Skip to content

WireGuard on iPhone does not transition between wifi and LTE #1385

@moshesiegel

Description

@moshesiegel

Describe the bug
When moving from wifi to LTE either by disabling wifi on the iPhone (XS iOS 12.2) or moving out of wifi range, the VPN tunnel shows connected, but will not pass any traffic. The same is true when moving from LTE to WIFI, no traffic is passed such as DNS or even reaching 1.1.1.1

To Reproduce

Steps to reproduce the behavior:

  1. be on wifi
  2. turn off wifi
  3. no traffic is passed

Expected behavior

Wireguard should support the network transition and maintain or at the very least, quickly as in IPSEC reestablish the VPN connection and allow traffic to pass.

Additional context

If I connect to the VPN, and power down my Lightsail VPN host, WireGuard will still show a connected VPN which is impossible if the Algo host is off.

Transitions are working fine on IPSEC

Full log

Mac:algo-master$ ./algo

PLAY [Ask user for the input] ****************************************************************************************************************************************************

TASK [Gathering Facts] ***********************************************************************************************************************************************************
ok: [localhost]
[pause]
What provider would you like to use?
    1. DigitalOcean
    2. Amazon Lightsail
    3. Amazon EC2
    4. Vultr
    5. Microsoft Azure
    6. Google Compute Engine
    7. Scaleway
    8. OpenStack (DreamCompute optimised)
    9. Install to existing Ubuntu 18.04 server (Advanced)
  
Enter the number of your desired provider
:
2

TASK [pause] *********************************************************************************************************************************************************************
ok: [localhost]

TASK [Set facts based on the input] **********************************************************************************************************************************************
ok: [localhost]
[pause]
Name the vpn server
[algo]
:
arkadia

TASK [pause] *********************************************************************************************************************************************************************
ok: [localhost]
[pause]
Do you want macOS/iOS IPsec clients to enable "Connect On Demand" when connected to cellular networks?
[y/N]
:
y

TASK [pause] *********************************************************************************************************************************************************************
ok: [localhost]
[pause]
Do you want macOS/iOS IPsec clients to enable "Connect On Demand" when connected to Wi-Fi?
[y/N]
:
y

TASK [pause] *********************************************************************************************************************************************************************
ok: [localhost]
[pause]
List the names of any trusted Wi-Fi networks where macOS/iOS IPsec clients should not use "Connect On Demand"
(e.g., your home network. Comma-separated value, e.g., HomeNet,OfficeWifi,AlgoWiFi)
:


TASK [pause] *********************************************************************************************************************************************************************
ok: [localhost]
[pause]
Do you want the VPN to support Windows 10 or Linux Desktop clients? (enables compatible ciphers and key exchange, less secure)
[y/N]
:
n

TASK [pause] *********************************************************************************************************************************************************************
ok: [localhost]
[pause]
Do you want to retain the CA key? (required to add users in the future, but less secure)
[y/N]
:
n

TASK [pause] *********************************************************************************************************************************************************************
ok: [localhost]
[pause]
Do you want to install an ad blocking DNS resolver on this VPN server?
[y/N]
:
y

TASK [pause] *********************************************************************************************************************************************************************
ok: [localhost]
[pause]
Do you want each user to have their own account for SSH tunneling?
[y/N]
:


TASK [pause] *********************************************************************************************************************************************************************
ok: [localhost]

TASK [Set facts based on the input] **********************************************************************************************************************************************
ok: [localhost]

PLAY [Provision the server] ******************************************************************************************************************************************************

TASK [Gathering Facts] ***********************************************************************************************************************************************************
ok: [localhost]

--> Please include the following block of text when reporting issues:

Algo running on: Mac OS X 10.14.4
ZIP file created: Mar 25 00:55:38 2019
Python 2.7.10
Runtime variables:
    algo_provider "lightsail"
    algo_ondemand_cellular "True"
    algo_ondemand_wifi "True"
    algo_ondemand_wifi_exclude "X251bGw="
    algo_local_dns "True"
    algo_ssh_tunneling "False"
    algo_windows "False"
    wireguard_enabled "True"
    dns_encryption "True"

TASK [Display the invocation environment] ****************************************************************************************************************************************
changed: [localhost -> localhost]

