Настройка VPN Ubuntu 15.10

Dec  9 15:16:30 user-VirtualBox charon: 05[IKE] IKE_SA rw[5] state change: CONNECTING => ESTABLISHED
Dec  9 15:16:30 user-VirtualBox charon: 05[IKE] scheduling reauthentication in 3346s
Dec  9 15:16:30 user-VirtualBox charon: 05[IKE] maximum IKE_SA lifetime 3526s
Dec  9 15:16:30 user-VirtualBox charon: 05[IKE] sending end entity cert "C=ua, ST=ua, O=ua, OU=ua, CN=ua, E=uaua"
Dec  9 15:16:30 user-VirtualBox charon: 05[IKE] peer requested virtual IP %any
Dec  9 15:16:30 user-VirtualBox charon: 05[IKE] assigning virtual IP 20.1.1.2 to peer 'C=ua, ST=ua, O=ua, OU=client, CN=client, E=ua'
Dec  9 15:16:30 user-VirtualBox charon: 05[IKE] no acceptable proposal found
Dec  9 15:16:30 user-VirtualBox charon: 05[IKE] failed to establish CHILD_SA, keeping IKE_SA
Dec  9 15:16:30 user-VirtualBox charon: 05[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH CPRP(ADDR) N(AUTH_LFT) N(MOBIKE_SUP) N(NO_ADD_ADDR) N(NO_PROP) ]

config setup  # данная секция определяет базовые параметры
       strictcrlpolicy=no
       charondebug="ike 2, knl 3, cfg 0"
conn %default  # определяет базовые параметры всех IPSEC-соединений
     ikelifetime=60m
     keylife=20m
     rekeymargin=3m
     keyingtries=1
     dpdaction=restart
     dpddelay=30s
     dpdtimeout=180s
conn rw # название IPSEC-соединения
  left=192.168.180.210 # адрес внешнего интерфейса
  leftauth=pubkey # говорим, что мы авторизуемся у клиент с помощью сертификата RSA
  right=%any # к нам можно подключиться с любого IP
  rightauth=pubkey # клиент авторизуется у нас по сертификату RSA
  rightsourceip=20.1.1.1/12  # из этого пула будет выдаваться IP-адрес для клиента
  auto=add # подключение будет инициироваться клиентом
  keyexchange=ikev2
  type=tunnel

charon {
    load_modular = curl test-vectors aes des sha1 sha2 md5 pem pkcs1 gmp random x509 revocation hmac xcbc cmac ctr ccm gcm stroke kernel-netlink socket-default updown eap-identity
}

HOME            = .
RANDFILE        = $ENV::HOME/.rnd
# Extra OBJECT IDENTIFIER info:
#oid_file       = $ENV::HOME/.oid
oid_section     = new_oids
[ new_oids ]
tsa_policy1 = 1.2.3.4.1
tsa_policy2 = 1.2.3.4.5.6
tsa_policy3 = 1.2.3.4.5.7
####################################################################
[ ca ]
default_ca  = CA_default        # The default ca section
####################################################################
[ CA_default ]
 
dir     = /usr/local/etc/ipsec.d # Where everything is kept
certs       = $dir/certs        # Where the issued certs are kept
crl_dir     = $dir/crl      # Where the issued crl are kept
database    = $dir/index.txt    # database index file.
new_certs_dir   = $dir/newcerts     # default place for new certs.
certificate = $dir/cacerts/strongswanCert.pem   # The CA certificate
serial      = $dir/serial       # The current serial number
crlnumber   = $dir/crlnumber    
crl     = $dir/crl.pem      # The current CRL
private_key = $dir/private/strongswanKey.pem# The private key
RANDFILE    = $dir/private/.rand    # private random number file
#subjectAltName=IP:192.168.180.210
x509_extensions = usr_cert      # The extentions to add to the cert
 
# Comment out the following two lines for the "traditional"
# (and highly broken) format.
name_opt    = ca_default        # Subject Name options
cert_opt    = ca_default        # Certificate field options
default_days    = 365           # how long to certify for
default_crl_days= 30            # how long before next CRL
default_md  = default       # use public key default MD
preserve    = no            # keep passed DN ordering
policy      = policy_match
# For the CA policy
[ policy_match ]
countryName     = match
stateOrProvinceName = match
organizationName    = match
organizationalUnitName  = optional
commonName      = supplied
emailAddress        = optional
[ policy_anything ]
countryName     = optional
stateOrProvinceName = optional
localityName        = optional
organizationName    = optional
organizationalUnitName  = optional
commonName      = supplied
emailAddress        = optional
[ req ]
default_bits        = 2048
default_keyfile     = privkey.pem
distinguished_name  = req_distinguished_name
attributes      = req_attributes
x509_extensions = v3_ca # The extentions to add to the self signed cert
string_mask = utf8only
[ req_distinguished_name ]
countryName         = Country Name (2 letter code)
countryName_default     = AU
countryName_min         = 2
countryName_max         = 2
stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = Some-State
 
localityName            = Locality Name (eg, city)
 
0.organizationName      = Organization Name (eg, company)
0.organizationName_default  = Internet Widgits Pty Ltd
organizationalUnitName      = Organizational Unit Name (eg, section)
 
commonName          = Common Name (e.g. server FQDN or YOUR name)
commonName_max          = 64
 
emailAddress            = Email Address
emailAddress_max        = 64
 
# SET-ex3           = SET extension number 3
 
[ req_attributes ]
challengePassword       = A challenge password
challengePassword_min       = 4
challengePassword_max       = 20
 
unstructuredName        = An optional company name
 
[ usr_cert ]
basicConstraints=CA:FALSE
nsComment           = "OpenSSL Generated Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
 
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
 
[ v3_ca ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = CA:true
[ crl_ext ]
authorityKeyIdentifier=keyid:always
 
[ proxy_cert_ext ]
basicConstraints=CA:FALSE
nsComment           = "OpenSSL Generated Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
[ tsa ]
 
default_tsa = tsa_config1   # the default TSA section
 
[ tsa_config1 ]
 
# These are used by the TSA reply generation only.
dir     = ./demoCA      # TSA root directory
serial      = $dir/tsaserial    # The current serial number (mandatory)
crypto_device   = builtin       # OpenSSL engine to use for signing
signer_cert = $dir/tsacert.pem  # The TSA signing certificate
                    # (optional)
certs       = $dir/cacert.pem   # Certificate chain to include in reply
                    # (optional)
signer_key  = $dir/private/tsakey.pem # The TSA private key (optional)
 
default_policy  = tsa_policy1       # Policy if request did not specify it
                    # (optional)
other_policies  = tsa_policy2, tsa_policy3  # acceptable policies (optional)
digests     = md5, sha1     # Acceptable message digests (mandatory)
accuracy    = secs:1, millisecs:500, microsecs:100  # (optional)
clock_precision_digits  = 0 # number of digits after dot. (optional)
ordering        = yes   # Is ordering defined for timestamps?
                # (optional, default: no)
tsa_name        = yes   # Must the TSA name be included in the reply?
                # (optional, default: no)
ess_cert_id_chain   = no    # Must the ESS cert id chain be included?
                # (optional, default: no)