AWS-EC2: How to run
douglasoliveiraadv opened this issue · 0 comments
Hi,
I'm using a virtual machine on aws.
I run docker run -d --cap-add NET_ADMIN -p 500:500/udp -p 4500:4500/udp -p 1701:1701/tcp -p 1195:1194/udp -p 5555:5555/tcp siomiz/softethervpn
But it does not work, I can't connect with my client:
Aug 15 15:51:30 douglas-IPMH81G1 org.mate.panel.applet.MateMenuAppletFactory[1488]: [2282:2282:0815/155130.279484:ERROR:buffer_manager.cc(488)] [.DisplayCompositor]GL ERROR :GL_INVALID_OPERATION : glBufferData: <- error from previous GL command
Aug 15 15:52:45 douglas-IPMH81G1 NetworkManager[762]: [1565895165.5728] audit: op="connection-activate" uuid="fe5131ea-e8a2-40b5-a475-887dee7f930b" name="MV L2TP/IPsec" pid=1707 uid=1000 result="success"
Aug 15 15:52:45 douglas-IPMH81G1 NetworkManager[762]: [1565895165.5798] vpn-connection[0x555e65058120,fe5131ea-e8a2-40b5-a475-887dee7f930b,"MV L2TP/IPsec",0]: Started the VPN service, PID 16428
Aug 15 15:52:45 douglas-IPMH81G1 NetworkManager[762]: [1565895165.5875] vpn-connection[0x555e65058120,fe5131ea-e8a2-40b5-a475-887dee7f930b,"MV L2TP/IPsec",0]: Saw the service appear; activating connection
Aug 15 15:52:45 douglas-IPMH81G1 NetworkManager[762]: [1565895165.5917] vpn-connection[0x555e65058120,fe5131ea-e8a2-40b5-a475-887dee7f930b,"MV L2TP/IPsec",0]: VPN connection: (ConnectInteractive) reply received
Aug 15 15:52:45 douglas-IPMH81G1 nm-l2tp-service[16428]: Check port 1701
Aug 15 15:52:45 douglas-IPMH81G1 NetworkManager[762]: Stopping strongSwan IPsec failed: starter is not running
Aug 15 15:52:47 douglas-IPMH81G1 NetworkManager[762]: Starting strongSwan 5.6.2 IPsec [starter]...
Aug 15 15:52:47 douglas-IPMH81G1 NetworkManager[762]: Loading config setup
Aug 15 15:52:47 douglas-IPMH81G1 NetworkManager[762]: Loading conn 'fe5131ea-e8a2-40b5-a475-887dee7f930b'
Aug 15 15:52:47 douglas-IPMH81G1 NetworkManager[762]: found netkey IPsec stack
Aug 15 15:52:47 douglas-IPMH81G1 charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.6.2, Linux 4.15.0-58-generic, x86_64)
Aug 15 15:52:47 douglas-IPMH81G1 charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
Aug 15 15:52:47 douglas-IPMH81G1 charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
Aug 15 15:52:47 douglas-IPMH81G1 charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
Aug 15 15:52:47 douglas-IPMH81G1 charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
Aug 15 15:52:47 douglas-IPMH81G1 charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'
Aug 15 15:52:47 douglas-IPMH81G1 charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'
Aug 15 15:52:47 douglas-IPMH81G1 charon: 00[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-fe5131ea-e8a2-40b5-a475-887dee7f930b.secrets'
Aug 15 15:52:47 douglas-IPMH81G1 charon: 00[CFG] loaded IKE secret for %any
Aug 15 15:52:47 douglas-IPMH81G1 charon: 00[LIB] loaded plugins: charon aesni aes rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown eap-mschapv2 xauth-generic counters
Aug 15 15:52:47 douglas-IPMH81G1 charon: 00[LIB] dropped capabilities, running as uid 0, gid 0
Aug 15 15:52:47 douglas-IPMH81G1 charon: 00[JOB] spawning 16 worker threads
Aug 15 15:52:47 douglas-IPMH81G1 charon: 05[CFG] received stroke: add connection 'fe5131ea-e8a2-40b5-a475-887dee7f930b'
Aug 15 15:52:47 douglas-IPMH81G1 charon: 05[CFG] added configuration 'fe5131ea-e8a2-40b5-a475-887dee7f930b'
