no matching peer config found

[SB8767]

Hi,

I'm trying to set up a test VPN connection to compare it against another VPN but I am getting no peer config found.

Config 1:
conn vpn-test
type=tunnel
auto=start
keyexchange=ikev2
authby=secret
left=188.166.169.90
leftsubnet=10.0.5.1/29
leftid=186.166.169.90
leftfirewall=yes
right=Publicip
rightsubnet=192.168.10.1/29
rightid=10.131.112.99
rightfirewall=yes
ike=aes256-sha512-modp2048,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha-modp2048!
esp=aes256-sha512-modp2048,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha1-modp2048!
dpdaction=restart
ikelifetime=86400s
lifetime=3600s
dpddelay=20s
dpdtimeout=60s

ipsec.secrets output:
#vpn-test
188.166.169.90 10.131.112.99 : PSK "key"

config2:

conn vpn-test
type=tunnel
auto=start
keyexchange=ikev2
authby=secret
left=**
leftsubnet=192.168.10.1/29
leftid=10.131.112.99
leftfirewall=yes
right=188.166.169.90
rightsubnet=10.0.5.1/29
rightfirewall=yes
ike=aes256-sha512-modp2048,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha-modp2048!
esp=aes256-sha512-modp2048,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha1-modp2048!
dpdaction=restart
ikelifetime=86400s
lifetime=3600s
dpddelay=20s
dpdtimeout=60s

ipsec.secrets output:

#vpn-test
publicip 188.166.169.90 : PSK "key"

when I run the below command from config1 server:

grep -rn /var/log/syslog -e "charon"

I get this:

ADD_4_ADDR) N(ADD_4_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
3685:2024-06-13T16:15:20.092942+00:00 ubuntu-s-1vcpu-1gb-lon1-01 charon: 06[CFG] looking for peer configs matching 188.166.169.90[188.166.169.90]...publicip[10.131.112.99]
3686:2024-06-13T16:15:20.093158+00:00 ubuntu-s-1vcpu-1gb-lon1-01 charon: 06[CFG] no matching peer config found
3687:2024-06-13T16:15:20.093318+00:00 ubuntu-s-1vcpu-1gb-lon1-01 charon: 06[IKE] peer supports MOBIKE
3688:2024-06-13T16:15:20.093525+00:00 ubuntu-s-1vcpu-1gb-lon1-01 charon: 06[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
3689:2024-06-13T16:15:20.093791+00:00 ubuntu-s-1vcpu-1gb-lon1-01 charon: 06[NET] sending packet: from 188.166.169.90[4500] to publicip[4500] (96 bytes)

I was using this website as a reference: https://ruan.dev/blog/2018/02/11/setup-a-site-to-site-ipsec-vpn-with-strongswan-and-preshared-key-authentication

[tobiasbrunner]

leftid=186.166.169.90

Typo

[SB8767]

The LAN IPs are just LAN IPs of each server.

So your goal is to be able to ping 192.168.10.1 from 10.0.5.1 and vice-versa? yes. I deleted the NAT rules as they didn't solve the ping issue.

[tobiasbrunner]

Look at the packets and whether they match the IPsec policies. Look at traffic counters (strongSwan, firewall etc.).

[SB8767]

Thank you.

I did some further troubleshooting today:

1. I set up x2 servers and set up StrongSwan VPN on a different cloud provider -pings worked fine without the need for any NAT or IPTables.
2. I tried replicating this on my current Cloud provider but I could not ping. I found the problem to be leftid and rightid - I removed both and restarted ipsec, and that worked. I could successfully ping.
3. My next step is: I will replicate this on the servers this case was logged for:

A side has a subnet of
leftsubnet=10.0.5.1/29

B side has a subnet of
rightsubnet=192.168.10.1/29

This is a working ipsec.conf on one of the servers with my current Cloud Provider:

conn vpn-test
    type=tunnel
    auto=start
    keyexchange=ikev2
    authby=secret
    left=143.110.169.236
    leftsubnet=192.168.100.2/24
    leftfirewall=yes
    right=165.232.100.250
    rightsubnet=192.168.200.2/24
    rightfirewall=yes
    ike=aes256-sha512-modp2048,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha-modp2048!
    esp=aes256-sha512-modp2048,aes256-sha384-modp2048,aes256-sha256-modp2048,aes256-sha1-modp2048!
    dpdaction=restart
    ikelifetime=28800s
    lifetime=28800s
    dpddelay=20s
    dpdtimeout=60s

Admittedly I went the long way to troubleshoot but I believe the leftid and rightid may have been the problem and I should know m more in the next few hours.

[SB8767]

Sorry, another update:

I believe I have found the issue preventing me from pinging my test server. It's the firewall attached to my server (not the built in UFW or IPTables, the firewall attached to my Cloud server).

The thing is, the firewall has custom ports and their locked down to IPs so I can't see why that would prevent pings. I also have the standard 443, 22 and 80 open.

When I remove the server from firewall, the pings work. When I assign the firewall to the server, the pings stop working.

[SB8767]

Update: I removed the server from the firewall and set up iptables instead. I setup IPtables rules to replicate the rules that were configured in the firewall, then I ran the command sudo iptables -A INPUT -j DROP. This stopped the whole VPN from working.

I have two VPNs: one that works and one that isn't (and is the reason for this ticket).

The reason I set up iptables and removed the cloud firewall, is, because when I removed the server from the cloud firewall, the VPN started working and I could ping both side. When I added the Cloud firewall back in to the server, the ping stopped working.

I set up the firewall to allow TCP and UDP from any source and the PING still did not work. Once I remove the Cloud firewall from the server, the pings works, so that's why I looked at IPTables but the ping still does not work.