Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Valid configuration for IKEv2 VPN for iOS and OSX

    Scheduled Pinned Locked Moved IPsec
    68 Posts 33 Posters 52.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bluefoxreg
      last edited by

      Actually, found the problem… I followed the document and didn't have a local domain set, once I did, the ios devices are able to route all traffics through the VPN now!

      1 Reply Last reply Reply Quote 0
      • H
        hidalgo
        last edited by

        First, thank you for these instructions. With these I could finally connect my iPhone to my pfSense 2.3. But I cannot figure out how to resolve my local dns names through the tunnel.
        If I leave phase 2 “Local Network” to “LAN subnet” I reach my local devices with IP address and the internet outside the tunnel.
        If I put phase 2  “Local Network” to “Network” and “Address 0.0.0.0/0” I reach my local devices with IP address but no internet. Do I have to change my firewall settings?

        But how can I resolve my devices with names? This

        https://lists.strongswan.org/pipermail/users/2015-October/008842.html

        doesn’t work for me. Or I don’t understand exactly how to do it?

        1 Reply Last reply Reply Quote 0
        • M
          matp
          last edited by

          Yeah, I was hoping 2.3 fixed/changed this. Only way seems to be to route all traffic, as mentioned. This means internet access goes out from the other end of the VPN, and domain name resolution is handled by the LAN dns server, it could be that you've not got access to them?

          1 Reply Last reply Reply Quote 0
          • dennypageD
            dennypage
            last edited by

            I'm not sure it's something that pfSense can fix. Best that I can tell, the correct options are being set for StrongSwan, and StrongSwan is pushing the options correctly. The fix would need to be on the iOS/MacOS side.

            I did see someone who said that they had fixed it by introducing options in the profile that could not be set in Configurator. I dug into this a bit, but was not able to reproduce their success with MacOS. I didn't try with iOS though.

            1 Reply Last reply Reply Quote 0
            • M
              matp
              last edited by

              Yeah, I'm not sure either, but my thinking runs that if it were an iOS/OSX issue, then it would affect all VPN providers and that does not seem to be the case. I've not actually tested it with a Cisco or Juniper unit but I'd expect that something not based on strong swan wouldn't have this problem.

              1 Reply Last reply Reply Quote 0
              • B
                bpawlak
                last edited by

                Hi,

                Does this setup work for pfSense in version 2.3.2-RELEASE?
                Can anyone confirm that?

                Cheers!

                1 Reply Last reply Reply Quote 0
                • T
                  tcw
                  last edited by

                  @bpawlak:

                  Hi,

                  Does this setup work for pfSense in version 2.3.2-RELEASE?
                  Can anyone confirm that?

                  Cheers!

                  Yes, I just set this up today. To address an earlier question about Dynamic DNS, I have this working also but I had to set everything up on a subdomain (vpn.myname.com, versus just myname.com), including setting a dynamic DNS A record for vpn on my nameserver.

                  Thanks OP for such a detailed post! Your instructions are the first I got working. If you're still following this thread, what was your rationale for making the cipher selections you did? I'm wondering if this will work with ciphers that take advantage of AES-NI hardware acceleration.

                  1 Reply Last reply Reply Quote 0
                  • P
                    pfsensepilot
                    last edited by

                    Where or how do I key in this command?? In the web interface somewhere??  From the physical console??

                    sudo openssl pkcs12 -export -in userCert.crt -inkey userCert.key -out userCert.p12

                    I'm going through the steps and hope to make a connection between my iphone IOS 9.3.5 and pfSense 2.3.2…

                    Thanks.

                    1 Reply Last reply Reply Quote 0
                    • A
                      acc4ever
                      last edited by

                      you have downloaded command line tools for Xcode..

                      this is a little tutorial… hope it helps you...

                      http://railsapps.github.io/xcode-command-line-tools.html

                      1 Reply Last reply Reply Quote 0
                      • P
                        pfsensepilot
                        last edited by

                        Ok, so copy the 3 certificates and 1 user key to a folder on my mac, then modify the command to the correct paths and run through xcode?

                        1 Reply Last reply Reply Quote 0
                        • A
                          acc4ever
                          last edited by

                          You have to run it in through /Applications/Utilities/Terminal.app

                          1 Reply Last reply Reply Quote 0
                          • P
                            pfsensepilot
                            last edited by

                            I was able to run the command.  Thank you.

                            1 Reply Last reply Reply Quote 0
                            • P
                              pfsensepilot
                              last edited by

                              I went through all the steps in the first post.  I am not getting a connection.  What am I missing?  Here's what the logs say:

                              Sep 2 15:22:34	charon		05[ENC] <bypasslan|7> generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
Sep 2 15:22:34	charon		05[IKE] <bypasslan|7> peer supports MOBIKE
Sep 2 15:22:34	charon		05[IKE] <bypasslan|7> received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Sep 2 15:22:34	charon		05[CFG] <bypasslan|7> no alternative config found
Sep 2 15:22:34	charon		05[IKE] <bypasslan|7> peer requested EAP, config inacceptable
Sep 2 15:22:34	charon		05[CFG] <bypasslan|7> selected peer config 'bypasslan'</bypasslan|7></bypasslan|7></bypasslan|7></bypasslan|7></bypasslan|7></bypasslan|7>
                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                This doesn't work??