Aug 15 15:52:48 douglas-IPMH81G1 charon: 07[CFG] rereading secrets
Aug 15 15:52:48 douglas-IPMH81G1 charon: 07[CFG] loading secrets from '/etc/ipsec.secrets'
Aug 15 15:52:48 douglas-IPMH81G1 charon: 07[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-fe5131ea-e8a2-40b5-a475-887dee7f930b.secrets'
Aug 15 15:52:48 douglas-IPMH81G1 charon: 07[CFG] loaded IKE secret for %any
Aug 15 15:52:48 douglas-IPMH81G1 charon: 09[CFG] received stroke: initiate 'fe5131ea-e8a2-40b5-a475-887dee7f930b'
Aug 15 15:52:48 douglas-IPMH81G1 charon: 11[IKE] initiating Main Mode IKE_SA fe5131ea-e8a2-40b5-a475-887dee7f930b[1] to 18.228.xx.xxx
Aug 15 15:52:48 douglas-IPMH81G1 charon: 11[ENC] generating ID_PROT request 0 [ SA V V V V V ]
Aug 15 15:52:48 douglas-IPMH81G1 charon: 11[NET] sending packet: from 192.168.88.157[500] to 18.228.xx.xxx[500] (204 bytes)
Aug 15 15:52:52 douglas-IPMH81G1 charon: 13[IKE] sending retransmit 1 of request message ID 0, seq 1
Aug 15 15:52:52 douglas-IPMH81G1 charon: 13[NET] sending packet: from 192.168.88.157[500] to 18.228.xx.xxx[500] (204 bytes)
Aug 15 15:52:58 douglas-IPMH81G1 NetworkManager[762]: Stopping strongSwan IPsec...
Aug 15 15:52:58 douglas-IPMH81G1 charon: 00[DMN] signal of type SIGINT received. Shutting down
Aug 15 15:52:58 douglas-IPMH81G1 charon: 00[IKE] destroying IKE_SA in state CONNECTING without notification
Aug 15 15:52:58 douglas-IPMH81G1 NetworkManager[762]: initiating Main Mode IKE_SA fe5131ea-e8a2-40b5-a475-887dee7f930b[1] to 18.228.xx.xxx
Aug 15 15:52:58 douglas-IPMH81G1 NetworkManager[762]: generating ID_PROT request 0 [ SA V V V V V ]
Aug 15 15:52:58 douglas-IPMH81G1 NetworkManager[762]: sending packet: from 192.168.88.157[500] to 18.228.xx.xxx[500] (204 bytes)
Aug 15 15:52:58 douglas-IPMH81G1 NetworkManager[762]: sending retransmit 1 of request message ID 0, seq 1
Aug 15 15:52:58 douglas-IPMH81G1 NetworkManager[762]: sending packet: from 192.168.88.157[500] to 18.228.xx.xxx[500] (204 bytes)
Aug 15 15:52:58 douglas-IPMH81G1 NetworkManager[762]: destroying IKE_SA in state CONNECTING without notification
Aug 15 15:52:58 douglas-IPMH81G1 nm-l2tp-service[16428]: g_dbus_method_invocation_take_error: assertion 'error != NULL' failed
Aug 15 15:52:58 douglas-IPMH81G1 NetworkManager[762]: [1565895178.7631] vpn-connection[0x555e65058120,fe5131ea-e8a2-40b5-a475-887dee7f930b,"MV L2TP/IPsec",0]: VPN plugin: state changed: stopped (6)
Aug 15 15:52:58 douglas-IPMH81G1 NetworkManager[762]: [1565895178.7669] vpn-connection[0x555e65058120,fe5131ea-e8a2-40b5-a475-887dee7f930b,"MV L2TP/IPsec",0]: VPN service disappeared
Aug 15 15:52:58 douglas-IPMH81G1 NetworkManager[762]: [1565895178.7677] vpn-connection[0x555e65058120,fe5131ea-e8a2-40b5-a475-887dee7f930b,"MV L2TP/IPsec",0]: VPN connection: failed to connect: 'Message recipient disconnected from message bus without replying'
Aug 15 15:53:04 douglas-IPMH81G1 NetworkManager[762]: [1565895184.0725] settings-connection[0x555e64fb3530,fe5131ea-e8a2-40b5-a475-887dee7f930b]: write: successfully commited (keyfile: update /etc/NetworkManager/system-connections/MV L2TP*IPsec (fe5131ea-e8a2-40b5-a475-887dee7f930b,"MV L2TP/IPsec"))
`
Here my iptables on the host (virtual machine):
`Chain INPUT (policy DROP)
target prot opt source destination
ufw-before-logging-input all -- anywhere anywhere
ufw-before-input all -- anywhere anywhere