TASK [Install the requirements] **************************************************************************************************************************************************
ok: [localhost -> localhost]

TASK [Generate the SSH private key] **********************************************************************************************************************************************
ok: [localhost]

TASK [Generate the SSH public key] ***********************************************************************************************************************************************
ok: [localhost]

TASK [cloud-lightsail : Install requirements] ************************************************************************************************************************************
changed: [localhost]
[cloud-lightsail : pause]
Enter your aws_access_key (http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html)
Note: Make sure to use an IAM user with an acceptable policy attached (see https://github.com/trailofbits/algo/blob/master/docs/deploy-from-ansible.md)
 (output is hidden):

TASK [cloud-lightsail : pause] ***************************************************************************************************************************************************
ok: [localhost]
[cloud-lightsail : pause]
Enter your aws_secret_key (http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html)
 (output is hidden):

TASK [cloud-lightsail : pause] ***************************************************************************************************************************************************
ok: [localhost]

TASK [cloud-lightsail : set_fact] ************************************************************************************************************************************************
ok: [localhost]

TASK [cloud-lightsail : Get regions] *********************************************************************************************************************************************
ok: [localhost]

TASK [cloud-lightsail : Set facts about the regions] *****************************************************************************************************************************
ok: [localhost]

TASK [cloud-lightsail : Set the default region] **********************************************************************************************************************************
ok: [localhost]
[cloud-lightsail : pause]
What region should the server be located in?
(https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/)
    1.  ap-northeast-1       Tokyo
    2.  ap-northeast-2       Seoul
    3.  ap-south-1           Mumbai
    4.  ap-southeast-1       Singapore
    5.  ap-southeast-2       Sydney
    6.  ca-central-1         Montreal
    7.  eu-central-1         Frankfurt
    8.  eu-west-1            Ireland
    9.  eu-west-2            London
    10. eu-west-3            Paris
    11. us-east-1            Virginia
    12. us-east-2            Ohio
    13. us-west-2            Oregon
  
Enter the number of your desired region
[11]
:
11

TASK [cloud-lightsail : pause] ***************************************************************************************************************************************************
ok: [localhost]

TASK [cloud-lightsail : set_fact] ************************************************************************************************************************************************
ok: [localhost]

TASK [cloud-lightsail : Create an instance] **************************************************************************************************************************************
changed: [localhost]

TASK [cloud-lightsail : set_fact] ************************************************************************************************************************************************
ok: [localhost]

TASK [Set subjectAltName as afact] ***********************************************************************************************************************************************
ok: [localhost]

TASK [Add the server to an inventory group] **************************************************************************************************************************************
changed: [localhost]

TASK [Additional variables for the server] ***************************************************************************************************************************************
changed: [localhost]

TASK [Wait until SSH becomes ready...] *******************************************************************************************************************************************
ok: [localhost]

TASK [debug] *********************************************************************************************************************************************************************
ok: [localhost] => {
    "IP_subject_alt_name": "REDACTED"
}
Pausing for 20 seconds
(ctrl+C then 'C' = continue early, ctrl+C then 'A' = abort)
Press 'C' to continue the play or 'A' to abort 

TASK [A short pause, in order to be sure the instance is ready] ******************************************************************************************************************
ok: [localhost]

PLAY [Configure the server and install required software] ************************************************************************************************************************

TASK [common : Check the system] *************************************************************************************************************************************************
changed: [REDACTED]

TASK [common : include_tasks] ****************************************************************************************************************************************************
included: /Applications/algo-master/roles/common/tasks/ubuntu.yml for REDACTED

TASK [common : Gather facts] *****************************************************************************************************************************************************
ok: [REDACTED]

TASK [common : Install software updates] *****************************************************************************************************************************************
changed: [REDACTED]

TASK [common : Check if reboot is required] **************************************************************************************************************************************
changed: [REDACTED]

TASK [common : Reboot] ***********************************************************************************************************************************************************
changed: [REDACTED]

TASK [common : Wait until SSH becomes ready...] **********************************************************************************************************************************
ok: [REDACTED -> localhost]

TASK [common : Install unattended-upgrades] **************************************************************************************************************************************
ok: [REDACTED]

