Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOVLED] How to restart ipsec service from command line

    Scheduled Pinned Locked Moved
    IPsec
    5
    19
    35.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      doktornotor Banned
      last edited by

      I frankly have no idea what's the difference between the button and script. The button may work perfectly fine except for the fact it fails to apply changed configuration here so it's totally useless. So, the only workable way to really restart this thing is stop and start (always thought restart would do that but here apparently some reload attempt is made or god knows what…) Cannot see myself getting in love with strongswan any time soon.

      1 Reply Last reply Reply Quote 0
      • E
        esquire1968
        last edited by

        Hi again!

        The effect of the script and the "restart button" is the same, it doesn't work. See the log as below:

        Feb 11 19:04:57 charon: 13[CFG] rereading crls from '/var/etc/ipsec/ipsec.d/crls' 
Feb 11 19:04:57 charon: 13[CFG] rereading attribute certificates from '/var/etc/ipsec/ipsec.d/acerts' 
Feb 11 19:04:57 charon: 13[CFG] rereading aa certificates from '/var/etc/ipsec/ipsec.d/aacerts' 
Feb 11 19:04:57 charon: 13[CFG] rereading ocsp signer certificates from '/var/etc/ipsec/ipsec.d/ocspcerts' 
Feb 11 19:04:57 charon: 13[CFG] loaded ca certificate "C=EH, ST=xx, L=xxx, O=xxx, CN=xxx, E=xxx@xxx.com from '/var/etc/ipsec/ipsec.d/cacerts/df28683a.0.crt' 
Feb 11 19:04:57 charon: 13[CFG] loaded ca certificate "C=AT, ST=yy, L=yyy, O=yyy, E=yyy@yyy.com, CN=yyy" from '/var/etc/ipsec/ipsec.d/cacerts/a9025906.0.crt' 
Feb 11 19:04:57 charon: 13[CFG] rereading ca certificates from '/var/etc/ipsec/ipsec.d/cacerts' 
Feb 11 19:04:57 charon: 13[CFG] loaded IKE secret for %any nnn.nnn.nnn.nnn 
Feb 11 19:04:57 charon: 13[CFG] loading secrets from '/var/etc/ipsec/ipsec.secrets'

        What is wrong here?

        Only with the Buttons <Stop Ipsec Service> and then <Start Ipsec Service> the tunnel works.

        Have you any idea what I can do? Maybe a script that stops AND restarts the Connection …

        The reason why I need a solution is, that my internet connection stops every 24 hours (daily at 05:10), I get a new IP and the DynDNS will be updated. IPsec tries to establish the tunnel with the old IP - I don't know why.

        I'm thankful for any tipps.

        Best regards
        esquire1968

        1 Reply Last reply Reply Quote 0
        • D
          doktornotor Banned
          last edited by

          @esquire1968:

          What is wrong here?
          Only with the Buttons <Stop Ipsec Service> and then <Start Ipsec Service> the tunnel works.
          Have you any idea what I can do? Maybe a script that stops AND restarts the Connection …

          No, NFC. Nada. Nothing. Zero. Strongswan suxxx…

          https://redmine.pfsense.org/issues/4268
          https://redmine.pfsense.org/issues/4353

          1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by 

            pfSsh.php playback svc stop ipsec; pfSsh.php playback svc start ipsec

            The restart action was set to only refresh the configuration, to minimize disruption to running tunnels.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • E
              esquire1968
              last edited by

              Sorry, I'm a Little bit confused!  :-[

              Now, I've 2 links to new files …

              https://redmine.pfsense.org/projects/pfsense/repository/revisions/01f3438e7ab91d29751fc27a4627a98c8cba2b4b

              ... and ...

              https://redmine.pfsense.org/projects/pfsense/repository/revisions/41da54ce14d2d43a5ce9738bd80b73355fa26180

              Witch are the right one?

              Should I set a cron-job with the following command 1 Minute after the new Internet Connection has been started:

              [code]pfSsh.php playback svc stop ipsec; pfSsh.php playback svc start ipsec

              Best regards
              esquire1968

              1 Reply Last reply Reply Quote 0
              • D
                doktornotor Banned
                last edited by

                @esquire1968:

                Sorry, I'm a Little bit confused!  :-[
                Now, I've 2 links to new files …
                [/quote]

                Does not matter. Plus, the "restart" is apparently useless so just ignore the patch.

                1 Reply Last reply Reply Quote 0
                • E
                  esquire1968
                  last edited by

                  Hi again!

                  When I start the following command via SSH, it works!

                  pfSsh.php playback svc stop ipsec; pfSsh.php playback svc start ipsec

                  The same command as a cron-job does nothing!

                  12   5   *   *   *   root   pfSsh.php playback svc stop ipsec; pfSsh.php playback svc start ipsec

                  Why? Pls help!

                  Thx
                  esquire1968

                  1 Reply Last reply Reply Quote 0
                  • D
                    doktornotor Banned
                    last edited by

                    Always use full paths with cron…

                    1 Reply Last reply Reply Quote 0
                    • D
                      doktornotor Banned
                      last edited by

                      @doktornotor:

                      Always use full paths (like /usr/local/sbin/pfSsh.php) with cron…

                      1 Reply Last reply Reply Quote 0
                      • E
                        esquire1968
                        last edited by

                        Thanks! Now it works!

                        How can I reduce the log entries für IPsec. I've a lot of logs like this …

                        Feb 16 13:35:02 charon: 07[NET] sending packet: from xxx.xxx.xxx.xxx[500] to yyy.yyy.yyy.yyy[500] (92 bytes) 
Feb 16 13:35:02 charon: 07[ENC] generating INFORMATIONAL_V1 request 851016784 [ HASH N(DPD_ACK) ] 
Feb 16 13:35:02 charon: 07[ENC] parsed INFORMATIONAL_V1 request 703088055 [ HASH N(DPD) ] 
Feb 16 13:35:02 charon: 07[NET] received packet: from xxx.xxx.xxx.xxx[500] to yyy.yyy.yyy.yyy[500] (92 bytes)

                        'IPsec debug' is 'silent'.

                        Chreers
                        esquire1968

                        1 Reply Last reply Reply Quote 0
                        • K
                          kapara
                          last edited by

                          With the new version 2.3 are we able to take advantage of all the strongswan commands?

                          I am running 2.2.6 and I lost all connectivity to the GUI during setup of a VPN.  Since I cannot reboot (Business Hours) I wanted to check the status of the VPN's and I was able to run from shell:  ipsec status and was able to get details on all configured tunnels.

                          https://wiki.strongswan.org/projects/strongswan/wiki/IpsecCommand

                          Can we use this to restart the ipsec or is that not recommended?

                          Skype ID:  Marinhd

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.