                                https://doc.pfsense.org/index.php/IKEv2_with_EAP-MSCHAPv2

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • P
                                  pfsensepilot
                                  last edited by

                                  Following the instructions on that link, I am getting what looks like the same errors:

                                  Sep 5 14:36:38	charon		07[ENC] <bypasslan|10> generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
Sep 5 14:36:38	charon		07[IKE] <bypasslan|10> peer supports MOBIKE
Sep 5 14:36:38	charon		07[IKE] <bypasslan|10> received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Sep 5 14:36:38	charon		07[CFG] <bypasslan|10> no alternative config found
Sep 5 14:36:38	charon		07[IKE] <bypasslan|10> peer requested EAP, config inacceptable
Sep 5 14:36:38	charon		07[CFG] <bypasslan|10> selected peer config 'bypasslan'</bypasslan|10></bypasslan|10></bypasslan|10></bypasslan|10></bypasslan|10></bypasslan|10>

                                  The only thing I was confused about when following the instructions was the CN.  I used my static external ip address as the common name, then added "ip address" as an alternative and rekeyed in my static external ip.  I'm not sure what the hostname for my box means and when I click alternative, I do not have the option for DNS.

                                  Please help!  I was using PPTP before and lost that after I upgraded my box.  Now I can't get into my office remotely anymore, can't go on vacation or out of town, I have to drive to the office in the evenings and on weekends when I need access to my network.

                                  Trying to configure ipsec to work with my macbook and iphone has cost me a lot of hours and been very frustrating.  I hope to get it configured correctly and up and running soon.

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    jffortier
                                    last edited by

                                    Hi, newbie here! :o

                                    At one point I was able to make it work but I have some issues now.

                                    I setup OpenVPN and it's working fine, but I need the Apple configurator option "AlwaysON" and it can only be achive with IKEv2.

                                    I can setup all those parameters, but the p12 certificate, I search online and openssl command line doesn't ask for a password, you can't set one and Apple configurator won't let you add that certificate to a profile with an empty password field and "space" is not working.

                                    I have PFSense 2.3, iOS 10.1  and latest version of Apple configurator.

                                    I need something simple, one user only that need to be on VPN all the time and can't get it off with configuration profile that can't be removed (supervised mode)

                                    So how can I get it to work ? or have a self sign certificate p12 with the password.

                                    Thank you

                                    1 Reply Last reply Reply Quote 0
                                    • A
                                      aholtzma
                                      last edited by

                                      To make split DNS work w/o routing all traffic through the tunnel, you need to provide a second, fake, domain name to work around bug 4418:

                                      https://redmine.pfsense.org/issues/4418

                                      Without this work around, you will see a 'p' character appended to the domain in 'scutil –dns'. The extra 'p' is still there, it just gets appended to the fake domain name and is harmless.

                                      1 Reply Last reply Reply Quote 0
                                      • F
                                        flagsense
                                        last edited by

                                        Hi,

                                        i configured as you described in your post. And the VPN Tunnel works fast, but after 3-30 Minutes the iPhone do a panic - and restart. Sometime it happend directly if i do some network traffic.

                                        Did somebody else have the same problem ?

                                        best

                                        regards

                                        flagsense

                                        1 Reply Last reply Reply Quote 0
                                        • P
                                          pfguy2017
                                          last edited by

                                          I am trying to get this set up on my pfsense box 2.3.3_1.  I am stuck on the server certificate, where the instructions say:

                                          Click "+" to add a new Alternative Name
                                          Enter DNS in the Type field
                                          Enter the hostname of the firewall as it exists in DNS again in the Value field – Some clients require the value in SAN not just CN!
                                          Click "+" to add a new Alternative Name
                                          Enter IP in the Type field
                                          Enter the WAN IP address of the firewall in the Value field

                                          At my end, there does not seem to be any way to type in DNS or IP into the type field.  The type field is a drop down menu containing the following choices:
                                          -FQDN or Hostname
                                          -IP address
                                          -URI
                                          -email address

                                          Am I missing something here?

                                          1 Reply Last reply Reply Quote 0
                                          • P
                                            posto587
                                            last edited by

                                            I'm trying to get this work with EAP-MSCHAPv2.
                                            On Windows 10 it's working great but I have problems getting this to work on macOS/iOS with AppleConfigurator profiles.

                                            I did everything to generate the profile suggested in the first post but instead of eap-authentication: certificate I choose username/password.
                                            When connecting with macOS/iOS with the profile installed I'm getting the exact same errors as pfsensepilot:

                                            Apr 4 17:13:27 	charon 		07[ENC] <bypasslan|54>generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
Apr 4 17:13:27 	charon 		07[IKE] <bypasslan|54>peer supports MOBIKE
Apr 4 17:13:27 	charon 		07[IKE] <bypasslan|54>received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
Apr 4 17:13:27 	charon 		07[CFG] <bypasslan|54>no alternative config found
Apr 4 17:13:27 	charon 		07[IKE] <bypasslan|54>peer requested EAP, config inacceptable
Apr 4 17:13:27 	charon 		07[CFG] <bypasslan|54>selected peer config 'bypasslan'</bypasslan|54></bypasslan|54></bypasslan|54></bypasslan|54></bypasslan|54></bypasslan|54>

                                            Does anybody has an idea/hint?

                                            EDIT: Now I tested with EAP-TLS and configured everything exactly as described in the first post.
                                            And again, it's working on Windows 10 but when I try to connect with macOS I'm getting the same errors shown above.
                                            Trying to modify certain settings (e.g. PFS off/on) changes nothing…

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.