TASK [common : Configure unattended-upgrades] ************************************************************************************************************************************
changed: [REDACTED]

TASK [common : Periodic upgrades configured] *************************************************************************************************************************************
changed: [REDACTED]

TASK [common : Unattended reboots configured] ************************************************************************************************************************************
changed: [REDACTED]
changed: [REDACTED] => (item={u'regexp': u'^session.*optional.*pam_motd.so.*', u'line': u'# MOTD DISABLED', u'file': u'/etc/pam.d/login'})
changed: [REDACTED] => (item={u'regexp': u'^session.*optional.*pam_motd.so.*', u'line': u'# MOTD DISABLED', u'file': u'/etc/pam.d/sshd'})

TASK [common : Disable MOTD on login and SSHD] ***********************************************************************************************************************************

TASK [common : Loopback for services configured] *********************************************************************************************************************************
changed: [REDACTED]
ok: [REDACTED] => (item=systemd-networkd)
ok: [REDACTED] => (item=systemd-resolved)

TASK [common : systemd services enabled and started] *****************************************************************************************************************************

RUNNING HANDLER [common : restart systemd-networkd] ******************************************************************************************************************************
changed: [REDACTED]

TASK [common : Check apparmor support] *******************************************************************************************************************************************
changed: [REDACTED]

TASK [common : set_fact] *********************************************************************************************************************************************************
ok: [REDACTED]

TASK [common : Generate password for the CA key] *********************************************************************************************************************************
changed: [REDACTED -> localhost]

TASK [common : Generate p12 export password] *************************************************************************************************************************************
changed: [REDACTED -> localhost]

TASK [common : Define facts] *****************************************************************************************************************************************************
ok: [REDACTED]

TASK [common : set_fact] *********************************************************************************************************************************************************
ok: [REDACTED]

TASK [common : Set IPv6 support as a fact] ***************************************************************************************************************************************
ok: [REDACTED]

TASK [common : Check size of MTU] ************************************************************************************************************************************************
ok: [REDACTED]

TASK [common : set_fact] *********************************************************************************************************************************************************
ok: [REDACTED]
changed: [REDACTED] => (item=[u'git', u'screen', u'apparmor-utils', u'uuid-runtime', u'coreutils', u'iptables-persistent', u'cgroup-tools', u'openssl'])

TASK [common : Install tools] ****************************************************************************************************************************************************

TASK [common : Install headers] **************************************************************************************************************************************************
changed: [REDACTED]

TASK [common : include_tasks] ****************************************************************************************************************************************************
included: /Applications/algo-master/roles/common/tasks/iptables.yml for REDACTED
changed: [REDACTED] => (item={u'dest': u'/etc/iptables/rules.v4', u'src': u'rules.v4.j2'})

TASK [common : Iptables configured] **********************************************************************************************************************************************
changed: [REDACTED] => (item={u'item': u'net.ipv4.ip_forward', u'value': 1})
changed: [REDACTED] => (item={u'item': u'net.ipv4.conf.all.forwarding', u'value': 1})

RUNNING HANDLER [common : restart iptables] **************************************************************************************************************************************
changed: [REDACTED]

TASK [dns_encryption : Include tasks for Ubuntu] *********************************************************************************************************************************
included: /Applications/algo-master/roles/dns_encryption/tasks/ubuntu.yml for REDACTED

TASK [dns_encryption : Add the repository] ***************************************************************************************************************************************
changed: [REDACTED]

TASK [dns_encryption : Install dnscrypt-proxy] ***********************************************************************************************************************************
changed: [REDACTED]

TASK [dns_encryption : Configure unattended-upgrades] ****************************************************************************************************************************
changed: [REDACTED]

TASK [dns_encryption : Ubuntu | Unbound profile for apparmor configured] *********************************************************************************************************
changed: [REDACTED]

TASK [dns_encryption : Ubuntu | Enforce the dnscrypt-proxy AppArmor policy] ******************************************************************************************************
ok: [REDACTED]

TASK [dns_encryption : Ubuntu | Ensure that the dnscrypt-proxy service directory exist] ******************************************************************************************
changed: [REDACTED]

TASK [dns_encryption : Ubuntu | Add custom requirements to successfully start the unit] ******************************************************************************************
changed: [REDACTED]