ufw-after-input all -- anywhere anywhere
ufw-after-logging-input all -- anywhere anywhere
ufw-reject-input all -- anywhere anywhere
ufw-track-input all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy DROP)
target prot opt source destination
DOCKER-USER all -- anywhere anywhere
DOCKER-ISOLATION-STAGE-1 all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ufw-before-logging-forward all -- anywhere anywhere
ufw-before-forward all -- anywhere anywhere
ufw-after-forward all -- anywhere anywhere
ufw-after-logging-forward all -- anywhere anywhere
ufw-reject-forward all -- anywhere anywhere
ufw-track-forward all -- anywhere anywhere
TCPMSS tcp -- ip-10-99-99-0.sa-east-1.compute.internal/24 anywhere tcp flags:FIN,SYN,RST,ACK/SYN TCPMSS set 1356
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
TCPMSS tcp -- ip-10-99-99-0.sa-east-1.compute.internal/24 anywhere tcp flags:FIN,SYN,RST,ACK/SYN TCPMSS set 1356
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ufw-before-logging-output all -- anywhere anywhere
ufw-before-output all -- anywhere anywhere
ufw-after-output all -- anywhere anywhere
ufw-after-logging-output all -- anywhere anywhere
ufw-reject-output all -- anywhere anywhere
ufw-track-output all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain DOCKER (2 references)
target prot opt source destination
ACCEPT udp -- anywhere ip-172-20-20-2.sa-east-1.compute.internal udp dpt:openvpn
ACCEPT tcp -- anywhere ip-172-20-20-3.sa-east-1.compute.internal tcp dpt:82
ACCEPT tcp -- anywhere ip-172-20-20-3.sa-east-1.compute.internal tcp dpt:81
ACCEPT tcp -- anywhere ip-172-20-20-3.sa-east-1.compute.internal tcp dpt:http
ACCEPT tcp -- anywhere ip-172-17-0-2.sa-east-1.compute.internal tcp dpt:5555
ACCEPT udp -- anywhere ip-172-17-0-2.sa-east-1.compute.internal udp dpt:ipsec-nat-t
ACCEPT tcp -- anywhere ip-172-17-0-2.sa-east-1.compute.internal tcp dpt:l2f
ACCEPT udp -- anywhere ip-172-17-0-2.sa-east-1.compute.internal udp dpt:openvpn
ACCEPT udp -- anywhere ip-172-17-0-2.sa-east-1.compute.internal udp dpt:isakmp
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target prot opt source destination
DOCKER-ISOLATION-STAGE-2 all -- anywhere anywhere
DOCKER-ISOLATION-STAGE-2 all -- anywhere anywhere
RETURN all -- anywhere anywhere
Chain DOCKER-ISOLATION-STAGE-2 (2 references)
target prot opt source destination
DROP all -- anywhere anywhere
DROP all -- anywhere anywhere
RETURN all -- anywhere anywhere
Chain DOCKER-USER (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain ufw-after-forward (1 references)
target prot opt source destination
Chain ufw-after-input (1 references)
target prot opt source destination
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-ns
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:netbios-dgm
ufw-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:netbios-ssn
ufw-skip-to-policy-input tcp -- anywhere anywhere tcp dpt:microsoft-ds
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:bootps
ufw-skip-to-policy-input udp -- anywhere anywhere udp dpt:bootpc
ufw-skip-to-policy-input all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST
Chain ufw-after-logging-forward (1 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "
Chain ufw-after-logging-input (1 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "
Chain ufw-after-logging-output (1 references)
