mirror of
https://github.com/hwdsl2/docker-ipsec-vpn-server.git
synced 2026-04-26 01:55:53 +03:00
[GH-ISSUE #204] Unable to have 2 vpn clients connected via IKEv2 #191
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @usmcfiredog on GitHub (Oct 2, 2020).
Original GitHub issue: https://github.com/hwdsl2/docker-ipsec-vpn-server/issues/204
Checklist
Describe the issue
A clear and concise description of what the bug is.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
A clear and concise description of what you expected to happen.
Have multiple devices log in with different certs
Logs
ID_DER_ASN1_DN 'O=IKEv2 VPN,CN=vpnclient2' does not match expected 'CN=vpnclient1, O=IKEv2 VPN'
Peer CERT payload SubjectAltName does not match peer ID for this connection
X509: connection failed due to unmatched IKE ID in certificate SAN
Peer ID '@vpnclient2' is not specified on the certificate SubjectAltName (SAN) and no better connection found responding to IKE_AUTH message (ID 1) from 172.17.0.1:55157 with encrypted notification AUTHENTICATION_FAILED
Server (please complete the following information)
Client (please complete the following information)
Additional context
Add any other context about the problem here.
@hwdsl2 commented on GitHub (Nov 7, 2020):
@usmcfiredog Thanks for reporting this issue. Connecting multiple IKEv2 clients from behind the same NAT requires setting the "local ID" field to match the VPN client name. Please follow these client configuration instructions [1], make sure to complete the "local ID" step. For context, see [2] [3].
[1] https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/ikev2-howto.md#configure-ikev2-vpn-clients
[2]
github.com/hwdsl2/setup-ipsec-vpn@71dc5bab01[3] libreswan/libreswan#237
@usmcfiredog commented on GitHub (Nov 7, 2020):
I have followed those steps and it is still referring to the local ID of the already connected device and won't let the second device connect.
@hwdsl2 commented on GitHub (Nov 7, 2020):
@usmcfiredog Did you fill in the "Local ID" field for both the first and second VPN client devices in their VPN configurations? In addition, those IDs must match the VPN client names you specified during IKEv2 setup, respectively (same as the filename without extension of your
.p12files). This did work fine in my tests.@usmcfiredog commented on GitHub (Nov 7, 2020):
yes I did. for the first client I put the same exact name in the local id as I used to create the .p12. I used a different name for the second client and made sure that local id matched exactly.
@hwdsl2 commented on GitHub (Feb 2, 2021):
@usmcfiredog Update - The root cause for this issue (connecting multiple IKEv2 clients simultaneously from behind the same NAT) has been identified, and a fix was submitted in
github.com/hwdsl2/setup-ipsec-vpn@954b2acb7c. To fix this issue on your VPN server, see https://github.com/hwdsl2/setup-ipsec-vpn/issues/924#issuecomment-771327878.@usmcfiredog commented on GitHub (Feb 2, 2021):
@hwdsl2 I went into the config file and removed the '@' next to the IP address and it works as expected. Thank you.