Запуск команды IPSec зависает

Я пытаюсь установить VPN-соединение между двумя регионами в AWS EC2 (две виртуальные машины) с помощью StrongSwan в Docker. Однако при попытке установить соединение я получаю массу ошибок.

Команды sudo ipsec start --nofork и sudo ipsec restart выдают следующие ошибки, соответственно:

Starting strongSwan 5.3.5 IPsec [starter]...
ipsec_starter[374]: Starting strongSwan 5.3.5 IPsec [starter]...

00[LIB] expanding file pattern '/etc/strongswan.d/charon/*.conf' failed: Permission denied
00[LIB] expanding file pattern '/etc/strongswan.d/*.conf' failed: Permission denied
00[DMN] Starting IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-1065-aws, x86_64)
00[LIB] feature CUSTOM:libcharon in critical plugin 'charon' has unmet dependency: NONCE_GEN
00[LIB] feature CUSTOM:libcharon-receiver in critical plugin 'charon' has unmet dependency: HASHER:HASH_SHA1
00[LIB] feature CUSTOM:libcharon-sa-managers in critical plugin 
'charon' has unmet dependency: HASHER:HASH_SHA1 00[LIB] failed to load 3 critical plugin features
00[DMN] initialization failed - aborting charon
charon has quit: initialization failed
ipsec_starter[374]: charon has quit: initialization failed

charon refused to be started
ipsec_starter[374]: charon refused to be started

ipsec starter stopped
ipsec_starter[374]: ipsec starter stopped

и

Stopping strongSwan IPsec failed: starter is not running
Starting strongSwan 5.3.5 IPsec [starter]...
ipsec_starter[389]: Starting strongSwan 5.3.5 IPsec [starter]...

root@b65e01b190f6:/etc# ipsec_starter[408]: charon has quit: 
initialization failed

ipsec_starter[408]: charon refused to be started

ipsec_starter[408]: ipsec starter stopped

(второй зависает после последней команды и должен быть закрыт с помощью Ctrl + C)

Чтобы исправить некоторые ошибки, я закомментировал строку:

load_modular = yes

в файле:

/etc/strongswan.conf

Сейчас выполняется тот же вывод команд:

Starting strongSwan 5.3.5 IPsec [starter]...
ipsec_starter[413]: Starting strongSwan 5.3.5 IPsec [starter]...

00[LIB] expanding file pattern '/etc/strongswan.d/charon/*.conf' failed: Permission denied
00[LIB] expanding file pattern '/etc/strongswan.d/*.conf' failed: Permission denied
00[DMN] Starting IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-1065-aws, x86_64)
00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
00[LIB] opening directory '/etc/ipsec.d/cacerts' failed: Permission denied
00[CFG]   reading directory failed
00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
00[LIB] opening directory '/etc/ipsec.d/aacerts' failed: Permission denied
00[CFG]   reading directory failed
00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
00[LIB] opening directory '/etc/ipsec.d/ocspcerts' failed: Permission denied
00[CFG]   reading directory failed
00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
00[LIB] opening directory '/etc/ipsec.d/acerts' failed: Permission denied
00[CFG]   reading directory failed
00[CFG] loading crls from '/etc/ipsec.d/crls'
00[LIB] opening directory '/etc/ipsec.d/crls' failed: Permission denied
00[CFG]   reading directory failed
00[CFG] loading secrets from '/etc/ipsec.secrets'
00[CFG]   loaded IKE secret for B.B.B.B X.X.X.X
00[LIB] loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac ccm gcm attr kernel-netlink resolve socket-default connmark stroke updown
00[LIB] dropped capabilities, running as uid 0, gid 0
00[JOB] spawning 16 worker threads
charon (426) started after 20 ms
ipsec_starter[413]: charon (426) started after 20 ms

11[CFG] received stroke: add connection 'A-to-B'
11[CFG] left nor right host is our side, assuming left=local
11[CFG] algorithm 'sha_256' not recognized
11[CFG] skipped invalid proposal string: aes256-sha_256-modp1024
11[CFG] added configuration 'A-to-B'
13[CFG] received stroke: initiate 'A-to-B'
13[IKE] initiating IKE_SA A-to-B[1] to X.X.X.X
13[IKE] configured DH group MODP_NONE not supported
13[MGR] tried to check-in and delete nonexisting IKE_SA

и

Stopping strongSwan IPsec failed: starter is not running
Starting strongSwan 5.3.5 IPsec [starter]...
ipsec_starter[444]: Starting strongSwan 5.3.5 IPsec [starter]...

root@b65e01b190f6:/etc# ipsec_starter[463]: charon (464) started after 20 ms

Теперь обе команды зависают, поэтому я не уверен, помогло ли вообще комментирование этой строки.

шаблон расширяющегося файла '/etc/strongswan.d/charon/*.conf' завершился неудачно: строки Permission denied , вероятно, вызывают многие из моих ошибок, но я не знаю, как это исправить, так как я я уже root в Docker.

