<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hi guys, <br>
<br>
</p>
<p>I am trying to deploy a VPN server (I choose Openswan flavor) into a systemd-nspawn container on a raspberry pi running Arch Linux. For now I can login into the container, ping, goes outside from within the container (I managed to bring Internet in it).</p>
<p><br>
</p>
<p>Here is my systemd config file for my container. (override.conf)</p>
<p></p>
<p></p>
<pre><code><span style="font-family: "Courier New",monospace;">[Service]
ExecStart=
ExecStart=/usr/bin/systemd-nspawn \
--quiet --keep-unit --boot --link-journal=try-guest \
</span><span style="font-family: "Courier New",monospace;"> -D /usr/lib/machines/%I</span><span style="font-family: "Courier New",monospace;"> \</span><br><span style="font-family: "Courier New",monospace;"> --machine=%I</span></code><br><span></span><br><div align="left"><span style="font-family: Calibri,Arial,Helvetica,sans-serif;">And here my openswan.nspawn file:</span><br></div><br><span style="font-family: "Courier New",monospace;">[Exec]</span><br><br><div><span style="font-family: "Courier New",monospace;">Capability=CAP_NET_ADMIN CAP_NET_BIND_SERVICE</span><br><br><span style="font-family: "Courier New",monospace;">[Network]</span><br><span style="font-family: "Courier New",monospace;">Private=yes</span><br><span style="font-family: "Courier New",monospace;">VirtualEthernet=yes</span><br><span style="font-family: "Courier New",monospace;">Port=udp:500:500</span><br><span style="font-family: "Courier New",monospace;">Port=udp:4500:4500</span><br><span style="font-family: "Courier New",monospace;">Port=udp:1701:1701</span><br><span style="font-family: "Courier New",monospace;">Port=tcp:500:500</span><br><span style="font-family: "Courier New",monospace;">Port=tcp:4500:4500</span><br><br><span style="font-family: Calibri,Arial,Helvetica,sans-serif;">From this part, I can successfully launch openswan and forward traffic from the host (raspberry-pi) into the container. <br><br>But, once I launch the VPN establishment using my smartphone, pluto is crashing with the following message.<br><br><div><span style="font-family: "Courier New",monospace;">"L2TP-PSK-NAT"[1] 178.50.79.197 #1: ABORT at /build/openswan/src/openswan-2.6.47/programs/pluto/keys.c:488</span><br><span style="font-family: "Courier New",monospace;">"L2TP-PSK-NAT"[1] 178.50.79.197 #1: ABORT at /build/openswan/src/openswan-2.6.47/programs/pluto/keys.c:488</span><br><br>So, my question is: is Openswan able to run into a systemd-container ? I know that strongswan can, but I don't want to use it...<br><br>You will find all related openswan configuration's files attached to this mail. I give you also a tcpdump capture run into the container.<br><br></div>My version of Openswan: <span>Linux Openswan U2.6.47/K4.4.13-2-ARCH (netkey)</span><br><br></span><br>Thanks a lot for support.<img style="vertical-align: bottom;" class="EmojiInsert" alt="😊" src="cid:35c98374-37a5-4cad-a67f-7c9ca8d5f61e"></div></pre>
<p></p>
<p><br>
</p>
<p><br>
</p>
</div>
</body>
</html>