I noticed issues using your sample setup when attempting to connect an iOS client to the vpn-server.
I used your Docker-compose file with the following modifications:
services:
vpn-server:
ports:
- "500:500/udp"
- "4500:4500/udp"
command: /charon
and was able to connect with the Android StrongSwan-Client using the eap-setup for jane with the docker host as the Strongswan server after importing caCert.pem into the client.
The Docker host is a Mac mini M1. I built the strongswan:5.9.10 image from the Dockerfile you provided as there is an amd64 image only on Docker hub.
However, using the same credentials in iOS on a IKEv2 VPN connection using the built-in vpn stack does not connect.
The first thing I needed to do was to remove all the server proposal from the server configuration file as iOS IKEv2 does not support Curve25519.
It changed the server log, but not the outcome: iOS doesn't connect. This is, what I see in the charon server log:
12[NET] received packet: from 192.168.0.1[36785] to 192.168.0.2[500] (604 bytes)
2023-05-10T16:37:18.546651552Z 12[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]
2023-05-10T16:37:18.548211510Z 12[IKE] 192.168.0.1 is initiating an IKE_SA
2023-05-10T16:37:18.550500510Z 12[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
2023-05-10T16:37:18.559234677Z 12[IKE] local host is behind NAT, sending keep alives
2023-05-10T16:37:18.559674135Z 12[IKE] remote host is behind NAT
2023-05-10T16:37:18.561551635Z 12[IKE] sending cert request for "C=CH, O=Cyber, CN=Cyber Root CA"
2023-05-10T16:37:18.562556677Z 12[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(CHDLESS_SUP) N(MULT_AUTH) ]
2023-05-10T16:37:18.562691468Z 12[NET] sending packet: from 192.168.0.2[500] to 192.168.0.1[36785] (481 bytes)
2023-05-10T16:37:18.590461135Z 10[NET] received packet: from 192.168.0.1[34243] to 192.168.0.2[4500] (512 bytes)
2023-05-10T16:37:18.607463593Z 10[ENC] unknown attribute type INTERNAL_DNS_DOMAIN
2023-05-10T16:37:18.607518718Z 10[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr CPRQ(ADDR MASK DHCP DNS ADDR6 DHCP6 DNS6 DOMAIN) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr N(MOBIKE_SUP) ]
2023-05-10T16:37:18.607526677Z 10[CFG] looking for peer configs matching 192.168.0.2[server.strongswan.org]...192.168.0.1[192.168.178.65]
2023-05-10T16:37:18.607529260Z 10[CFG] selected peer config 'rw'
2023-05-10T16:37:18.607531843Z 10[IKE] peer requested EAP, config unacceptable
2023-05-10T16:37:18.607572302Z 10[CFG] switching to peer config 'psk'
2023-05-10T16:37:18.607617468Z 10[IKE] peer requested EAP, config unacceptable
2023-05-10T16:37:18.607804510Z 10[CFG] switching to peer config 'eap'
2023-05-10T16:37:18.608085135Z 10[IKE] initiating EAP_IDENTITY method (id 0x00)
2023-05-10T16:37:18.608100218Z 10[IKE] peer supports MOBIKE
2023-05-10T16:37:18.608104385Z 10[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
2023-05-10T16:37:18.609484843Z 10[IKE] authentication of 'server.strongswan.org' (myself) with ECDSA-384 signature successful
2023-05-10T16:37:18.609494343Z 10[ENC] generating IKE_AUTH response 1 [ IDr AUTH EAP/REQ/ID ]
2023-05-10T16:37:18.609517635Z 10[NET] sending packet: from 192.168.0.2[4500] to 192.168.0.1[34243] (208 bytes)
2023-05-10T16:37:18.647225135Z 11[NET] received packet: from 192.168.0.1[36785] to 192.168.0.2[500] (604 bytes)
2023-05-10T16:37:18.647365635Z 11[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]
2023-05-10T16:37:18.647376510Z 11[IKE] 192.168.0.1 is initiating an IKE_SA
2023-05-10T16:37:18.647379343Z 11[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
2023-05-10T16:37:18.649942760Z 11[IKE] local host is behind NAT, sending keep alives
2023-05-10T16:37:18.649978135Z 11[IKE] remote host is behind NAT
2023-05-10T16:37:18.649983885Z 11[IKE] sending cert request for "C=CH, O=Cyber, CN=Cyber Root CA"
