Jumphost VPN (IPSec)

connections {
   fritzbox {
      local_addrs = <vps.server.ip>
      remote_addrs = 0.0.0.0/0
      local {
          auth = psk
          id = <vps.server.ip>
          }
      remote {
          auth = psk
          id = keyid:strongswan@fritz.box
          }
      children {
          net {
              local_ts = 172.25.24.0/23
              remote_ts = 192.168.188.0/24
              esp_proposals = aes256-sha512-modp1024,aes256-sha1-modp1024
              }
          }
       version = 1
       proposals = aes256-sha512-modp1024,aes256-sha1-modp1024
   }

   ikev2-mobile-defaults {
      unique = replace
      version = 2
      proposals = aes256-sha512-modp2048,aes256-sha256-modp2048,aes256-sha256-modp1024
      send_cert = always
      pools = pool-ipv4
      local_addrs = <vps.server.ip>
      remote_addrs = 0.0.0.0/0,::/0
      local {
         auth = pubkey
         certs = server-cert.pem
         id = fqdn:<vps.server.fqdn>
      }
      remote {
         id = %any
         auth = eap-mschapv2
         eap_id = %any
       }
       children {
          ikev2-mobile {
          local_ts = 0.0.0.0/0
          esp_proposals = aes256-sha512,aes256-sha384,aes256-sha256,aes256-sha1
          start_action = trap
          }
      }
   }
}
pools {
    pool-ipv4 {
    addrs = 172.25.25.0/24
    dns = 9.9.9.9,192.168.188.1
    }
}
secrets {
 eap-1 {
     id = user1
     secret = "<secret1>"  
     }
 eap-2 {
     id = user2
     secret = "<secret2>"  
     }
 ike-3 {
      id = keyid:strongswan@fritz.box
      secret = "<fritz.box.passwd>"  
     }
}

vpncfg {
        connections {
                enabled = yes;
                editable = no;
                conn_type = conntype_lan;
                name = "StrongSwan";  
                always_renew = yes;
                reject_not_encrypted = no;
                dont_filter_netbios = yes;
                localip = 0.0.0.0;
                local_virtualip = 0.0.0.0;
                remoteip = <vps.server.ip>;
                remote_virtualip = 0.0.0.0;
                keepalive_ip = 172.25.24.1;
				localid {
                        key_id = "strongswan@fritz.box";  
                        }
                remoteid {
                        ipaddr = <vps.server.ip>;
                        }
                mode = phase1_mode_idp;
                phase1ss = "LT8h/all/all/all";  
                keytype = connkeytype_pre_shared;
                key = "<fritz.box.passwd>";  
                cert_do_server_auth = no;
                use_nat_t = yes;
                use_xauth = no;
                use_cfgmode = no;
                phase2localid {
                        ipnet {
                                ipaddr = 192.168.188.0;
                                mask = 255.255.255.0;
                        }
                }
                phase2remoteid {
                        ipnet {
                                ipaddr = 172.25.24.0;
                                mask = 255.255.254.0;
                        }
                }
                phase2ss = "esp-all-all/ah-none/comp-all/pfs";  
                accesslist = "permit ip any 172.25.24.0 255.255.254.0";  
        }
        ike_forward_rules = "udp 0.0.0.0:500 0.0.0.0:500",   
                            "udp 0.0.0.0:4500 0.0.0.0:4500";  
} 

root@ubuntu:~# swanctl -q
loaded certificate from '/etc/swanctl/x509/server-cert.pem'  
loaded certificate from '/etc/swanctl/x509ca/raspica-cert.pem'  
loaded RSA key from '/etc/swanctl/private/raspica-key.pem'  
loaded RSA key from '/etc/swanctl/private/server-key.pem'  
loaded eap secret 'eap-1'  
loaded eap secret 'eap-2'  
loaded ike secret 'ike-3'  
no authorities found, 0 unloaded
loaded pool 'pool-ipv4'  
successfully loaded 1 pools, 0 unloaded
loaded connection 'fritzbox'  
loaded connection 'ikev2-mobile-defaults'  
successfully loaded 2 connections, 0 unloaded