TASK [dns_encryption : dnscrypt-proxy ip-blacklist configured] *******************************************************************************************************************
changed: [REDACTED]

TASK [dns_encryption : dnscrypt-proxy configured] ********************************************************************************************************************************
changed: [REDACTED]

TASK [dns_encryption : dnscrypt-proxy enabled and started] ***********************************************************************************************************************
ok: [REDACTED]

RUNNING HANDLER [dns_encryption : restart dnscrypt-proxy] ************************************************************************************************************************
changed: [REDACTED]

TASK [dns_adblocking : Dnsmasq installed] ****************************************************************************************************************************************
changed: [REDACTED]

TASK [dns_adblocking : The dnsmasq directory created] ****************************************************************************************************************************
changed: [REDACTED]

TASK [dns_adblocking : include_tasks] ********************************************************************************************************************************************
included: /Applications/algo-master/roles/dns_adblocking/tasks/ubuntu.yml for REDACTED

TASK [dns_adblocking : Ubuntu | Dnsmasq profile for apparmor configured] *********************************************************************************************************
changed: [REDACTED]

TASK [dns_adblocking : Ubuntu | Enforce the dnsmasq AppArmor policy] *************************************************************************************************************
changed: [REDACTED]

TASK [dns_adblocking : Ubuntu | Ensure that the dnsmasq service directory exist] *************************************************************************************************
changed: [REDACTED]

TASK [dns_adblocking : Ubuntu | Setup the cgroup limitations for the ipsec daemon] ***********************************************************************************************
changed: [REDACTED]

TASK [dns_adblocking : Dnsmasq configured] ***************************************************************************************************************************************
changed: [REDACTED]

TASK [dns_adblocking : Adblock script created] ***********************************************************************************************************************************
changed: [REDACTED]

TASK [dns_adblocking : Adblock script added to cron] *****************************************************************************************************************************
changed: [REDACTED]

TASK [dns_adblocking : Update adblock hosts] *************************************************************************************************************************************
changed: [REDACTED]

RUNNING HANDLER [dns_adblocking : restart dnsmasq] *******************************************************************************************************************************
changed: [REDACTED]

RUNNING HANDLER [strongswan : daemon-reload] *************************************************************************************************************************************
changed: [REDACTED]

TASK [dns_adblocking : Dnsmasq enabled and started] ******************************************************************************************************************************
ok: [REDACTED]
ok: [REDACTED -> localhost] => (item=private)
ok: [REDACTED -> localhost] => (item=public)

TASK [wireguard : Ensure the required directories exist] *************************************************************************************************************************

TASK [wireguard : Include tasks for Ubuntu] **************************************************************************************************************************************
included: /Applications/algo-master/roles/wireguard/tasks/ubuntu.yml for REDACTED

TASK [wireguard : WireGuard repository configured] *******************************************************************************************************************************
changed: [REDACTED]

TASK [wireguard : WireGuard installed] *******************************************************************************************************************************************
changed: [REDACTED]

TASK [wireguard : WireGuard reload-module-on-update] *****************************************************************************************************************************
changed: [REDACTED]

TASK [wireguard : Configure unattended-upgrades] *********************************************************************************************************************************
changed: [REDACTED]

TASK [wireguard : set_fact] ******************************************************************************************************************************************************
ok: [REDACTED]
changed: [REDACTED] => (item=laptop)
changed: [REDACTED] => (item=phone)
changed: [REDACTED] => (item=spare)
changed: [REDACTED] => (item=REDACTED)

TASK [wireguard : Generate private keys] *****************************************************************************************************************************************
changed: [REDACTED] => (item=None)
changed: [REDACTED] => (item=None)
changed: [REDACTED] => (item=None)
changed: [REDACTED] => (item=None)

TASK [wireguard : Save private keys] *********************************************************************************************************************************************
changed: [REDACTED] => (item=laptop)
changed: [REDACTED] => (item=phone)
changed: [REDACTED] => (item=spare)
changed: [REDACTED] => (item=REDACTED)

TASK [wireguard : Touch the lock file] *******************************************************************************************************************************************
ok: [REDACTED] => (item=laptop)
ok: [REDACTED] => (item=phone)
ok: [REDACTED] => (item=spare)
ok: [REDACTED] => (item=REDACTED)

