address=46.28.xxx.xxx local-address=31.134.xxx.xxx passive=no port=500
send-initial-contact=no nat-traversal=no hash-algorithm=sha1
enc-algorithm=3des,aes-128,aes-256 dh-group=modp1024 lifetime=8h
src-address=31.134.xxx.xxx/32 src-port=any dst-address=46.28.xxx.xxx/32
dst-port=any protocol=all action=encrypt level=require
ipsec-protocols=esp tunnel=yes sa-src-address=31.134.xxx.xxx
sa-dst-address=46.28.xxx.xxx proposal=default priority=0
version 2 # conforms to second version of ipsec.conf specification
#in what directory should things started by setup (notably the Pluto daemon) be allowed to dump core?
#whether to accept/offer to support NAT (NAPT, also known as "IP Masqurade") workaround for IPsec
#contains the networks that are allowed as subnet= for the remote client. In other words, the address ranges that may live behind a NAT router through whi$
#decide which protocol stack is going to be used.
# Send a keep-alive packet every 60 seconds.
#shared secret. Use rsasig for certificates.
#the ipsec tunnel should be started and routes created when the ipsec daemon itself starts.
#Only negotiate a conn. 3 times.
# specifies the phase 1 encryption scheme, the hashing algorithm, and the diffie-hellman group. The modp1024 is for Diffie-Hellman 2. Why 'modp' instead o$
#because we use l2tp as tunnel protocol
#fill in server IP above
# Dead Peer Dectection (RFC 3706) keepalives delay
# length of time (in seconds) we will idle without hearing either an R_U_THERE poll from our peer, or an R_U_THERE_ACK reply.
# When a DPD enabled peer is declared dead, what action should be taken. clear means the eroute and SA with both be cleared.
не могу найти логов openswan, позже выложу.