☰

StrongSwan 配置问题：未找到匹配的对等配置

tag-icon • tag-icon vpn ipsec strongswan openwrt ikev2
StrongSwan 配置问题：未找到匹配的对等配置

我正在尝试使用 IPsec 在我的路由器（运行 OpenWrt）和我的智能手机之间建立 VPN。

我按照指南进行操作https://openwrt.org/docs/guide-user/services/vpn/ipsec/strongswan/roadwarrior

据我所知，大多数事情都运行良好，但是当我单击手机上的“连接”按钮时，我无法建立连接并且在路由器上永久出现以下错误：

Sun Aug  9 22:29:48 2020 daemon.info syslog: 04[CFG] looking for peer configs matching 111.222.111.222[%any]...192.168.1.216[192.168.1.216]
Sun Aug  9 22:29:48 2020 daemon.info syslog: 04[CFG] no matching peer config found

据我跟踪，这个问题的关键是，所使用的名称rightid也leftid位于证书的 SAN 上（请参阅VPN 服务器使用 StrongSwan“未找到匹配的对等配置” - 这是什么意思？）在我看来，情况是这样的：

输出ipsec listcerts

no files found matching '/etc/strongswan.d/*.conf'

List of X.509 End Entity Certificates:

  altNames:  lumia950xl, myVpnClients
  subject:  "C=DE, O=-, CN=lumia950xl"
  issuer:   "C=DE, O=-, CN=something.example.org"
  serial:    68:e0:a1:3d:32:0a:02:7f
  validity:  not before Aug 09 19:35:53 2020, ok
             not after  Aug 09 19:35:53 2030, ok 
  pubkey:    RSA 2048 bits
  keyid:     a7:01:fd:fb:44:81:52:ee:5b:b7:03:59:df:4f:a3:fa:53:b5:58:ea
  subjkey:   de:dd:c9:3e:c5:bf:e2:e0:f1:51:c6:1d:ad:f1:02:2e:f3:48:ac:02
  authkey:   8e:19:a8:0c:b1:eb:c5:bc:3a:ff:e4:c0:c7:e1:24:0d:e1:e0:f9:0b

  altNames:  something.example.org
  subject:  "C=DE, O=-, CN=something.example.org"
  issuer:   "C=DE, O=-, CN=something.example.org"
  serial:    59:11:7e:ca:07:39:1a:ab
  validity:  not before Aug 09 19:35:49 2020, ok
             not after  Aug 09 19:35:49 2030, ok 
  pubkey:    RSA 2048 bits, has private key
  keyid:     53:9e:ad:04:d8:22:20:be:b6:2e:0a:9c:07:8e:89:03:6d:b4:bc:5f
  subjkey:   3b:d4:a6:f5:b2:48:1d:a7:08:8d:64:04:88:65:87:91:fe:65:00:78
  authkey:   8e:19:a8:0c:b1:eb:c5:bc:3a:ff:e4:c0:c7:e1:24:0d:e1:e0:f9:0b

Making Keys我使用以下参数运行指南（部分）中的脚本来生成证书：

COUNTRYNAME="DE"
CANAME="something.example.org"
ORGNAME="-"
SERVERDOMAINNAME="something.example.org"
CLIENTNAMES="lumia950xl" # or more " �^�� myvpnclient2 muvpnclient3"
SHAREDSAN="myVpnClients" # iOS clients need to match a common SAN

内容ipsec.conf

# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
        # strictcrlpolicy=yes
        # uniqueids = no

conn %default
        keyexchange=ikev2
        ike=aes256-aes128-sha256-sha1-modp3072-modp2048
        esp=aes128-aes256-sha256-modp3072-modp2048,aes128-aes256-sha256
        left=%any
        leftauth=pubkey
        leftcert=serverCert_something.example.org.pem
        leftid=something.example.org
        leftsubnet=0.0.0.0/0;::/0
        right=%any
        rightsourceip=192.168.1.99/32
        #rightdns=8.8.8.8
        eap_identity=%identity
        auto=add


#conn rwPUBKEY
#        rightauth=pubkey
#        rightcert=clientCert_lumia950xl.pem
#        #rightauth2=eap-mschapv2

conn rwEAPTLS
        rightauth=eap-tls
        rightcert=clientCert_lumia950xl.pem

输出ipsec statusall

no files found matching '/etc/strongswan.d/*.conf'
Status of IKE charon daemon (strongSwan 5.3.3, Linux 3.18.20, mips):
  uptime: 5 minutes, since Aug 09 22:50:24 2020
  malloc: sbrk 262144, mmap 0, used 235072, free 27072
  worker threads: 9 of 16 idle, 7/0/0/0 working, job queue: 0/0/0/0, scheduled: 0
  loaded plugins: charon test-vectors ldap pkcs11 aes des blowfish rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gcrypt af-alg fips-prf gmp agent xcbc cmac hmac ctr ccm gcm curl mysql sqlite attr kernel-netlink resolve socket-default farp stroke smp updown eap-identity eap-md5 eap-mschapv2 eap-radius eap-tls xauth-generic xauth-eap dhcp whitelist led duplicheck uci addrblock unity
Virtual IP pools (size/online/offline):
  192.168.1.99/32: 1/0/0
Listening IP addresses:
  192.168.1.1
  fd87:6eb5:ef58::1
  111.222.111.222
Connections:
    rwEAPTLS:  %any...%any  IKEv2
    rwEAPTLS:   local:  [something.example.org] uses public key authentication
    rwEAPTLS:    cert:  "C=DE, O=-, CN=something.example.org"
    rwEAPTLS:   remote: [C=DE, O=-, CN=lumia950xl] uses EAP_TLS authentication with EAP identity '%any'
    rwEAPTLS:    cert:  "C=DE, O=-, CN=lumia950xl"
    rwEAPTLS:   child:  0.0.0.0/0 === dynamic TUNNEL
Security Associations (0 up, 0 connecting):
  none

有人可以解释一下我做错了什么吗？！:)

相关内容