Я также включаю часть своего Dockerfile, если это может помочь:

FROM ubuntu:16.04

RUN apt update && apt install -y --no-install-recommends apt-utils
RUN apt -y install sudo
RUN apt upgrade -y
RUN apt install strongswan -y
RUN apt install nano -y
RUN apt install openssh-client -y
RUN apt install kmod
RUN echo "IdentityFile ~/.ssh/id_rsa" >> /etc/ssh/ssh_config
RUN sudo rm /etc/ipsec.conf
RUN touch /etc/ipsec.conf
RUN echo "# basic configuration" >> /etc/ipsec.conf \
    && echo "config setup" >> /etc/ipsec.conf \
    && echo '    charondebug="all"' >> /etc/ipsec.conf \
    && echo "    uniqueids=yes" >> /etc/ipsec.conf \
    && echo "    strictcrlpolicy=no" >> /etc/ipsec.conf \
    && echo "" >> /etc/ipsec.conf \
    && echo "conn A-to-B" >> /etc/ipsec.conf \
    && echo "    authby=secret" >> /etc/ipsec.conf \
    && echo "    left=A.A.A.A" >> /etc/ipsec.conf \
    && echo "    leftid=B.B.B.B" >> /etc/ipsec.conf \
    && echo "    leftsubnet=A.C.C.C/16" >> /etc/ipsec.conf \
    && echo "    right=X.X.X.X" >> /etc/ipsec.conf \
    && echo "    rightsubnet=Y.Y.Y.Y/16" >> /etc/ipsec.conf \
    && echo "    ike=aes256-sha_256-modp1024!" >> /etc/ipsec.conf \
    && echo "    esp=aes256-sha2_256!" >> /etc/ipsec.conf \
    && echo "    keyingtries=0" >> /etc/ipsec.conf \
    && echo "    ikelifetime=1h" >> /etc/ipsec.conf \
    && echo "    lifetime=8h" >> /etc/ipsec.conf \
    && echo "    dpddelay=30" >> /etc/ipsec.conf \
    && echo "    dpdtimeout=120" >> /etc/ipsec.conf \
    && echo "    dpdaction=restart" >> /etc/ipsec.conf \
    && echo "    auto=start" >> /etc/ipsec.conf
RUN sudo rm /etc/ipsec.secrets
RUN touch /etc/ipsec.secrets
RUN echo "'B.B.B.B X.X.X.X : PSK "mykey"' >> /etc/ipsec.secrets
RUN echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
RUN sudo sysctl -p /etc/sysctl.conf

Dockerfile на другом экземпляре почти то же самое, но с замененными IP-адресами.

РЕДАКТИРОВАТЬ: ОБНОВЛЕНИЕ (НЕ ЧАСТЬ ОРИГИНАЛЬНОГО ВОПРОСА)

Я переключил алгоритмы шифрования, потому что mod1024 недостаточно силен для стандартов strongSwan. Сейчас я использую:

ike=aes128gcm16-prfsha256-ecp256,aes256gcm16-prfsha384-ecp384!
esp=aes128gcm16-ecp256,aes256gcm16-ecp384!

, и это исправило несколько ошибок. Я также использовал команду:

sudo docker run -itv ~:/mnt/ nameHere bash

, но добавил тег - cap-add = NET_ADMIN , и все ошибки предварительного подключения исчезли. Однако при попытке подключения возникает новая ошибка, при которой время ожидания соединения прерывается после 5 попыток.

root@aaaaaaaaaa:/etc# sudo ipsec start --nofork
Starting strongSwan 5.3.5 IPsec [starter]...
ipsec_starter[482]: Starting strongSwan 5.3.5 IPsec [starter]...

00[DMN] Starting IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-1065-aws, x86_64)
00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
00[CFG] loading crls from '/etc/ipsec.d/crls'
00[CFG] loading secrets from '/etc/ipsec.secrets'
00[CFG]   loaded IKE secret for X.X.X.X Y.Y.Y.Y
00[LIB] loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown
00[LIB] dropped capabilities, running as uid 0, gid 0
00[JOB] spawning 16 worker threads
charon (495) started after 20 ms
ipsec_starter[482]: charon (495) started after 20 ms

11[CFG] received stroke: add connection 'A-to-B'
11[CFG] left nor right host is our side, assuming left=local
11[CFG] added configuration 'A-to-B'
13[CFG] received stroke: initiate 'A-to-B'
13[IKE] initiating IKE_SA A-to-B[1] to Y.Y.Y.Y
13[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HASH_ALG) ]
13[NET] sending packet: from X.X.X.X[500] to Y.Y.Y.Y[500] (284 bytes)
10[NET] error writing to socket: Invalid argument
15[IKE] retransmit 1 of request with message ID 0
15[NET] sending packet: from X.X.X.X (private ip)[500] to Y.Y.Y.Y (public ip of other connection)[500] (284 bytes)
10[NET] error writing to socket: Invalid argument
.
.
.
04[IKE] retransmit 5 of request with message ID 0
04[NET] sending packet: from X.X.X.X (private ip)[500] to Y.Y.Y.Y (public ip of other connection)[500] (284 bytes)
10[NET] error writing to socket: Invalid argument
03[IKE] giving up after 5 retransmits
03[IKE] establishing IKE_SA failed, peer not responding

И теперь он висит здесь, пока я не убью его другим CTRL + C. Любые идеи очень приветствуются.