mirror of
https://github.com/hwdsl2/docker-ipsec-vpn-server.git
synced 2026-04-26 10:05:48 +03:00
[GH-ISSUE #167] How to configure third-party radius #154
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @jiaweiwei32 on GitHub (Nov 15, 2019).
Original GitHub issue: https://github.com/hwdsl2/docker-ipsec-vpn-server/issues/167
Hello bro!
I hope you can help me to solve them,thank you !
Here is the basic information:
OS:centos7.2
docer version:18.03.0-ce
image:hwdsl2/ipsec-vpn-server
Everything is ok after startup
Now I want to join radius authentication
Configuration file /etc/ppp/options.xl2tpd added
plugin /usr/lib/pppd/2.4.7/radius.so
plugin /usr/lib/pppd/2.4.7/radattr.so
radius-config-file /usr/local/etc/radiusclient/radiusclient.conf
radiusclient connection ok,but the client did not request radius when dialing in
Here is the packet capture information:
10:42:40.693130 IP 192.168.59.60.isakmp > 71dad3cb4025.isakmp: isakmp: phase 1 I ident
10:42:40.693640 IP 71dad3cb4025.isakmp > 192.168.59.60.isakmp: isakmp: phase 1 R ident
10:42:40.694154 IP 71dad3cb4025.54714 > 192.168.52.253.domain: 12946+ PTR? 60.59.168.192.in-addr.arpa. (44)
10:42:40.694605 IP 192.168.52.253.domain > 71dad3cb4025.54714: 12946 NXDomain* 0/1/0 (103)
10:42:40.694812 IP 71dad3cb4025.38427 > 192.168.52.253.domain: 5464+ PTR? 253.52.168.192.in-addr.arpa. (45)
10:42:40.695187 IP 192.168.52.253.domain > 71dad3cb4025.38427: 5464 NXDomain* 0/1/0 (104)
10:42:40.728155 IP 192.168.59.60.isakmp > 71dad3cb4025.isakmp: isakmp: phase 1 I ident
10:42:40.729661 IP 71dad3cb4025.isakmp > 192.168.59.60.isakmp: isakmp: phase 1 R ident
10:42:40.847390 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: NONESP-encap: isakmp: phase 1 I ident[E]
10:42:40.847832 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: NONESP-encap: isakmp: phase 1 R ident[E]
10:42:42.027884 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: NONESP-encap: isakmp: phase 2/others I oakley-quick[E]
10:42:42.028884 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: NONESP-encap: isakmp: phase 2/others R oakley-quick[E]
10:42:42.529695 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: NONESP-encap: isakmp: phase 2/others R oakley-quick[E]
10:42:42.561123 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: NONESP-encap: isakmp: phase 2/others I oakley-quick[E]
10:42:42.561323 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: UDP-encap: ESP(spi=0xde50f676,seq=0x1), length 132
10:42:42.562175 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: UDP-encap: ESP(spi=0x0d78f860,seq=0x1), length 164
10:42:42.594914 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: NONESP-encap: isakmp: phase 2/others I oakley-quick[E]
10:42:42.619367 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: UDP-encap: ESP(spi=0xde50f676,seq=0x2), length 68
10:42:42.619371 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: UDP-encap: ESP(spi=0xde50f676,seq=0x3), length 84
10:42:42.619563 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: UDP-encap: ESP(spi=0x0d78f860,seq=0x2), length 68
10:42:42.619689 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: UDP-encap: ESP(spi=0x0d78f860,seq=0x3), length 84
10:42:42.619750 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: UDP-encap: ESP(spi=0x0d78f860,seq=0x4), length 68
10:42:42.632348 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: UDP-encap: ESP(spi=0xde50f676,seq=0x4), length 100
10:42:42.632616 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: UDP-encap: ESP(spi=0x0d78f860,seq=0x5), length 68
10:42:42.636848 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: UDP-encap: ESP(spi=0x0d78f860,seq=0x6), length 84
10:42:42.694769 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: UDP-encap: ESP(spi=0xde50f676,seq=0x5), length 84
10:42:42.694777 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: UDP-encap: ESP(spi=0xde50f676,seq=0x6), length 84
10:42:42.695947 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: UDP-encap: ESP(spi=0x0d78f860,seq=0x7), length 84
