Valid configuration for IKEv2 VPN for iOS and OSX

matp · Feb 5, 2016, 11:55 PM

denny, it is not. In fact, I did have it working set to 20.
I'm no authority on this stuff by a long shot. My concern was that there seemed to be no set of instructions that would produce a working link. These values 'work' and they're pretty good, but yes, setting the P2 to DH20 is a good idea.

As I have already tested this and I know it works with the rest of the values, I'll edit the post to use DH20 for both the P1 and the P2.

Cheers!

paulchen0815 · Feb 6, 2016, 5:09 PM

Hi,

I want to configure my pfSense as an VPN "dial-in-server" to access my home network via IPsec VPN from my mobile clients (smartphone, tablet, Mac).

I have the following problem when configuring it with your documentation:

when creating the phase 1 entry I have to enter a remote gateway address and this is a mandatory field, so I have to fill in anything.

But in my usecase my mobile phone has no known official IP adress… So what I have to fill in there?

Thanks,

paulchen

matp · Feb 6, 2016, 8:57 PM

Not too sure I follow you, only the pfSense box needs a fixed IP, the mobile device does not.

Your message means that the instructions are not clear enough, as it would seem that you have made a mistake in them, could you please tell me which step you are looking at and I'll enhance it.
Thanks.

@paulchen0815:

when creating the phase 1 entry I have to enter a remote gateway address and this is a mandatory field, so I have to fill in anything.

But in my usecase my mobile phone has no known official IP adress… So what I have to fill in there?

luckman212 · Feb 6, 2016, 10:05 PM

I think what he means is that the pfSense does not have a static IPv4 WAN address. Can a DNS name e.g. a dynamic-dns entry be substituted in place?

paulchen0815 · Feb 7, 2016, 6:16 AM

Maybe the wording in the pfSense GUI is a little bit missleading. I have to enter the "Remote Gateway: Enter the public IP address or host name of the remote gateway". See attached screenshot.

So in my point of view this would be the other end of the IPsec tunnel, so not my pfSense box but the mobile device (which has a dynamic IP address that is unkown).

So which IP address or hostname I have to enter in this field?

![Bildschirmfoto 2016-02-07 um 07.13.24.png](/public/imported_attachments/1/Bildschirmfoto 2016-02-07 um 07.13.24.png)
![Bildschirmfoto 2016-02-07 um 07.13.24.png_thumb](/public/imported_attachments/1/Bildschirmfoto 2016-02-07 um 07.13.24.png_thumb)

matp · Feb 8, 2016, 11:33 AM

Ah, now it makes sense.
First, you're setting up an IKEv1 connection, and these instructions are for IKEv2
Second, in the screenshot you are configuring a P1 for a static site-to-site link, not a mobile one, which is why you are being asked for a remote address.
You want to be configuring the Mobile Client phase 1.

Recheck the instructions from the 'Configure the VPN' section and try again.

paulchen0815 · Feb 9, 2016, 4:22 AM

Yes, that was the problem: I didn't realize, that there is a difference how to create the phase 1 entry. I did it via the "tunnel" tab and not via the button "create mobile phase 1". With this button there is no "Remote gateway" field and that makes sense now.

Thanks!

Best regards

paulchen

nodau · Feb 10, 2016, 9:00 AM

does dns resolution work from the ios device in this configuration? with the current ipsec config ios 9 doesn't do name resolution through tunnel. running shrewsoft on windows works. so i'm looking for a solution that will allow dns through tunnel from any ios 9 device.

jeevajii · Feb 10, 2016, 11:04 AM

Useful ideas.. Great information Thanks..

matp · Feb 16, 2016, 7:48 PM

It does, but only if you route all traffic over the link. I do mention this in the post.
I've been unable to find a resolution to this.

Sadly, paid support responded with a "works for me" answer, which wasn't much help.

