when I try to start IPsec service on Vero 4K it tells me right before the service is failing:
ipsec start
Starting strongSwan 5.5.1 IPsec [starter]...
no netkey IPsec stack detected
no KLIPS IPsec stack detected
no known IPsec stack detected, ignoring!
Same configuration on Raspi with OSMC installed works like a charm. Thus assuming this is likely related to the backported 3.x kernel. If yes, is there a workaround available or is this going to be fixed with the 4.x kernel?
Unfortunately the problem seems to be more general. systemctl status strongswan tells me after a restart:
<...>
osmc ipsec[7408]: 00[CFG] loading secrets from '/etc/ipsec.secrets'
osmc ipsec[7408]: 00[CFG] loaded EAP secret for vero
osmc ipsec[7408]: 00[CFG] loaded 0 RADIUS server configurations
osmc ipsec[7408]: 00[CFG] HA config misses local/remote address
osmc ipsec[7408]: 00[LIB] failed to load 1 critical plugin feature
osmc ipsec[7408]: 00[DMN] initialization failed - aborting charon
osmc ipsec[7408]: 00[KNL] received netlink error: Address family not supported by protocol (97)
osmc ipsec[7408]: charon has quit: initialization failed
<...>
Accordingly ipsec statusall doesn’t produce any output at all. What surprises me is the Address family not supported by protocol (97). Not sure if this could be related to having added IPv6-support to the network interfaces.
Thanks for offering help. It doesn’t look good, since essentially none of the 12 listed modules can be loaded:
modprobe: FATAL: Module ah4 not found in directory /lib/modules/3.14.29-126-osmc
modprobe: FATAL: Module ah6 not found in directory /lib/modules/3.14.29-126-osmc
modprobe: FATAL: Module esp4 not found in directory /lib/modules/3.14.29-126-osmc
modprobe: FATAL: Module esp6 not found in directory /lib/modules/3.14.29-126-osmc
modprobe: FATAL: Module xfrm4_tunnel not found in directory /lib/modules/3.14.29-126-osmc
modprobe: FATAL: Module xfrm6_tunnel not found in directory /lib/modules/3.14.29-126-osmc
modprobe: FATAL: Module xfrm_user not found in directory /lib/modules/3.14.29-126-osmc
modprobe: FATAL: Module tunnel not found in directory /lib/modules/3.14.29-126-osmc
modprobe: FATAL: Module tunnel6 not found in directory /lib/modules/3.14.29-126-osmc
modprobe: FATAL: Module xfrm4_mode_tunnel not found in directory /lib/modules/3.14.29-126-osmc
modprobe: FATAL: Module xfrm6_mode_tunnel not found in directory /lib/modules/3.14.29-126-osmc
Correspondingly the suggested script produces this:
# CONFIG_XFRM_USER is not set
# CONFIG_NET_KEY is not set
CONFIG_INET=y
CONFIG_IP_ADVANCED_ROUTER=y
CONFIG_IP_MULTIPLE_TABLES=y
# CONFIG_INET_AH is not set
# CONFIG_INET_ESP is not set
# CONFIG_INET_IPCOMP is not set
# CONFIG_INET_XFRM_MODE_TRANSPORT is not set
# CONFIG_INET_XFRM_MODE_TUNNEL is not set
# CONFIG_INET_XFRM_MODE_BEET is not set
CONFIG_IPV6=y
# CONFIG_INET6_AH is not set
# CONFIG_INET6_ESP is not set
# CONFIG_INET6_IPCOMP is not set
# CONFIG_INET6_XFRM_MODE_TRANSPORT is not set
# CONFIG_INET6_XFRM_MODE_TUNNEL is not set
# CONFIG_INET6_XFRM_MODE_BEET is not set
# CONFIG_IPV6_MULTIPLE_TABLES is not set
CONFIG_NETFILTER=y
CONFIG_NETFILTER_XTABLES=m
Any chance to have the missing modules included soon?
Add the following line: deb http://apt.osmc.tv stretch-devel main
Run the following commands to update: sudo apt-get update && sudo apt-get dist-upgrade && reboot
Your system should have have received the update.
Please see if the issue is resolved.
I also recommend you edit /etc/apt/sources.list again and remove the line that you added after updating. This will return you to the normal update channel.
from a first glance it looks good, i.e. IPsec tunnel can be established manually.
Unfortunately auto start during boot still fails. Obviously (systemd) dependency to networking is still missing, as the initial DNS query for the VPN server fails.
Somewhat confusing is also still the output from modprobe and the config check:
modprobe: FATAL: Module tunnel not found <...>
CONFIG_NETFILTER_XT_MATCH_POLICY is not set
Anyhow thanks a lot for the very quick and competent support!
thanks for fixing the missing module. Most likely your are right that strongswan needs to depend on connman-wait-for-network.
Currently with strongswan enabled at boot time systemctl status strongswan tells me right after login
osmc charon[573]: 17[LIB] resolving '***.net' failed: Name or service not known
osmc charon[573]: 05[IKE] unable to resolve ***.net, initiate aborted
As expected following a systemctl restart strongswan everything works fine. Hence could you please also fix this dependency / let me know what needs to be done there?