8 ms·

StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

141 points by spaceboy 10y ago

baby 10y ago
With the 4000 LOC Wireguard https://www.wireguard.io/ https://www.wireguard.io/ what are the incentives to continue using IPsec or Strongswan?
- drdaeman 10y ago
  Because IPSec is natively supported by many OSes out-of-box, while Wireguard doesn't seem to have even third-party packages for many systems?
  - baby 10y ago
    Sure, but if you care about security you won't mind installing it.
    - JustSomeNobody 10y ago
      I don't see an iOS client.
    - q3k 10y ago
      I don't think I can install Wireguard on my Cisco ASAs or Juniper SRXes..?
    - drdaeman 10y ago
      Install what? I can install it on GNU/Linux machines. But there are no Android[1], Windows or macOS or iOS packages. [1] Well, it's theoretically possible to build a custom kernel for some devices, and manage VPN from terminal, but I'm not sure many would enjoy it this way.
    - derefr 10y ago
      You don't get to install software if you only control your end of the tunnel — because the other end is either a proprietary appliance (e.g. a Cisco router; an AWS Virtual Private Gateway) or someone else's computer (e.g. some other org you're peering an [semi-isolated] part of your network with for a shared project.)
    - discreditable 10y ago
      WireGuard is not production ready. > Warning: WireGuard is currently under heavy development, and therefore any installation steps here should be considered as experimental. Please do not rely on WireGuard at this stage. We are rapidly working toward a first release that we will consider secure and ready for widespread usage, but that time has not yet come. https://www.wireguard.io/install/ https://www.wireguard.io/install/
- JustSomeNobody 10y ago
  Can you clarify the point about the LOC? I don't understand why that would matter. Oh, and where is Wireguard supported out of the box like IPsec is?
  - baby 10y ago
    https://twitter.com/lyon01_david/status/827918656562720769 https://twitter.com/lyon01_david/status/827918656562720769
    - JustSomeNobody 10y ago
      So, less code automagically makes it better. Ok.
      - orf 10y ago
        Don't be flippant. Less LOC means that the code is easier to audit, unlike large and older codebases. Easily audited code is good for security.
        vetinari 10y ago
        It also means, that the functionality may not be there yet. For example, Strongswan, OpenVPN etc have already solved assignment of client IPs, with Wireguard you have to allocate them by hand in the config (good luck managing several hundreds of them). Strongswan, OpenVPN, etc have no problem operating the server with dynamic IP (you just create DNS record for the end point and update it, whenever the IP changes), with Wireguard you must define the server IP by hand and when it changes, you must change the config and reload it. Stuff like these is also a reason, why Strongswan, OpenVPN, etc have bigger LOC. I'm not saying that Wireguard is something bad, it just must go through a growing period, where it will gain additional LOC.
        orf 10y ago
        So, more code automagically makes it better. Ok.
- cthalupa 10y ago
  Because I need something that is natively supported on phones and can be set to 'always on' on managed iOS devices.
- binalpatel 10y ago
  You work in an industry like healthcare where it's IPSEC or bust for any tunneling.
- danesparza 10y ago
  Well, considering Wireguard says on their website "WireGuard is not yet complete. You should not rely on this code" ... I think the burden is on you to justify the comparison in the first place.
- danudey 10y ago
  For L2TP-over-IPSec, support for mobile devices, like iOS/Android, and relative simplicity of configuration for users (e.g. through provisioning profiles).
- rkeene2 10y ago
  StrongSWAN (and IPSec in general) supports smartcards. WireGuard does not. I've setup StrongSWAN using smartcards almost 15 years ago, at the time it was the only open source IPSec client that supported it. It was relatively easy to get going (the server was a Cisco VPN appliance, which I managed and it was relatively easy to extract the relevant IKE profiles).
dkhenry 10y ago
When I was looking to replace my OpenVPN server for a cloud based VPN one thing I wanted was to use the OS native VPN solution. Everything pointed me to L2TP/IPSec, I am wondering why I would choose IKEv2 over that.
- cthalupa 10y ago
  It's very good for mobile devices - it should fairly seamlessly reconnect when transitioning between networks/cell towers/etc
- laura2013 10y ago
  ikev2 is a key exchange protocol within IPSec (you may use pre-shared keys instead).
- teilo 10y ago
  First off, IKEv2 is IPSec. IPSec tunnels are either IKEv1 or IKEv2. The advantages: * It has a streamlined/faster key negotiation protocol. IKEv2 tunnels can be established in a fraction of the time it takes for IKEv1 negotiation, especially when negotiating multiple SAs. * More robust integrity algorithms which can detect and re-establish a tunnel faster. * It supports EAP, so in client/server mode (vs. tunnel mode) you can attach it to an AAA server to assign IP addresses and do user authentication, making L2TP and shared secrets unnecessary. (Note that when using IKEv2 for IPSec tunnels, one still must use either a shared secret or certificates for authentication.)