10:42:42.696000 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: UDP-encap: ESP(spi=0x0d78f860,seq=0x8), length 68
10:42:42.696029 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: UDP-encap: ESP(spi=0x0d78f860,seq=0x9), length 84
10:42:43.202342 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: UDP-encap: ESP(spi=0xde50f676,seq=0x7), length 68
10:42:43.202483 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: UDP-encap: ESP(spi=0x0d78f860,seq=0xa), length 68
10:42:43.203383 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: UDP-encap: ESP(spi=0xde50f676,seq=0x8), length 68
10:42:43.203390 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: UDP-encap: ESP(spi=0xde50f676,seq=0x9), length 100
10:42:43.204046 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: UDP-encap: ESP(spi=0x0d78f860,seq=0xb), length 68
10:42:43.204078 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: UDP-encap: ESP(spi=0x0d78f860,seq=0xc), length 84
10:42:43.216173 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: UDP-encap: ESP(spi=0xde50f676,seq=0xa), length 116
10:42:43.216261 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: UDP-encap: ESP(spi=0x0d78f860,seq=0xd), length 68
10:42:43.225363 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: UDP-encap: ESP(spi=0xde50f676,seq=0xb), length 100
10:42:43.225471 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: UDP-encap: ESP(spi=0xde50f676,seq=0xc), length 100
10:42:43.225578 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: UDP-encap: ESP(spi=0x0d78f860,seq=0xe), length 68
10:42:43.225706 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: UDP-encap: ESP(spi=0x0d78f860,seq=0xf), length 68
10:42:43.243249 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: NONESP-encap: isakmp: phase 2/others I inf[E]
10:42:43.243693 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: NONESP-encap: isakmp: phase 2/others R inf[E]
10:42:43.243990 IP 192.168.59.60.ipsec-nat-t > 71dad3cb4025.ipsec-nat-t: NONESP-encap: isakmp: phase 2/others I inf[E]
10:42:43.257523 IP 71dad3cb4025.ipsec-nat-t > 192.168.59.60.ipsec-nat-t: NONESP-encap: isakmp: phase 2/others R inf[E]
10:42:43.855992 IP 192.168.59.60.58528 > 71dad3cb4025.l2f: l2tp:TLSNs=4,Nr=2 *MSGTYPE(CDN) *ASSND_SESS_ID(42650) RESULT_CODE(768/0 )
10:42:45.699671 ARP, Request who-has 71dad3cb4025 tell 172.17.0.1, length 28
10:42:45.699688 ARP, Reply 71dad3cb4025 is-at 02:42:ac:11:00:03 (oui Unknown), length 28
10:42:45.699833 IP 71dad3cb4025.35782 > 192.168.52.253.domain: 33811+ PTR? 1.0.17.172.in-addr.arpa. (41)
10:42:45.700334 IP 192.168.52.253.domain > 71dad3cb4025.35782: 33811 NXDomain 0/1/0 (100)
10:42:45.856950 IP 192.168.59.60.58528 > 71dad3cb4025.l2f: l2tp:TLSNs=4,Nr=2 *MSGTYPE(CDN) *ASSND_SESS_ID(42650) *RESULT_CODE(768/0 )
10:42:46.207067 IP 71dad3cb4025.l2f > 192.168.59.60.58528: l2tp: {LCP, Term-Request (0x05), id 3, length 18}
10:42:49.864330 IP 192.168.59.60.58528 > 71dad3cb4025.l2f: l2tp:TLSNs=4,Nr=2 *MSGTYPE(CDN) *ASSND_SESS_ID(42650) *RESULT_CODE(768/0 )
10:42:50.707686 ARP, Request who-has 172.17.0.1 tell 71dad3cb4025, length 28
10:42:50.707733 ARP, Reply 172.17.0.1 is-at 02:42:cd:d5:d5:0f (oui Unknown), length 28
10:42:53.866949 IP 192.168.59.60.58528 > 71dad3cb4025.l2f: l2tp:TLSNs=4,Nr=2 *MSGTYPE(CDN) *ASSND_SESS_ID(42650) *RESULT_CODE(768/0 )
10:42:57.871779 IP 192.168.59.60.58528 > 71dad3cb4025.l2f: l2tp:TLSNs=4,Nr=2 *MSGTYPE(CDN) *ASSND_SESS_ID(42650) *RESULT_CODE(768/0 )
10:43:01.913335 IP 192.168.59.60.58528 > 71dad3cb4025.l2f: l2tp:TLSNs=4,Nr=2 *MSGTYPE(CDN) *ASSND_SESS_ID(42650) *RESULT_CODE(768/0 )
Hope to get your reply!Thank you so mush!
@hwdsl2 commented on GitHub (Nov 15, 2019):
@jiaweiwei32 Hello! I would recommend that you ask on the Libreswan or strongSwan mailing lists [1] [2] because I am not familiar with the RADIUS setup.
[1] https://lists.libreswan.org/mailman/listinfo/swan
[2] https://lists.strongswan.org/mailman/listinfo/users
@jiaweiwei32 commented on GitHub (Nov 15, 2019):
ok! Thank you so much!
@peimansh commented on GitHub (Nov 27, 2019):
@jiaweiwei32 have you found a solution for this ?!