6.9. Configuring TCP fallback for an IPsec VPN connection

Procedure

1. Edit the /etc/ipsec.conf file, and make the following changes in the config setup section:

   1. Configure Libreswan to listen on a TCP port:

      listen-tcp=yes

   2. By default, Libreswan listens on port 4500. If you want to use a different port, enter:

      tcp-remoteport=<port_number>

   3. Decide whether TCP should be used as a fallback option if UDP is not available or permanent:

      • As a fallback option, enter:

        enable-tcp=fallback
        retransmit-timeout=5s

        By default, Libreswan waits 60 seconds after a failed attempt to connect by using UDP before retrying the connection over TCP. Lowering the retransmit-timeout value shortens the delay, enabling the fallback protocol to initiate more quickly.

      • As a permanent replacement for UDP, enter:

        enable-tcp=yes

2. Restart the ipsec service:

   # systemctl restart ipsec

3. If you configured a TCP port other than the default 4500, open the port in the firewall:

   # firewall-cmd --permanent --add-port=<tcp_port>/tcp
   # firewall-cmd --reload

4. Repeat the procedure on the peers that use this gateway.