target prot opt source destination
Chain ufw-after-output (1 references)
target prot opt source destination
Chain ufw-before-forward (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
ACCEPT icmp -- anywhere anywhere icmp echo-request
ufw-user-forward all -- anywhere anywhere
Chain ufw-before-input (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ufw-logging-deny all -- anywhere anywhere ctstate INVALID
DROP all -- anywhere anywhere ctstate INVALID
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc
ufw-not-local all -- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
ACCEPT udp -- anywhere 239.255.255.250 udp dpt:1900
ufw-user-input all -- anywhere anywhere
Chain ufw-before-logging-forward (1 references)
target prot opt source destination
Chain ufw-before-logging-input (1 references)
target prot opt source destination
Chain ufw-before-logging-output (1 references)
target prot opt source destination
Chain ufw-before-output (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ufw-user-output all -- anywhere anywhere
Chain ufw-logging-allow (0 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW ALLOW] "
Chain ufw-logging-deny (2 references)
target prot opt source destination
RETURN all -- anywhere anywhere ctstate INVALID limit: avg 3/min burst 10
LOG all -- anywhere anywhere limit: avg 3/min burst 10 LOG level warning prefix "[UFW BLOCK] "
Chain ufw-not-local (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere ADDRTYPE match dst-type LOCAL
RETURN all -- anywhere anywhere ADDRTYPE match dst-type MULTICAST
RETURN all -- anywhere anywhere ADDRTYPE match dst-type BROADCAST
ufw-logging-deny all -- anywhere anywhere limit: avg 3/min burst 10
DROP all -- anywhere anywhere
Chain ufw-reject-forward (1 references)
target prot opt source destination
Chain ufw-reject-input (1 references)
target prot opt source destination
Chain ufw-reject-output (1 references)
target prot opt source destination
Chain ufw-skip-to-policy-forward (0 references)
target prot opt source destination
DROP all -- anywhere anywhere
Chain ufw-skip-to-policy-input (7 references)
target prot opt source destination
DROP all -- anywhere anywhere
Chain ufw-skip-to-policy-output (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain ufw-track-forward (1 references)
target prot opt source destination
Chain ufw-track-input (1 references)
target prot opt source destination
Chain ufw-track-output (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere ctstate NEW
ACCEPT udp -- anywhere anywhere ctstate NEW
Chain ufw-user-forward (1 references)
target prot opt source destination
Chain ufw-user-input (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:http /* 'dapp_Nginx%20HTTP' /
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh / 'dapp_OpenSSH' */
Chain ufw-user-limit (0 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning prefix "[UFW LIMIT BLOCK] "
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain ufw-user-limit-accept (0 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
Chain ufw-user-logging-forward (0 references)
target prot opt source destination
Chain ufw-user-logging-input (0 references)
target prot opt source destination
Chain ufw-user-logging-output (0 references)
target prot opt source destination
Chain ufw-user-output (1 references)
target prot opt source destination`
Thank you all!