mirror of
https://github.com/hwdsl2/docker-ipsec-vpn-server.git
synced 2026-04-26 18:15:50 +03:00
[GH-ISSUE #195] Can login to VPN but cannot access internet #182
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @jsdnhk-devops on GitHub (May 27, 2020).
Original GitHub issue: https://github.com/hwdsl2/docker-ipsec-vpn-server/issues/195
Message from
ipsec statusinside the container:Help with thanks.
@hwdsl2 commented on GitHub (May 27, 2020):
@jsdnhk-devops Are you using an Android device? Please try the instructions in "important notes" section [1]. You must re-create the Docker container after modifying
vpn.env. If not working, try also running these commands inside your Docker container [2]. Let us know if this works.[1] https://github.com/hwdsl2/docker-ipsec-vpn-server#important-notes
[2] https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/clients.md#android-mtumss-issues
@jsdnhk-devops commented on GitHub (May 30, 2020):
@hwdsl2 yes it's using android mobiles to connect.
For point 1, i added the line
VPN_SHA2_TRUNCBUG=yesinto vpn.env included indocker runprocess.For point 2, i run these commands before executing
/opt/src/run.shin/etc/rc.local, which is the file volumed and executed indocker runcommand.The modified settings is occupied in the container, while still can login to VPN but cannot access internet.
There is
ipsec statusoutput in the container for lookup.@hwdsl2 commented on GitHub (May 30, 2020):
@jsdnhk-devops Please try the latest version of the Docker image using these instructions [1]. I have added a new variable
VPN_ANDROID_MTU_FIX[2] to automatically apply the Android MTU/MSS fix [3] inside the container. AddVPN_ANDROID_MTU_FIX=yesto yourenvfile to enable.In the latest image, I also added output line
Setting sha2-truncbug to yes in ipsec.conf...that you will see fromdocker logs ipsec-vpn-server, if you putVPN_SHA2_TRUNCBUG=yesin yourenvfile.From your logs, it does seem related to the sha2-truncbug issue. Note that you must re-create the Docker container (refer to [1]) every time you modify your
envfile, otherwise the changes won't take effect. After updating to the latest Docker image, look for the output line above to confirm thatsha2-truncbug=yeshas been set correctly.[1] https://github.com/hwdsl2/docker-ipsec-vpn-server#update-docker-image
[2]
a156117[3] https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/clients.md#android-mtumss-issues
@jsdnhk-devops commented on GitHub (May 31, 2020):
After setting
VPN_ANDROID_MTU_FIX=yes,VPN_SHA2_TRUNCBUG=yesin env file included,then recreate the container, next using android mobile to connect via IPSec Xauth PSK,
the condition keeps the same and give the following status report.
@hwdsl2 commented on GitHub (May 31, 2020):
@jsdnhk-devops Thanks for the update. Reading your logs output again, I see that
AES_CBC_256-HMAC_SHA2_512_256is used, therefore it's not an issue with sha2-truncbug. You can removeVPN_SHA2_TRUNCBUG=yesfrom yourenvfile.Can you successfully connect using IPsec/L2TP mode [1]? If you cannot, this is likely an IPTables problem. Check the output of
docker logs ipsec-vpn-serverto see if there is any error, if so, post the error details here.[1] https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/clients.md
@jsdnhk-devops commented on GitHub (Jun 1, 2020):
thanks for helping, this situation started to happen currently, it worked in few month before.
It sets to 500/udp, 4500/udp exposed in container, host(fw), gateway as well.
when using android via IPsec/L2TP,
docker logsrepeats showing,while it shows nothing if using IPSec Xauth PSK on
docker logs,ipsec statusmessage via IPsec/L2TP,@hwdsl2 commented on GitHub (Jun 1, 2020):
@jsdnhk-devops This looks like an IPTables issue, but I'm not sure. Does
docker logs ipsec-vpn-servershow any IPTables-related errors when the container starts?You can enable Libreswan logs [1] for further troubleshooting. After enabling, try to re-connect the VPN, then check logs with:
[1] https://github.com/hwdsl2/docker-ipsec-vpn-server#enable-libreswan-logs
@jsdnhk-devops commented on GitHub (Jun 2, 2020):
@hwdsl2 thanks reminding the firewall issue, it got fixed by following which is podman internal bug,
https://bugzilla.redhat.com/show_bug.cgi?id=1805212
that would cause the container's network packages cannot be sent out.
@jsdnhk-devops commented on GitHub (Jun 2, 2020):
Curiously, would like to ask that are there any methods or healthcheck tools to check and keep VPN service working?
As sometimes I connected to use the service, and found that was disabled then have to recreate the container again to use.
For ensuring the process running supervisor can help.
@hwdsl2 commented on GitHub (Jun 2, 2020):
@jsdnhk-devops Glad that you resolved the issue. For checking and keeping the VPN service running, the
--restart=alwaysparameter [1] ofdocker runcan help to auto restart the container on exit. Maybe you can also check that UDP port 500 is open, and theplutoprocess is running.[1] https://github.com/hwdsl2/docker-ipsec-vpn-server#start-the-ipsec-vpn-server