TASK [wireguard : Generate public keys] ******************************************************************************************************************************************
changed: [REDACTED] => (item=None)
changed: [REDACTED] => (item=None)
changed: [REDACTED] => (item=None)
changed: [REDACTED] => (item=None)

TASK [wireguard : Save public keys] **********************************************************************************************************************************************
ok: [REDACTED -> localhost] => (item=laptop)
ok: [REDACTED -> localhost] => (item=phone)
ok: [REDACTED -> localhost] => (item=spare)

TASK [wireguard : WireGuard user list updated] ***********************************************************************************************************************************

TASK [wireguard : set_fact] ******************************************************************************************************************************************************
ok: [REDACTED -> localhost]
changed: [REDACTED -> localhost] => (item=(0, u'laptop'))
changed: [REDACTED -> localhost] => (item=(1, u'phone'))
changed: [REDACTED -> localhost] => (item=(2, u'spare'))

TASK [wireguard : WireGuard users config generated] ******************************************************************************************************************************
ok: [REDACTED -> localhost] => (item=(0, u'laptop'))
ok: [REDACTED -> localhost] => (item=(1, u'phone'))
ok: [REDACTED -> localhost] => (item=(2, u'spare'))

TASK [wireguard : Generate QR codes] *********************************************************************************************************************************************

TASK [wireguard : WireGuard configured] ******************************************************************************************************************************************
changed: [REDACTED]

TASK [wireguard : WireGuard enabled and started] *********************************************************************************************************************************
changed: [REDACTED]

RUNNING HANDLER [wireguard : restart wireguard] **********************************************************************************************************************************
changed: [REDACTED]

TASK [strongswan : include_tasks] ************************************************************************************************************************************************
included: /Applications/algo-master/roles/strongswan/tasks/ubuntu.yml for REDACTED

TASK [strongswan : set_fact] *****************************************************************************************************************************************************
ok: [REDACTED]

TASK [strongswan : Ubuntu | Install strongSwan] **********************************************************************************************************************************
changed: [REDACTED]
changed: [REDACTED] => (item=/usr/lib/ipsec/charon)
changed: [REDACTED] => (item=/usr/lib/ipsec/lookip)
changed: [REDACTED] => (item=/usr/lib/ipsec/stroke)

TASK [strongswan : Ubuntu | Enforcing ipsec with apparmor] ***********************************************************************************************************************
ok: [REDACTED] => (item=apparmor)
ok: [REDACTED] => (item=strongswan)
ok: [REDACTED] => (item=netfilter-persistent)

TASK [strongswan : Ubuntu | Enable services] *************************************************************************************************************************************

TASK [strongswan : Ubuntu | Ensure that the strongswan service directory exist] **************************************************************************************************
changed: [REDACTED]

TASK [strongswan : Ubuntu | Setup the cgroup limitations for the ipsec daemon] ***************************************************************************************************
changed: [REDACTED]

TASK [strongswan : Ensure that the strongswan user exist] ************************************************************************************************************************
ok: [REDACTED]

TASK [strongswan : Install strongSwan] *******************************************************************************************************************************************
ok: [REDACTED]
changed: [REDACTED] => (item={u'dest': u'strongswan.conf', u'src': u'strongswan.conf.j2', u'group': u'root', u'mode': u'0644', u'owner': u'root'})
changed: [REDACTED] => (item={u'dest': u'ipsec.conf', u'src': u'ipsec.conf.j2', u'group': u'root', u'mode': u'0644', u'owner': u'root'})
changed: [REDACTED] => (item={u'dest': u'ipsec.secrets', u'src': u'ipsec.secrets.j2', u'group': u'root', u'mode': u'0600', u'owner': u'strongswan'})

TASK [strongswan : Setup the config files from our templates] ********************************************************************************************************************

