search

hwdsl2 / docker-ipsec-vpn-server

Docker image to run an IPsec VPN server, with IPsec/L2TP, Cisco IPsec and IKEv2
https://hub.docker.com/r/hwdsl2/ipsec-vpn-server
Other
6.37k stars 1.38k forks source link

使用StrongSwan客户端连接docker服务端提示用户鉴权失败 #365

Closed KongGuoguang closed 1 year ago

KongGuoguang commented 1 year ago

Android系统手机，docker镜像是arm32位，一直报这个错， 手头还有另外一个arm64的机器，dockers部署之后连接正常，

贴上strongswan客户端的日志 [redacted]

hwdsl2 commented 1 year ago

@KongGuoguang 你好！你的客户端日志显示错误 received TS_UNACCEPTABLE notify, no CHILD_SA built，你可以在服务器上启用 Libreswan 日志，然后重新尝试连接并检查服务器日志中的具体错误，并在这里回复。

KongGuoguang commented 1 year ago

@KongGuoguang 你好！你的客户端日志显示错误 received TS_UNACCEPTABLE notify, no CHILD_SA built，你可以在服务器上启用 Libreswan 日志，然后重新尝试连接并检查服务器日志中的具体错误，并在这里回复。

启用 Libreswan 日志的命令无法执行 root@hi3798mv100:~# docker exec -it ipsec-vpn-server env TERM=xterm bash -l 3e07a11d8831:/opt/src# apt-get update && apt-get -y install rsyslog bash: apt-get: command not found 3e07a11d8831:/opt/src#

hwdsl2 commented 1 year ago

@KongGuoguang Follow instructions for the Alpine-based image:

# For Alpine-based image
apk add --no-cache rsyslog
rsyslogd
rc-service ipsec stop; rc-service -D ipsec start >/dev/null 2>&1
sed -i '/pluto\.pid/a rsyslogd' /opt/src/run.sh
exit
KongGuoguang commented 1 year ago

@KongGuoguang Follow instructions for the Alpine-based image:

# For Alpine-based image
apk add --no-cache rsyslog
rsyslogd
rc-service ipsec stop; rc-service -D ipsec start >/dev/null 2>&1
sed -i '/pluto\.pid/a rsyslogd' /opt/src/run.sh
exit

感谢大佬指点，日志拿到了 Libreswan日志.txt [redacted]

hwdsl2 commented 1 year ago

@KongGuoguang 看了你提供的日志。与此问题相关部分如下：

ERROR: "ikev2-cp"[1] ... #2: netlink response for Add SA ...: Function not implemented (errno 38)
"ikev2-cp"[1] ... #2: setup_half_ipsec_sa() hit fail:
"ikev2-cp"[1] ... #1: deleting state (STATE_V2_ESTABLISHED_IKE_SA) aged 0.854448s and NOT sending notification

这说明你的 arm32 的 Docker 主机的 Linux 内核对 IPsec 的支持有一些问题，所以连接不能成功建立。建议你另外使用比如 arm64 的 Docker 主机。