# IPsec **URL:** https://community.ipfire.org/c/vpn/ipsec/7.md [Latest](https://community.ipfire.org/latest.md) · [Categories](https://community.ipfire.org/categories.md) --- ## [About the IPsec category](https://community.ipfire.org/t/about-the-ipsec-category/14)
**Author:** [@ms](https://community.ipfire.org/u/ms)\ **Replies:** 0\ **Last updated:** [23 October 2019 10:09 UTC](https://community.ipfire.org/t/about-the-ipsec-category/14 "2019-10-23T10:09:13Z")
Site-to-site tunnels and host-to-net connections using IPsec. --- ## [Leftover StrongSwan 5 plugin configs causing load errors after upgrade to StrongSwan 6](https://community.ipfire.org/t/leftover-strongswan-5-plugin-configs-causing-load-errors-after-upgrade-to-strongswan-6/16238)
**Author:** [@tikok974](https://community.ipfire.org/u/tikok974)\ **Replies:** 2\ **Last updated:** [23 October 2026 11:05 UTC](https://community.ipfire.org/t/leftover-strongswan-5-plugin-configs-causing-load-errors-after-upgrade-to-strongswan-6/16238 "2026-10-23T11:05:09Z")
Hello, On an IPFire system running StrongSwan 6.0.7 (after recent Core Updates), Charon logs multiple plugin loading failures upon startup: charon: 00\[LIB\] plugin 'aes': failed to load - version field aes\_plugin\_versio… --- ## [Manually Create IPSec Root and Host Certificates](https://community.ipfire.org/t/manually-create-ipsec-root-and-host-certificates/15795)
**Author:** [@wtme4](https://community.ipfire.org/u/wtme4)\ **Replies:** 7\ **Last updated:** [24 May 2026 12:10 UTC](https://community.ipfire.org/t/manually-create-ipsec-root-and-host-certificates/15795 "2026-05-24T12:10:00Z")
Hi everybody! First, thank you, especially the developers for IPFire. I’m happy to use the firewall system for multiple years. (Fujitsu Futro S920/S930 work so flawless.) In the past, the IPSec Root certificates were v… --- ## [MacOS Tahoe 26.5 - IPSec VPN stopped working on new VPN connections](https://community.ipfire.org/t/macos-tahoe-26-5-ipsec-vpn-stopped-working-on-new-vpn-connections/15802)
**Author:** [@jon](https://community.ipfire.org/u/jon)\ **Replies:** 0\ **Last updated:** [19 May 2026 18:46 UTC](https://community.ipfire.org/t/macos-tahoe-26-5-ipsec-vpn-stopped-working-on-new-vpn-connections/15802 "2026-05-19T18:46:35Z")
This is probably more a Mac issue than an IPFire CU201 issue but I am wondering if Mac users in the Community are seeing the same. (There is a small possibility it is related to IPFire but I cannot find it) I was on Ma… --- ## [IPSEC Site-To\_Site Missing Remote Subnet setting](https://community.ipfire.org/t/ipsec-site-to-site-missing-remote-subnet-setting/15587)
**Author:** [@sailingcheese](https://community.ipfire.org/u/sailingcheese)\ **Replies:** 3\ **Last updated:** [10 March 2026 15:47 UTC](https://community.ipfire.org/t/ipsec-site-to-site-missing-remote-subnet-setting/15587 "2026-03-10T15:47:11Z")
In Core-Update 198 IPsec tunnel settings there is a Remote subnet option. In Core-Update 200 IPsec tunnel this field is missing??? It is replaced by a DNS Servers field… (The remote subnet field is gone !!) Where can… --- ## [Ipsec.conf entry with exclamation mark not working](https://community.ipfire.org/t/ipsec-conf-entry-with-exclamation-mark-not-working/15432)
