https://wiki.strongswan.org/projects/strongswan/wiki/IKEv2Examples and https://wiki.strongswan.org/projects/strongswan/wiki/IKEv1Examples
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and SMBs
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.