TASK [strongswan : Get loaded plugins] *******************************************************************************************************************************************
changed: [REDACTED]
changed: [REDACTED] => (item=rc2)
changed: [REDACTED] => (item=gmp)
changed: [REDACTED] => (item=resolve)
changed: [REDACTED] => (item=md4)
changed: [REDACTED] => (item=sha1)
changed: [REDACTED] => (item=sshkey)
changed: [REDACTED] => (item=agent)
changed: [REDACTED] => (item=connmark)
changed: [REDACTED] => (item=updown)
changed: [REDACTED] => (item=dnskey)
changed: [REDACTED] => (item=fips-prf)
changed: [REDACTED] => (item=constraints)
changed: [REDACTED] => (item=mgf1)
changed: [REDACTED] => (item=bypass-lan)
changed: [REDACTED] => (item=counters)
changed: [REDACTED] => (item=xcbc)
changed: [REDACTED] => (item=aesni)
changed: [REDACTED] => (item=attr)
changed: [REDACTED] => (item=md5)
changed: [REDACTED] => (item=xauth-generic)
changed: [REDACTED] => (item=pkcs1)
changed: [REDACTED] => (item=eap-mschapv2)
changed: [REDACTED] => (item=gcm)
changed: [REDACTED] => (item=pgp)
changed: [REDACTED] => (item=socket-default)
changed: [REDACTED] => (item=pem)
changed: [REDACTED] => (item=hmac)
changed: [REDACTED] => (item=pkcs7)
changed: [REDACTED] => (item=aes)
changed: [REDACTED] => (item=stroke)
changed: [REDACTED] => (item=pkcs12)
changed: [REDACTED] => (item=x509)
changed: [REDACTED] => (item=random)
changed: [REDACTED] => (item=pubkey)
changed: [REDACTED] => (item=openssl)
changed: [REDACTED] => (item=nonce)
changed: [REDACTED] => (item=revocation)
changed: [REDACTED] => (item=kernel-netlink)
changed: [REDACTED] => (item=pkcs8)
changed: [REDACTED] => (item=sha2)

TASK [strongswan : Set subjectAltName as a fact] *********************************************************************************************************************************
ok: [REDACTED -> localhost]
changed: [REDACTED -> localhost] => (item=ecparams)
changed: [REDACTED -> localhost] => (item=certs)
ok: [REDACTED -> localhost] => (item=crl)
ok: [REDACTED -> localhost] => (item=newcerts)
changed: [REDACTED -> localhost] => (item=private)
changed: [REDACTED -> localhost] => (item=public)
changed: [REDACTED -> localhost] => (item=reqs)

TASK [strongswan : Ensure the pki directories exist] *****************************************************************************************************************************
changed: [REDACTED -> localhost] => (item=apple)
ok: [REDACTED -> localhost] => (item=windows)
changed: [REDACTED -> localhost] => (item=manual)

TASK [strongswan : Ensure the config directories exist] **************************************************************************************************************************
changed: [REDACTED -> localhost] => (item=.rnd)
changed: [REDACTED -> localhost] => (item=private/.rnd)
changed: [REDACTED -> localhost] => (item=index.txt)
changed: [REDACTED -> localhost] => (item=index.txt.attr)
changed: [REDACTED -> localhost] => (item=serial)

TASK [strongswan : Ensure the files exist] ***************************************************************************************************************************************

TASK [strongswan : Generate the openssl server configs] **************************************************************************************************************************
ok: [REDACTED -> localhost]

TASK [strongswan : Build the CA pair] ********************************************************************************************************************************************
ok: [REDACTED -> localhost]

TASK [strongswan : Copy the CA certificate] **************************************************************************************************************************************
ok: [REDACTED -> localhost]

TASK [strongswan : Generate the serial number] ***********************************************************************************************************************************
ok: [REDACTED -> localhost]

TASK [strongswan : Build the server pair] ****************************************************************************************************************************************
ok: [REDACTED -> localhost]
ok: [REDACTED -> localhost] => (item=laptop)
ok: [REDACTED -> localhost] => (item=phone)
ok: [REDACTED -> localhost] => (item=spare)

TASK [strongswan : Build the client's pair] **************************************************************************************************************************************
ok: [REDACTED -> localhost] => (item=laptop)
ok: [REDACTED -> localhost] => (item=phone)
ok: [REDACTED -> localhost] => (item=spare)

TASK [strongswan : Build openssh public keys] ************************************************************************************************************************************
changed: [REDACTED -> localhost] => (item=laptop)
changed: [REDACTED -> localhost] => (item=phone)
changed: [REDACTED -> localhost] => (item=spare)