**Author:** [@stefan2k1](https://community.ipfire.org/u/stefan2k1)\ **Replies:** 2\ **Last updated:** [27 January 2026 09:49 UTC](https://community.ipfire.org/t/ipsec-conf-entry-with-exclamation-mark-not-working/15432 "2026-01-27T09:49:12Z")
Hello, I am creating a IPSec connection in the Webgui and save it. The ipsec.conf contains these lines (and of course many more): ike=aes128-sha-modp1024! esp=aes128-sha1-modp1024! At the end there is a exclamation m… --- ## [IPSEC VPN not allowing files transfers over ~230mb](https://community.ipfire.org/t/ipsec-vpn-not-allowing-files-transfers-over-230mb/15315)
**Author:** [@minifiredragon](https://community.ipfire.org/u/minifiredragon)\ **Replies:** 7\ **Last updated:** [7 December 2025 05:07 UTC](https://community.ipfire.org/t/ipsec-vpn-not-allowing-files-transfers-over-230mb/15315 "2025-12-07T05:07:37Z")
As the title says, IPSEC VPN drops connection/stops transferring a file when it reaches around 230mb. In the process of troubleshooting, I setup another IPSEC VPN at another location and attempted the same file download… --- ## [Why is remote .253 not reachable via IPSEC](https://community.ipfire.org/t/why-is-remote-253-not-reachable-via-ipsec/15161)
**Author:** [@shvll](https://community.ipfire.org/u/shvll)\ **Replies:** 7\ **Last updated:** [24 October 2025 13:25 UTC](https://community.ipfire.org/t/why-is-remote-253-not-reachable-via-ipsec/15161 "2025-10-24T13:25:53Z")
I have two IPFire-Boxes successfully deployed, one at the GH site and one at the PB site, both running version IPFire 2.29-197. The ORANGE networks at both sites are connected via IPSEC. IPSEC is connected via VTI (17… --- ## [Problems with ipsec net2net psk connection](https://community.ipfire.org/t/problems-with-ipsec-net2net-psk-connection/14125)
**Author:** [@bonnietwin](https://community.ipfire.org/u/bonnietwin)\ **Replies:** 4\ **Last updated:** [26 May 2025 08:48 UTC](https://community.ipfire.org/t/problems-with-ipsec-net2net-psk-connection/14125 "2025-05-26T08:48:31Z")
I am trying to set up a net2net ipsec connection with PSK on my vm testbed for evaluation purposes. I have two vm IPFires and the ipsec n2n connection at each end is as shown in these two screenshots In both cases… --- ## [Multiple subnets in IPsec: Only first one is reachable](https://community.ipfire.org/t/multiple-subnets-in-ipsec-only-first-one-is-reachable/1488)
**Author:** [@larsen](https://community.ipfire.org/u/larsen)\ **Replies:** 9\ **Last updated:** [8 May 2025 09:17 UTC](https://community.ipfire.org/t/multiple-subnets-in-ipsec-only-first-one-is-reachable/1488 "2025-05-08T09:17:51Z")
The local IPFire initiates a connection to a partner’s remote system. The remote endpoint is not ipfire (don’t know what exactly) but capable of handling multiple subnets with one connection. Problem: The tunnel is esta… --- ## [Ipsec n2n psk routing between](https://community.ipfire.org/t/ipsec-n2n-psk-routing-between/13996)
**Author:** [@joximu](https://community.ipfire.org/u/joximu)\ **Replies:** 0\ **Last updated:** [28 April 2025 17:01 UTC](https://community.ipfire.org/t/ipsec-n2n-psk-routing-between/13996 "2025-04-28T17:01:02Z")
Hi I have several IPSec Tunnels net-to-net created to several IPFire stations. Lets say: IPF-priv, IPF-bus1, IPF-bus2 und IPF-bus3. Routing between priv and bus1 - no problem (both directions), between priv and bus2, … --- ## [Dead Peer Detection Restart not working](https://community.ipfire.org/t/dead-peer-detection-restart-not-working/7718)