2023-05-10T16:37:18.650095885Z 11[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(CHDLESS_SUP) N(MULT_AUTH) ]
2023-05-10T16:37:18.650147177Z 11[NET] sending packet: from 192.168.0.2[500] to 192.168.0.1[36785] (481 bytes)
2023-05-10T16:37:18.671030177Z 04[NET] received packet: from 192.168.0.1[34243] to 192.168.0.2[4500] (512 bytes)
2023-05-10T16:37:18.675534677Z 04[ENC] unknown attribute type INTERNAL_DNS_DOMAIN
2023-05-10T16:37:18.675565885Z 04[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr CPRQ(ADDR MASK DHCP DNS ADDR6 DHCP6 DNS6 DOMAIN) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr N(MOBIKE_SUP) ]
2023-05-10T16:37:18.675807135Z 04[CFG] looking for peer configs matching 192.168.0.2[server.strongswan.org]...192.168.0.1[192.168.178.65]
2023-05-10T16:37:18.675958427Z 04[CFG] selected peer config 'rw'
2023-05-10T16:37:18.676040052Z 04[IKE] peer requested EAP, config unacceptable
2023-05-10T16:37:18.676054135Z 04[CFG] switching to peer config 'psk'
2023-05-10T16:37:18.676098010Z 04[IKE] peer requested EAP, config unacceptable
2023-05-10T16:37:18.676107093Z 04[CFG] switching to peer config 'eap'
2023-05-10T16:37:18.676130552Z 04[IKE] initiating EAP_IDENTITY method (id 0x00)
2023-05-10T16:37:18.676165718Z 04[IKE] peer supports MOBIKE
2023-05-10T16:37:18.676173510Z 04[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
2023-05-10T16:37:18.676676802Z 04[IKE] authentication of 'server.strongswan.org' (myself) with ECDSA-384 signature successful
2023-05-10T16:37:18.676746552Z 04[ENC] generating IKE_AUTH response 1 [ IDr AUTH EAP/REQ/ID ]
2023-05-10T16:37:18.676751677Z 04[NET] sending packet: from 192.168.0.2[4500] to 192.168.0.1[34243] (208 bytes)
12[IKE] sending keep alive to 192.168.0.1[34243]
2023-05-10T16:40:04.542322628Z 10[IKE] sending keep alive to 192.168.0.1[34243]
2023-05-10T16:40:14.485466383Z 11[JOB] deleting half open IKE_SA with 192.168.0.1 after timeout
2023-05-10T16:40:14.542242841Z 04[JOB] deleting half open IKE_SA with 192.168.0.1 after timeout
with charon obviously believing everything is fine so far. But it isn't, as iOS fails IKE_AUTH with the follwoing error message in the console log:
[IKE_AUTH R resp1 41B3D8345D768F97-3507BD311A29426C] Initiator packet authentication method
Payload Type = Auth
Authentication Protocol = ECDSA384
Authentication Data = {length = 96, bytes = 0x2b518e94 396c3e64 30cd6138 36b5f633 ... 2048de42 a5fba569 } does not match proposal RSASignature
Using a psk setup, this time for [email protected], things aren't better:
06[NET] received packet: from 192.168.0.1[46115] to 192.168.0.2[500] (604 bytes)
2023-05-10T16:44:41.446711131Z 06[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]
2023-05-10T16:44:41.446804715Z 06[IKE] 192.168.0.1 is initiating an IKE_SA
2023-05-10T16:44:41.447076256Z 06[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
2023-05-10T16:44:41.455897507Z 06[IKE] local host is behind NAT, sending keep alives
2023-05-10T16:44:41.456139965Z 06[IKE] remote host is behind NAT
2023-05-10T16:44:41.457515090Z 06[IKE] sending cert request for "C=CH, O=Cyber, CN=Cyber Root CA"
2023-05-10T16:44:41.457671048Z 06[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(CHDLESS_SUP) N(MULT_AUTH) ]
2023-05-10T16:44:41.457681882Z 06[NET] sending packet: from 192.168.0.2[500] to 192.168.0.1[46115] (481 bytes)
2023-05-10T16:44:41.499648673Z 16[NET] received packet: from 192.168.0.1[56226] to 192.168.0.2[4500] (532 bytes)
2023-05-10T16:44:41.506007923Z 16[ENC] parsed IKE_AUTH request 1 [ EF(1/2) ]
2023-05-10T16:44:41.506045215Z 16[ENC] received fragment #1 of 2, waiting for complete IKE message
2023-05-10T16:44:41.506049007Z 08[NET] received packet: from 192.168.0.1[56226] to 192.168.0.2[4500] (116 bytes)
2023-05-10T16:44:41.506051382Z 08[ENC] parsed IKE_AUTH request 1 [ EF(2/2) ]