@bahsig:

does dns resolution work from the ios device in this configuration? with the current ipsec config ios 9 doesn't do name resolution through tunnel. running shrewsoft on windows works. so i'm looking for a solution that will allow dns through tunnel from any ios 9 device.

shpokas · Sep 3, 2019, 9:10 AM

@bahsig:

does dns resolution work from the ios device in this configuration? with the current ipsec config ios 9 doesn't do name resolution through tunnel. running shrewsoft on windows works. so i'm looking for a solution that will allow dns through tunnel from any ios 9 device.

This hint worked for me, on both IOS and OS X.
https://lists.strongswan.org/pipermail/users/2015-October/008842.html

For details on my setup, please see https://forum.pfsense.org/index.php?topic=106694.0

matp · Feb 18, 2016, 7:57 PM

Thanks shpokas!
Very interesting hack. I'm not using signed profiles, so I was able to try this. I didn't have any success with it but I'll try again soon. Quite odd that this may be fixable at the client side, despite dns settings being provided in the pfsense config. It still screams 'bug' to me.

(Plus, the paid support team said it worked just fine in their tests without doing this)

@shpokas:

This hint worked for me, on both IOS and OS X.
https://lists.strongswan.org/pipermail/users/2015-October/008842.html

For details on my setup, please see https://forum.pfsense.org/index.php?topic=106694.0

kapara · Feb 22, 2016, 8:46 AM

Have you tried installing/using the strongswan client for the MAC?

https://download.strongswan.org/osx/strongswan-5.3.2-1.app.zip

shpokas · Feb 22, 2016, 10:04 AM

nope, DNS still does not work for me and there's no way to configure it - in contrary to OS X built-in client.

matp · Feb 22, 2016, 6:06 PM

I had a look at that strong swan client, don't like it.
It didnt seem to do anything with the certificates, and the advantage of using the native configurator profile is that we can deploy and modify the settings via the MDM enrolment, which helps.

We're still simply routing all traffic to work around the DNS issue, its good enough for now.

bluefoxreg · Mar 13, 2016, 10:30 AM

I'm not sure what's causing this but my windows 10 was able to route all traffic through VPN (with one phase 2 config of 0.0.0.0/0). While my IOS (iphone 5s w IOS 9.2.1) is not routing any traffic through the VPN, even though the VPN icon is showing.

I also noticed that on the iphone the IP seems to remain the same after the VPN is connected.

I followed this guide, and the only thing that's different than what is outlined is the profile setup through app configurator 2, which I don't have access to

https://doc.pfsense.org/index.php/IKEv2_with_EAP-MSCHAPv2

Thoughts?

bluefoxreg · Mar 13, 2016, 10:31 AM

Actually, found the problem… I followed the document and didn't have a local domain set, once I did, the ios devices are able to route all traffics through the VPN now!

hidalgo · Apr 18, 2016, 12:01 PM

First, thank you for these instructions. With these I could finally connect my iPhone to my pfSense 2.3. But I cannot figure out how to resolve my local dns names through the tunnel.
If I leave phase 2 “Local Network” to “LAN subnet” I reach my local devices with IP address and the internet outside the tunnel.
If I put phase 2 “Local Network” to “Network” and “Address 0.0.0.0/0” I reach my local devices with IP address but no internet. Do I have to change my firewall settings?

But how can I resolve my devices with names? This

https://lists.strongswan.org/pipermail/users/2015-October/008842.html

doesn’t work for me. Or I don’t understand exactly how to do it?

matp · Apr 18, 2016, 5:28 PM

Yeah, I was hoping 2.3 fixed/changed this. Only way seems to be to route all traffic, as mentioned. This means internet access goes out from the other end of the VPN, and domain name resolution is handled by the LAN dns server, it could be that you've not got access to them?

dennypage · Apr 18, 2016, 5:50 PM

I'm not sure it's something that pfSense can fix. Best that I can tell, the correct options are being set for StrongSwan, and StrongSwan is pushing the options correctly. The fix would need to be on the iOS/MacOS side.

I did see someone who said that they had fixed it by introducing options in the profile that could not be set in Configurator. I dug into this a bit, but was not able to reproduce their success with MacOS. I didn't try with iOS though.