**Author:** [@bloater99](https://community.ipfire.org/u/bloater99)\ **Replies:** 10\ **Last updated:** [24 March 2025 16:21 UTC](https://community.ipfire.org/t/dead-peer-detection-restart-not-working/7718 "2025-03-24T16:21:56Z")
Our IPsec VPN connection to an Amazon cloud server is always on and for the most part is very solid. Occasionally (about once a month) it will lose connection though. We have a monitor system that alerts us when this h… --- ## [IPSec setup blues](https://community.ipfire.org/t/ipsec-setup-blues/13382)
**Author:** [@sonic](https://community.ipfire.org/u/sonic)\ **Replies:** 23\ **Last updated:** [31 December 2024 17:14 UTC](https://community.ipfire.org/t/ipsec-setup-blues/13382 "2024-12-31T17:14:06Z")
I cannot make IPSec to work. I started with this: www.ipfire.org - Host-to-Net Connections (Roadwarrior) I wanted to try first with the PSK, figuring it it’s easier. Well, I am stumped by the local ID and remote ID fi… --- ## [Ipsec behind NAT NAT-T](https://community.ipfire.org/t/ipsec-behind-nat-nat-t/13268)
**Author:** [@aborenas](https://community.ipfire.org/u/aborenas)\ **Replies:** 3\ **Last updated:** [10 December 2024 15:10 UTC](https://community.ipfire.org/t/ipsec-behind-nat-nat-t/13268 "2024-12-10T15:10:23Z")
Dec 3 16:16:43 front01 charon: 16\[NET\] sending packet: from 197.254.237.210\[500\] to 207.127.101.19\[500\] (36 bytes) Dec 3 16:16:46 front01 charon: 10\[IKE\] retransmit 3 of request with message ID 0 Dec 3 16:16:46 fron… --- ## [Ipfire 183 ipsec how convert road warrior user .pem to .crt](https://community.ipfire.org/t/ipfire-183-ipsec-how-convert-road-warrior-user-pem-to-crt/13277)
**Author:** [@franco](https://community.ipfire.org/u/franco)\ **Replies:** 3\ **Last updated:** [7 December 2024 22:23 UTC](https://community.ipfire.org/t/ipfire-183-ipsec-how-convert-road-warrior-user-pem-to-crt/13277 "2024-12-07T22:23:04Z")
Hi, I have in production an ipfire ver. 183. When I download a user road warrior certificate, this is a .pem file. At present time, for same reasons I can’t update the system. So I’d like convert the .pem to .crt. I… --- ## [IPSec PSK roadwarrior from Linux Network Manager fails to connect](https://community.ipfire.org/t/ipsec-psk-roadwarrior-from-linux-network-manager-fails-to-connect/13259)
**Author:** [@bonnietwin](https://community.ipfire.org/u/bonnietwin)\ **Replies:** 1\ **Last updated:** [2 December 2024 15:37 UTC](https://community.ipfire.org/t/ipsec-psk-roadwarrior-from-linux-network-manager-fails-to-connect/13259 "2024-12-02T15:37:30Z")
I am trying to setup an IPSec roadwarrior connection between an IPFire system and a Linux laptop using Network Manager with the Strongswan Plugin. I am trying to use the PSK to start with and after getting that working … --- ## [IPSec N2N short interruptions](https://community.ipfire.org/t/ipsec-n2n-short-interruptions/13098)
**Author:** [@kevinkrause](https://community.ipfire.org/u/kevinkrause)\ **Replies:** 0\ **Last updated:** [27 October 2024 18:09 UTC](https://community.ipfire.org/t/ipsec-n2n-short-interruptions/13098 "2024-10-27T18:09:06Z")
I have an IPSec net-to-net connection. Every now and then I have short interruptions of a few seconds: 64 bytes from 192.168.77.1: icmp\_seq=24 ttl=64 time=18.8 ms 64 bytes from 192.168.77.1: icmp\_seq=25 ttl=64 time=15.4… --- ## [Reading IPSec Logs](https://community.ipfire.org/t/reading-ipsec-logs/12989)
**Author:** [@jsndgrss](https://community.ipfire.org/u/jsndgrss)\ **Replies:** 6\ **Last updated:** [10 October 2024 03:45 UTC](https://community.ipfire.org/t/reading-ipsec-logs/12989 "2024-10-10T03:45:18Z")
Scenario: Trying to figure out why one ipsec setup is not working: Looking in Logs\>SystemLogs\>IPSec. I believe newest entries are at bottom (timestamped at left). Is there a way to flush this log? Is there a way to … --- ## [IPSec Windows/Linux Client (Roadwarrior) not working](https://community.ipfire.org/t/ipsec-windows-linux-client-roadwarrior-not-working/12160)