2023-05-10T16:44:41.506053382Z 08[ENC] received fragment #2 of 2, reassembled fragmented IKE message (576 bytes)
2023-05-10T16:44:41.506091882Z 08[ENC] unknown attribute type INTERNAL_DNS_DOMAIN
2023-05-10T16:44:41.506363423Z 08[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH CPRQ(ADDR MASK DHCP DNS ADDR6 DHCP6 DNS6 DOMAIN) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr N(MOBIKE_SUP) ]
2023-05-10T16:44:41.506376798Z 08[CFG] looking for peer configs matching 192.168.0.2[server.strongswan.org]...192.168.0.1[[email protected]]
2023-05-10T16:44:41.506379840Z 08[CFG] selected peer config 'rw'
2023-05-10T16:44:41.506542632Z 08[IKE] tried 1 shared key for 'server.strongswan.org' - '[email protected]', but MAC mismatched
2023-05-10T16:44:41.506553048Z 08[IKE] peer supports MOBIKE
2023-05-10T16:44:41.506556590Z 08[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
2023-05-10T16:44:41.506558882Z 08[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
2023-05-10T16:44:41.506728423Z 08[NET] sending packet: from 192.168.0.2[4500] to 192.168.0.1[56226] (80 bytes)
2023-05-10T16:44:41.538636465Z 13[NET] received packet: from 192.168.0.1[46115] to 192.168.0.2[500] (604 bytes)
2023-05-10T16:44:41.538945340Z 13[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]
2023-05-10T16:44:41.539221590Z 13[IKE] 192.168.0.1 is initiating an IKE_SA
2023-05-10T16:44:41.539622090Z 13[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
2023-05-10T16:44:41.544329840Z 13[IKE] local host is behind NAT, sending keep alives
2023-05-10T16:44:41.544370173Z 13[IKE] remote host is behind NAT
2023-05-10T16:44:41.544410298Z 13[IKE] sending cert request for "C=CH, O=Cyber, CN=Cyber Root CA"
2023-05-10T16:44:41.544577465Z 13[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(CHDLESS_SUP) N(MULT_AUTH) ]
2023-05-10T16:44:41.544608007Z 13[NET] sending packet: from 192.168.0.2[500] to 192.168.0.1[46115] (481 bytes)
2023-05-10T16:44:41.564534423Z 09[NET] received packet: from 192.168.0.1[56226] to 192.168.0.2[4500] (532 bytes)
2023-05-10T16:44:41.572366465Z 09[ENC] parsed IKE_AUTH request 1 [ EF(1/2) ]
2023-05-10T16:44:41.572392840Z 09[ENC] received fragment #1 of 2, waiting for complete IKE message
2023-05-10T16:44:41.572624507Z 15[NET] received packet: from 192.168.0.1[56226] to 192.168.0.2[4500] (116 bytes)
2023-05-10T16:44:41.572656840Z 15[ENC] parsed IKE_AUTH request 1 [ EF(2/2) ]
2023-05-10T16:44:41.572794882Z 15[ENC] received fragment #2 of 2, reassembled fragmented IKE message (576 bytes)
2023-05-10T16:44:41.572807757Z 15[ENC] unknown attribute type INTERNAL_DNS_DOMAIN
2023-05-10T16:44:41.573112632Z 15[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH CPRQ(ADDR MASK DHCP DNS ADDR6 DHCP6 DNS6 DOMAIN) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr N(MOBIKE_SUP) ]
2023-05-10T16:44:41.573130548Z 15[CFG] looking for peer configs matching 192.168.0.2[server.strongswan.org]...192.168.0.1[[email protected]]
2023-05-10T16:44:41.573135965Z 15[CFG] selected peer config 'rw'
2023-05-10T16:44:41.573140257Z 15[IKE] tried 1 shared key for 'server.strongswan.org' - '[email protected]', but MAC mismatched
2023-05-10T16:44:41.573144465Z 15[IKE] peer supports MOBIKE
2023-05-10T16:44:41.573148257Z 15[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
2023-05-10T16:44:41.573152132Z 15[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
2023-05-10T16:44:41.573166548Z 15[NET] sending packet: from 192.168.0.2[4500] to 192.168.0.1[56226] (80 bytes)
iOS-Konsole:
[IKE_AUTH R resp1 FB08308C2E619307-B7724B5BF4ED8941] Initiator auth received notify error Error Domain=NEIKEv2ProtocolErrorDomain Code=24 "AuthenticationFailed" UserInfo={NSDebugDescription=AuthenticationFailed}
Are there issues with the config files for the docker container or is this an issue for strongswan itself ? Maybe I should hop over to the strongswan rep and file the issue there?