Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VPN user group missing

    Scheduled Pinned Locked Moved IPsec
    2 Posts 1 Posters 1.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      daleelad.cc
      last edited by

      Hey smarter than me ones.

      Been following some articles to get my ipad connected to pfsense through ipsec.

      https://blog.andregasser.net/how-to-configure-ipsec-vpn-on-pfsense-for-use-with-iphone-ipad-android-windows-and-linux/
      https://doc.pfsense.org/index.php/IPsec_Road_Warrior/Mobile_Client_How-To

      Both articles say to add the users I created in the IPsec xauth Dialin user group, but that group doesn't exist.  When I go to groups to manually create one I don't see anything that gives special permissions to ipsec for users.  Of course when I try to connect from my ipad I'm getting the following:

      Feb 15 18:38:38 charon user 'username' cannot authenticate through IPsec since the required privileges are missing.
      Feb 15 18:38:38 charon user 'username' could not authenticate.
      Feb 15 18:38:38 charon 12[IKE] <con1|7>XAuth-SCRIPT failed for user 'username' with return status: -1.
      Feb 15 18:38:38 charon 12[IKE] <con1|7>Could not authenticate with XAuth secrets for 'xx.xx.xx.xx' - 'username'
      Feb 15 18:38:38 charon 12[IKE] <con1|7>XAuth authentication of 'username' failed
      Feb 15 18:38:38 charon 12[ENC] <con1|7>generating TRANSACTION request 988978985 [ HASH CPS(X_STATUS) ]
      Feb 15 18:38:38 charon 12[NET] <con1|7>sending packet: from xx.xx.xx.xx[4500] to yy.yy.yy.yy[5732] (76 bytes)
      Feb 15 18:38:38 charon 12[NET] <con1|7>received packet: from yy.yy.yy.yy[5732] to xx.xx.xx.xx[4500] (76 bytes)
      Feb 15 18:38:38 charon 12[ENC] <con1|7>parsed TRANSACTION response 988978985 [ HASH CPA(X_STATUS) ]
      Feb 15 18:38:38 charon 12[IKE] <con1|7>destroying IKE_SA after failed XAuth authentication

      Am I barking up the wrong tree by thinking there should be a pre-defined group for IPSEC Xauth dialin?

      TIA for your help.</con1|7></con1|7></con1|7></con1|7></con1|7></con1|7></con1|7></con1|7>

      1 Reply Last reply Reply Quote 0
      • D
        daleelad.cc
        last edited by

        Answered my own question.  Below groups are effective permissions, you can add the permission to that for IPSEC Xauth dialin.

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.