**Author:** [@bruzzler](https://community.ipfire.org/u/bruzzler)\ **Replies:** 15\ **Last updated:** [24 September 2024 23:39 UTC](https://community.ipfire.org/t/ipsec-windows-linux-client-roadwarrior-not-working/12160 "2024-09-24T23:39:35Z")
I have activated IPSec server. I was able to set up an android client and it also works. But it does not work on the Windows 11 and Linux client. I have tried several methods PSK, certificate. But it does not work. I ha… --- ## [IPSec Certificate Based Connections DNS Resolution Issues](https://community.ipfire.org/t/ipsec-certificate-based-connections-dns-resolution-issues/11939)
**Author:** [@whoot](https://community.ipfire.org/u/whoot)\ **Replies:** 10\ **Last updated:** [18 September 2024 03:42 UTC](https://community.ipfire.org/t/ipsec-certificate-based-connections-dns-resolution-issues/11939 "2024-09-18T03:42:34Z")
Recently (within the past 5 days), our IPSec Certificate Based connections suddenly have been unable to resolve addresses inside and outside of the local network, they have been working 100% fine up until this point. No … --- ## [Ipsec - how to renew expired certificates?](https://community.ipfire.org/t/ipsec-how-to-renew-expired-certificates/11937)
**Author:** [@franco](https://community.ipfire.org/u/franco)\ **Replies:** 5\ **Last updated:** [6 August 2024 13:35 UTC](https://community.ipfire.org/t/ipsec-how-to-renew-expired-certificates/11937 "2024-08-06T13:35:27Z")
Hi, can anyone help me with di issue? a couple of years ago, I made multiple IPSEC road warrior VPN. I’ve followed the procedure to genrate the certicates. Now after 2 years the root certificate is ok: Certificate: … --- ## [IPsec no private key found](https://community.ipfire.org/t/ipsec-no-private-key-found/11760)
**Author:** [@florin](https://community.ipfire.org/u/florin)\ **Replies:** 5\ **Last updated:** [21 June 2024 15:54 UTC](https://community.ipfire.org/t/ipsec-no-private-key-found/11760 "2024-06-21T15:54:58Z")
Hi, I can’t connect to IPsec because it’s not found the private key: Private key it’s not FlorinTanasaServici.p12? Messages from IPfire server: Server messages Also look at my setting: IPsec Setting With OpenVP… --- ## [Possible to use OpenVPN certificates for IPSec Roadwarrior?](https://community.ipfire.org/t/possible-to-use-openvpn-certificates-for-ipsec-roadwarrior/11044)
**Author:** [@jberntsen](https://community.ipfire.org/u/jberntsen)\ **Replies:** 1\ **Last updated:** [8 February 2024 09:39 UTC](https://community.ipfire.org/t/possible-to-use-openvpn-certificates-for-ipsec-roadwarrior/11044 "2024-02-08T09:39:34Z")
I already have OpenVPN Roadwarrior set up but now need to set up IPSec Roadwarrior as well. I’d like to use certificate authentication for clients but don’t wan’t to set up a separate PKI from the one already set up for… --- ## [CVE-2023-41913 seems potentially gnarly](https://community.ipfire.org/t/cve-2023-41913-seems-potentially-gnarly/10617)
**Author:** [@mangrove](https://community.ipfire.org/u/mangrove)\ **Replies:** 4\ **Last updated:** [5 December 2023 23:31 UTC](https://community.ipfire.org/t/cve-2023-41913-seems-potentially-gnarly/10617 "2023-12-05T23:31:59Z")
As IPFire uses charon-tkm, as far as I can see, it should be vulnerable. Is there a plan for releasing a version with fixes for this? --- ## [IPsec and Connection Scheduler](https://community.ipfire.org/t/ipsec-and-connection-scheduler/9558)
**Author:** [@lexuspolaris](https://community.ipfire.org/u/lexuspolaris)\ **Replies:** 6\ **Last updated:** [23 November 2023 11:46 UTC](https://community.ipfire.org/t/ipsec-and-connection-scheduler/9558 "2023-11-23T11:46:36Z")
Hey there, I try to configure an automatic start and stop time for the IPsec-host but the option in the connection-scheduler does not seem to have the effect, that I hoped for. :slight\_smile: IPsec is fully configured … --- ## [Ipsec.conf and ipsec.user.conf HOW SET rightdns PERMANENTLY](https://community.ipfire.org/t/ipsec-conf-and-ipsec-user-conf-how-set-rightdns-permanently/10591)
**Author:** [@franco](https://community.ipfire.org/u/franco)\ **Replies:** 4\ **Last updated:** [16 November 2023 11:29 UTC](https://community.ipfire.org/t/ipsec-conf-and-ipsec-user-conf-how-set-rightdns-permanently/10591 "2023-11-16T11:29:17Z")
Hi, I am using several ipsec roadworrior connections. I would like to set rightdns for all connections PERMANENTLY if you look at ipsec.conf (/ect/) all connections have the parameter rightdns set (by system) this way… --- ## [IPSec Roadwarrior problems](https://community.ipfire.org/t/ipsec-roadwarrior-problems/9832)
**Author:** [@roberto](https://community.ipfire.org/u/roberto)\ **Replies:** 9\ **Last updated:** [3 June 2023 10:52 UTC](https://community.ipfire.org/t/ipsec-roadwarrior-problems/9832 "2023-06-03T10:52:00Z")
Hi guys. I am trying to test with IPSec Roadwarrior and I have seen the limitation with Presared Key since it only allows one connection. So, I said to myself, let’s try certificates. Now comes the problem. When I try … --- ## [Failed to establish connection](https://community.ipfire.org/t/failed-to-establish-connection/9747)
**Author:** [@herby](https://community.ipfire.org/u/herby)\ **Replies:** 1\ **Last updated:** [21 May 2023 17:31 UTC](https://community.ipfire.org/t/failed-to-establish-connection/9747 "2023-05-21T17:31:49Z")
Hello, I have setup IPsec on Ipfire for a longer time ago and it worked all the time pretty well. But since the last update to core update 174 which I found has also impacted strongswan no ipsec connection to IOS is pos… --- ## [Failed to establish CHILD\_SA](https://community.ipfire.org/t/failed-to-establish-child-sa/9606)
**Author:** [@lexuspolaris](https://community.ipfire.org/u/lexuspolaris)\ **Replies:** 0\ **Last updated:** [12 April 2023 12:50 UTC](https://community.ipfire.org/t/failed-to-establish-child-sa/9606 "2023-04-12T12:50:34Z")
Hey there community, I set up an IPsec-server for VPN-tunnel and everything works great. In fact, I’m abroad at the moment and so far, had no issues at all. :hugs: My client is a Linux-laptop with the strongSwan-plugin … --- ## [Ipsec dnat snat](https://community.ipfire.org/t/ipsec-dnat-snat/9554)
**Author:** [@baso1972](https://community.ipfire.org/u/baso1972)\ **Replies:** 0\ **Last updated:** [4 April 2023 06:45 UTC](https://community.ipfire.org/t/ipsec-dnat-snat/9554 "2023-04-04T06:45:33Z")
IPSEC conenction established. Added green0:4 adapter with IP from left side of tunnel. CUSTOMPREORUTING WITH DNAT OK. CUSTOMPOSTROUING WITH SNAT NOT OK nothing arrives because of: IPSECBLOCK chain. iptables -S IPSEC… [Next page](https://community.ipfire.org/c/vpn/ipsec/7.md?page=1)