root@ubuntu:~# swanctl -T
 

root@ubuntu:~# tcpdump -i ens6 -n -t port 500 or 4500
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on ens6, link-type EN10MB (Ethernet), snapshot length 262144 bytes
IP 94.xx.xx.xx.14500 > 82.xxx.xxx.xxx.500: isakmp: phase 1 I ident
IP 82.xxx.xxx.xxx.500 > 94.xx.xx.xx.14500: isakmp: phase 2/others R inf
IP 94.xx.xx.xx.14500 > 82.xxx.xxx.xxx.500: isakmp: phase 1 I ident
IP 82.xxx.xxx.xxx.500 > 94.xx.xx.xx.14500: isakmp: phase 2/others R inf
IP 94.xx.xx.xx.14500 > 82.xxx.xxx.xxx.500: isakmp: phase 1 I ident
IP 82.xxx.xxx.xxx.500 > 94.xx.xx.xx.14500: isakmp: phase 2/others R inf
IP 94.xx.xx.xx.14500 > 82.xxx.xxx.xxx.500: isakmp: phase 1 I ident
IP 82.xxx.xxx.xxx.500 > 94.xx.xx.xx.14500: isakmp: phase 2/others R inf
IP 80.xxx.xxx.xxx.22858 > 82.xxx.xxx.xxx.500: isakmp: parent_sa ikev2_init[I]
IP 82.xxx.xxx.xxx.500 > 80.xxx.xxx.xxx.22858: isakmp: parent_sa ikev2_init[R]
IP 94.xx.xx.xx.14500 > 82.xxx.xxx.xxx.500: isakmp: phase 1 I ident
IP 82.xxx.xxx.xxx.500 > 94.xx.xx.xx.14500: isakmp: phase 2/others R inf
IP 94.xx.xx.xx.14500 > 82.xxx.xxx.xxx.500: isakmp: phase 1 I ident
IP 82.xxx.xxx.xxx.500 > 94.xx.xx.xx.14500: isakmp: phase 2/others R inf
IP 80.xxx.xxx.xxx.22902 > 82.xxx.xxx.xxx.500: isakmp: parent_sa ikev2_init[I]
IP 82.xxx.xxx.xxx.500 > 80.xxx.xxx.xxx.22902: isakmp: parent_sa ikev2_init[R]
IP 94.xx.xx.xx.14500 > 82.xxx.xxx.xxx.500: isakmp: phase 1 I ident

Jun 12 19:47:29 08[NET] received packet: from 8....5[500] to 192.0.0.2[54985] (36 bytes)

Jun 18 16:42:37 11[IKE] received end entity cert "CN=82-xxx-xx-xxx.nip.io"  
Jun 18 16:42:37 11[CFG]   using certificate "CN=82-xxx-xx-xxx.nip.io"  
Jun 18 16:42:37 11[CFG]   using trusted ca certificate "CN=RasPi CA"  
Jun 18 16:42:37 11[CFG]   reached self-signed root ca with a path length of 0
Jun 18 16:42:37 11[CFG] checking certificate status of "CN=82-xxx-xx-xxx.nip.io"  
Jun 18 16:42:37 11[CFG] certificate status is not available
Jun 18 16:42:37 11[IKE] authentication of '82-xxx-xx-xxx.nip.io' with RSA_EMSA_PKCS1_SHA2_256 successful  
Jun 18 16:42:37 11[CFG] constraint check failed: identity '82.xxx.xx.xxx' required   
Jun 18 16:42:37 11[CFG] selected peer config 'android' unacceptable: constraint checking failed  
Jun 18 16:42:37 11[CFG] no alternative config found
Jun 18 16:42:37 11[ENC] generating INFORMATIONAL request 2 [ N(AUTH_FAILED) ]
Jun 18 16:42:37 11[NET] sending packet: from 192.0.0.2[34981] to 82.xxx.xx.xxx[4500] (96 bytes)

11[CFG] looking for peer configs matching 82.xxx.xx.xxx[%any]...80.xxx.xxx.xx[user1]
11[CFG] selected peer config 'ikev2-mobile-defaults'  
11[IKE] initiating EAP_IDENTITY method (id 0x00)
11[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
11[IKE] peer supports MOBIKE
11[IKE] authentication of '82-xx-xx-xxx.nip.io' (myself) with RSA_EMSA_PKCS1_SHA2_256 successful  
11[IKE] sending end entity cert "CN=82-xx-xx-xxx.nip.io"  
11[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]
11[NET] sending packet: from 82.xxx.xx.xxx[4500] to 80.xxx.xxx.xx[6456] (1200 bytes)
16[NET] received packet: from 80.xxx.xxx.xx[6456] to 82.xxx.xx.xxx[4500] (96 bytes)
16[ENC] parsed INFORMATIONAL request 2 [ N(AUTH_FAILED) ]
16[ENC] generating INFORMATIONAL response 2 [ N(AUTH_FAILED) ]
16[NET] sending packet: from 82.xxx.xx.xxx[4500] to 80.xxx.xxx.xx[6456] (96 bytes)
14[KNL] creating delete job for CHILD_SA ESP/0xc9b64a20/82.xxx.xx.xxx
14[JOB] CHILD_SA ESP/0xc9b64a20/82.xxx.xx.xxx not found for delete
12[KNL] creating delete job for CHILD_SA ESP/0x99af92f8/94.31.91.57
12[JOB] CHILD_SA ESP/0x99af92f8/94.31.91.57 not found for delete

table ip nat {

        define VPN_NETS = {
        192.168.188.0/24
        }
        # fuer VPN Client Pakete ins Internet masquerade ausser VPN Netzwerke
        chain postrouting {
                type nat hook postrouting priority 100; policy accept;
                oifname ens6 ip daddr $VPN_NETS accept
                ip saddr 172.25.25.0/24 oif ens6 masquerade
        }

pools {
  pool-ipv4 {
    addrs = 172.25.25.0/24
    dns = 192.168.188.10
    }
  } 

Linux et9x00 3.8.7 #1 SMP Fri Jan 1 16:50:51 UTC 2021 mips GNU/Linux