TASK [strongswan : Build the client's p12] ***************************************************************************************************************************************
changed: [REDACTED -> localhost] => (item=laptop)
changed: [REDACTED -> localhost] => (item=phone)
changed: [REDACTED -> localhost] => (item=spare)

TASK [strongswan : Copy the p12 certificates] ************************************************************************************************************************************

TASK [strongswan : Get active users] *********************************************************************************************************************************************
changed: [REDACTED -> localhost]
changed: [REDACTED] => (item={u'dest': u'cacerts/ca.crt', u'src': u'cacert.pem', u'group': u'root', u'mode': u'0600', u'owner': u'strongswan'})
changed: [REDACTED] => (item={u'dest': u'certs/REDACTED.crt', u'src': u'certs/REDACTED.crt', u'group': u'root', u'mode': u'0600', u'owner': u'strongswan'})
changed: [REDACTED] => (item={u'dest': u'private/REDACTED.key', u'src': u'private/REDACTED.key', u'group': u'root', u'mode': u'0600', u'owner': u'strongswan'})

TASK [strongswan : Copy the keys to the strongswan directory] ********************************************************************************************************************
changed: [REDACTED -> localhost] => (item=laptop)
changed: [REDACTED -> localhost] => (item=phone)
changed: [REDACTED -> localhost] => (item=spare)

TASK [strongswan : Register p12 PayloadContent] **********************************************************************************************************************************

TASK [strongswan : Set facts for mobileconfigs] **********************************************************************************************************************************
ok: [REDACTED -> localhost]
changed: [REDACTED] => (item=None)
changed: [REDACTED] => (item=None)
changed: [REDACTED] => (item=None)

TASK [strongswan : Build the mobileconfigs] **************************************************************************************************************************************
changed: [REDACTED -> localhost] => (item=laptop)
changed: [REDACTED -> localhost] => (item=phone)
changed: [REDACTED -> localhost] => (item=spare)

TASK [strongswan : Build the client ipsec config file] ***************************************************************************************************************************
changed: [REDACTED -> localhost] => (item=laptop)
changed: [REDACTED -> localhost] => (item=phone)
changed: [REDACTED -> localhost] => (item=spare)

TASK [strongswan : Build the client ipsec secret file] ***************************************************************************************************************************

TASK [strongswan : Restrict permissions for the local private directories] *******************************************************************************************************
ok: [REDACTED -> localhost]

TASK [strongswan : strongSwan started] *******************************************************************************************************************************************
ok: [REDACTED]

RUNNING HANDLER [dns_adblocking : restart apparmor] ******************************************************************************************************************************
changed: [REDACTED]

RUNNING HANDLER [strongswan : restart strongswan] ********************************************************************************************************************************
changed: [REDACTED]

RUNNING HANDLER [strongswan : daemon-reload] *************************************************************************************************************************************
changed: [REDACTED]

TASK [Delete the CA key] *********************************************************************************************************************************************************
ok: [REDACTED-> localhost]

TASK [Dump the configuration] ****************************************************************************************************************************************************
ok: [REDACTED -> localhost]

TASK [debug] *********************************************************************************************************************************************************************
ok: [REDACTED] => {
    "msg": [
        [
            "\"#                          Congratulations!                            #\"", 
            "\"#                     Your Algo server is running.                     #\"", 
            "\"#    Config files and certificates are in the ./configs/ directory.    #\"", 
            "\"#              Go to https://whoer.net/ after connecting               #\"", 
            "\"#        and ensure that all your traffic passes through the VPN.      #\"", 
            "\"#                     Local DNS resolver 172.16.0.1                    #\"", 
            ""
        ], 
        "    \"#        The p12 and SSH keys password for new users is REDACTED       #\"\n", 
        "    ", 
        "    \"#      Shell access: ssh -i configs/algo.pem ubuntu@REDACTED        #\"\n"
    ]
}

PLAY RECAP ***********************************************************************************************************************************************************************
REDACTED                : ok=116  changed=73   unreachable=0    failed=0   
localhost                  : ok=34   changed=5    unreachable=0    failed=0   

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions