Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

unable to automatically setup ikev2 due to "mount" command returning empty on alpine image #247

Closed
neothematrix opened this issue Jul 18, 2021 · 2 comments
Closed

unable to automatically setup ikev2 due to "mount" command returning empty on alpine image #247

neothematrix opened this issue Jul 18, 2021 · 2 comments

Comments

@neothematrix
Copy link

Hello!
first of all, thanks for this extremely useful docker image!
I configured it on my nas and everything worked almost out of the box.
The issue I encountered is when I started to configure IKEv2 clients (no issues with L2TP/IPSEC), because I realized the docker image was not configuring the IKEv2 at all, even though I had a mounted volume for /etc/ipsec.d
I was using the alpine image, and realized that the "run.sh" script relies on the output of "mount" command to check if /etc/ipsec.d volume has been mounted, but for some reason, the "mount" command on the latest hwdsl2/ipsec-vpn-server (alpine image) returns empty.
I fixed it by using the "debian" version of the image, I'm not sure why it returns empty on alpine, and if it happens only to me, I couldn't find any open bug, but perhaps the "mount |grep ..." command could be replaced with "cat /proc/mounts |grep ..."?

After fixing this, another small issue I had (but it's a different issue) is that my docker host kernel does not have "MOBIKE" support, so until I forced "mobike=no" the ikev2 configuration was not loaded anyways, and it was not easy to understand why, I finally found the reason forcing the load of the "ikev2-cp" configuration with:

docker exec -ti ipsec-vpn-server /usr/local/sbin/ipsec auto --add ikev2-cp

where an informative message on missing MOBIKE kernel support helped me pinpointing the issue, perhaps it could be added to the troubleshooting doc?

again thanks a lot!
@hwdsl2
Copy link
Owner

hwdsl2 commented Jul 18, 2021

@neothematrix Thanks for reporting. I'll update run.sh to check /proc/mounts instead. What is your Docker host's Linux flavor (e.g. Ubuntu) and version? And which kernel version is running on your Docker host? You can check with uname -a.

@hwdsl2 hwdsl2 closed this as completed in 0156587 Jul 18, 2021
@neothematrix
Copy link
Author

neothematrix commented Jul 18, 2021 •
edited
Loading

hello @hwdsl2 ,
thanks for the fast reply and fix, I confirm it's now working properly also with the alpine image!

As per my docker host, it's a qnap NAS, running a qnap-customized linux distro, here's the uname output:

$ uname -a
Linux qnap-nas 4.14.24-qnap #1 SMP Thu Jul 8 01:44:24 CST 2021 x86_64 GNU/Linux

thanks!

hwdsl2 added a commit to hwdsl2/setup-ipsec-vpn that referenced this issue Jul 25, 2021
@hwdsl2
Update IKEv2 script
d22a473 
- Improve checking for MOBIKE support. Linux kernels on QNAP systems
  do not support MOBIKE.
- Ref: hwdsl2/docker-ipsec-vpn-server#247
hwdsl2 added a commit to hwdsl2/setup-ipsec-vpn that referenced this issue Jul 25, 2021
@hwdsl2
Update IKEv2 script
18bef25 
- Improve checking for MOBIKE support. Linux kernels on QNAP systems
  do not support MOBIKE.
  Ref: hwdsl2/docker-ipsec-vpn-server#247
- Switch to use /etc/ipsec.d/.vpnconfig to store generated password
  for IKEv2 client config files, instead of vpnclient.p12.password.
  Migrate to use .vpnconfig if the older config file is found.
  Ref: 45ee41d
hwdsl2 added a commit to hwdsl2/setup-ipsec-vpn that referenced this issue Jul 26, 2021
@hwdsl2
Update IKEv2 script
8d26e0b 
- Improve checking for MOBIKE support. Linux kernels on QNAP systems
  do not support MOBIKE.
  Ref: hwdsl2/docker-ipsec-vpn-server#247
- Switch to use /etc/ipsec.d/.vpnconfig to store generated password
  for IKEv2 client config files, instead of vpnclient.p12.password.
  Migrate to use .vpnconfig if the older config file is found.
  Ref: 45ee41d
nebulabox pushed a commit to nebulabox/setup-ipsec-vpn that referenced this issue Aug 11, 2021
@hwdsl2 @nebulabox
Update IKEv2 script
388b285 
- Improve checking for MOBIKE support. Linux kernels on QNAP systems
  do not support MOBIKE.
  Ref: hwdsl2/docker-ipsec-vpn-server#247
- Switch to use /etc/ipsec.d/.vpnconfig to store generated password
  for IKEv2 client config files, instead of vpnclient.p12.password.
  Migrate to use .vpnconfig if the older config file is found.
  Ref: 45ee41d
hwdsl2 added a commit to hwdsl2/setup-ipsec-vpn that referenced this issue Dec 2, 2022
@hwdsl2
Update IKEv2 script
fec1b7c 
- Improve MOBIKE detection by checking whether the IKEv2 connection
  is successfully loaded. If not, the server's Linux kernel may not
  support MOBIKE, and we disable it in ikev2.conf.
- This will help prevent the issue where the IKEv2 connection fails
  to load on some systems due to lack of MOBIKE support. Note that
  the script already has checks for MOBIKE support that cover common
  cases.
- Related issues:
  hwdsl2/docker-ipsec-vpn-server#330
  hwdsl2/docker-ipsec-vpn-server#298
  hwdsl2/docker-ipsec-vpn-server#247
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@neothematrix @hwdsl2