| Age | Commit message (Collapse) | Author | Lines |
|---|
|
YE1 intermediate cert was inflating IKE_AUTH response to 1776 bytes,
causing it to be split into 2 IKE fragments that iOS/Android clients
could not reassemble. Both iOS and Android 12 (Beam Pro) have
Let's Encrypt trust chain in their system store, so the intermediate
cert is not needed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
Logs to /home/yyamashita/vpn-logs/charon.log (readable without root)
to diagnose iPhone IKEv2 connection failures.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
fragmentation=no caused IP-level fragmentation (1808-byte packets) which is
blocked by mobile networks. Default IKE fragmentation (RFC 7383) works for
iOS/macOS with 2 fragments.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
fragment_size=0 was interpreted as minimum fragment size (resulting in
4 tiny fragments), not disabled. fragmentation=no in swanctl.conf is
the correct per-connection setting to disable IKE fragmentation entirely.
The server now sends a single large UDP packet; the OS kernel handles
IP fragmentation instead of the IKE layer.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
Android (XREAL Beam Pro) fails to reassemble IKE fragments even though
FRAG_SUP is negotiated. IP-level fragmentation (handled by the OS kernel)
works better. Removing the intermediate cert broke macOS/iOS.
This config:
- Sends leaf cert + YE1 intermediate (so any client can verify the chain)
- fragment_size=0 disables IKE fragmentation; the 1776-byte IKE_AUTH
response is sent as one large UDP packet (OS handles IP fragmentation)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
Android (XREAL Beam Pro) can't validate the server cert because it lacks
the Let's Encrypt YE1 hierarchy in its system trust store. The fix:
- Serve YE1 cert at https://vpn.yyamashita.com/ca.pem via Caddy
- Android VPN profile: set CA certificate to this downloaded cert
- install.sh / renew-cert.sh now extract and copy YE1 to caddy dir
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
Android (XREAL Beam Pro) advertises FRAG_SUP but fails to reassemble
IKE fragments. The IKE_AUTH response was 1776 bytes (leaf + YE1 intermediate)
requiring fragmentation into 2 packets. Without x509ca mount, only the leaf
cert is sent (~886 bytes total), fitting in a single packet without fragmentation.
Android fetches the intermediate CA (YE1) via AIA extension before tunnel setup.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
- swanctl.conf.tpl: send_cert = always (fix Android cert verification failure)
- docker-compose.yml: mount intermediate CAs to /etc/swanctl/x509ca/
- install.sh: split server.crt into leaf + chain for proper chain distribution
- entrypoint.sh: run charon directly for Docker log visibility,
fix sysctl error handling, fix charon binary path
- strongswan.conf: increase IKE log level to 4 for debugging
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
network_mode: host では /proc/sys への書き込みが制限されるため、
sysctl の失敗を無視してホスト側の設定値を確認するよう変更。
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
- vpn/: Dockerfile, docker-compose.yml, swanctl.conf.tpl, entrypoint.sh
- install.sh: Caddy 証明書流用 + コンテナ起動
- renew-cert.sh: 証明書更新 + swanctl ホットリロード
- caddy/Caddyfile: vpn.yyamashita.com 追加（Let's Encrypt 証明書取得用）
- post-receive: vpn/deploy.sh を追加
- setup-route53.py: WEB_SUBDOMAINS に vpn を追加
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
