Arch Linux User Repository

ipsec verify shows some errors.

$ ipsec verify                                                                                                               
/usr/bin/ipsec: /usr/lib/ipsec/verify: /usr/bin/python23: bad interpreter: No such file or directory
/usr/bin/ipsec: line 531: /usr/lib/ipsec/verify: Success

Compile with nss 3.51 then you can immediately upgrade to nss 3.52. The nss 3.52 headers are the problem. nss 3.51 headers work for nss 3.52.

@defts : THANKS !

@defts is a lifesaver. As mentioned in https://github.com/libreswan/libreswan/issues/342 nss needs to be downgraded. In my case I have downgraded from nss 3.52.1 to nss 3.51.1-1 and rebuilt libreswan. This fixes the issue.

@squalou @oddy

same issue here
for a quick fix, you can downgrade nss to 3.51 and rebuild libreswan

downgrade nss 
yay --rebuild libreswan

i post that reponse here https://github.com/libreswan/libreswan/issues/342

issue here too with l2tp psk, and libreswan 3.32-1

Job for ipsec.service failed because a fatal signal was delivered causing the control process to dump core.

ipsec fails to start

downgrading do 3.31-1 ... does not help so far :( previous versions do not compile anymore

=> move to strongswan instead, which works in my case

the latest update of libreswan, 3.32-1 breaks XAUTH VPN for me with an exception

May 20 17:35:18 miniattic pluto[4467]: ABORT: ASSERTION FAILED: test_gcm_vectors(&ike_alg_encrypt_aes_gcm_16, aes_gcm_tests) (in test_ike_alg() at ike_alg_test.c:41)

This means I can no longer work from home. I will try to downgrade the package. I do not know if it's an upstream issue or not.

@tapia @tatumkhamun thanks.

I can connect to VPN again if I either switch to strongswan or adapt the phase 1 algorithm settings.

Unfortunately I am still not able to ssh into machines on the VPN. Although mounting network drives from the VPN does work...

I also had to change Identity → PPP Settings... → MTU to a value of 1200 to be able to use SSH again.

@heapifyman I meant adapting the phase1 algorithm setting.

@heapify that is the strongswan I downloaded. The only other package I had installed was networkmanager-l2tp so that it interfaced with the network manager. Everything else was then plugin and play.