- fulafel 10y ago
  IKE is the protocol that negotiates the metadata for the IPsec connection. The encapsulated traffic itself is then carried IPsec's ESP protocol. (Technically you can also skip IKE and manually configure thesymmetric keys and parameters, using eg setkey from Linux ipsec-tools)
falcolas 10y ago
I've seen this implemented quite usefully in a corporate environment and for container-container communication; but attempting to set it up for my personal use was an absolute disaster. A bit over a week spent trying to make it work, and it never did. OpenVPN worked just fine, but I could never make StrongSwan work at all. Which is a shame, I really wanted to have an easy-to-use VPN for my phone and so forth. Settled on OpenVPN, which worked well enough with the iOS clients.
- terrywang 10y ago
  OpenVPN is SSL VPN, relatively easy to setup, it operates in transport layer. strongSwan (IPsec) works in layer 3. To properly install and configure strongSwan, following the tutorials available over the Nnternet is not enough. One needs to have basic networking knowledge (NAT, iptables in particular), good understanding of IPsec protocol suite (including IKE, AH, ESP), PKI, Linux skills and etc. This is a good reference but still needs the knowledge mentioned above to get it to work: https://raymii.org/s/tutorials/IPSEC_vpn_with_Ubuntu_16.04.html https://raymii.org/s/tutorials/IPSEC_vpn_with_Ubuntu_16.04.h...
  - MichaelGG 10y ago
    OpenVPN isn't really an SSL VPN. In one of the major modes (preshared key), TLS isn't used at all. In client-server mode, TLS is only used for session negotiation (keys, options, user/pass) and the rest goes over their own protocol and doesn't use TLS at all. And even then it isn't TLS over TCP directly, but TLS over OpenVPN's own protocol. For whatever reason, OpenVPN is way easier to get up and running. Little knowledge required. UDP overhead is minimal. t. Recently implemented an OpenVPN client from scratch.
    - terrywang 10y ago
      Thanks for pointing out, good insight. Haven't really done a deep dive for OpenVPN as strongSwan works perfectly fine for pretty much all my use cases. However, strongSwan (IPsec) is easy to block (e.g. if detected by big brother - GFW in China) as by default is uses UDP ports 500, 4500, while OpenVPN can easily disguise as SSL/TLS or anything. In that sense, OpenVPN can be a backup for IPsec for remote access (fighting censorship).
1_player 10y ago
StrongSwan is a real powerhorse, even though a bit of a b*tch to configure to work out-of-the-box on most platforms. The documentation is scarce and the wiki was a bit out of date IIRC. I'm using it on my VPS, with my Mac as a client to bypass the UK big brother, and on Android to bypass tethering blocks (in conjunction with the Tether app)
- Florin_Andrei 10y ago
  For site-to-site PSK tunnels it's really trivial to setup. Just install the package, copy/paste a config from the docs, add the PSK on both sides, and start the service. Wham, bam, thank you ma'am, you're done.
  - nikanj 10y ago
    And if it doesn't work, there's plenty of forum posts available listing the same symptoms. No solutions usually, but at least you're not suffering alone!
equalunique 10y ago
I'd only use StrongSwan if an OpenBSD gateway is not an option. Configuring IPsec IKEv2 on OpenBSD is very simple.
- softwarelimits 10y ago
  I would like to try that instead of a Linux implementation - it would be a great help if you would like to link to some (working) tutorials... of course I found something on search engines, but I expect to find many outdated things (as always with these kind of knowledge), so a link to THE right thing would be a very lovely shortcut. Thanks!
- kchoudhu 10y ago
  Yeah, I moved over to OpenBSD from FreeBSD because of their no-bullshit approach to supporting IPSEC -- everything just worked out of the box. I was thrilled when FreeBSD added IPSEC support in 11-RELEASE, but was less excited to learn that IPSEC_NAT_T wasn't compiled in, making it impossible to use strongswan. Oh well, maybe in 11.1 :)
  - gonzo 10y ago
    > I was thrilled when FreeBSD added IPSEC support in 11-RELEASE You're welcome.
- deleted 10y ago
  [deleted]
post_break 10y ago
I could never get this to work. Tried for quite a while and just gave up.
terrywang 10y ago
strongSwan is the best free and open source IPsec implementation available on Linux, (much better than libreswan...), good documentation, use cases and examples etc, good quality of code (less bugs - that's what we've found running it in production for 2+ years with 500+ instances deployed) actively developed and maintained by a group of passionate developers that knows the stuff well. Personally I've been using strongSwan since its 5.0.x for remote access - protect privacy and fight censorship (yes, originally from China where the infamous GFW is deployed...). The native strongSwan client for Android is also a killer feature worth mentioning, RSA authentication with X509 certificates works flawlessly with 1 click ;-) My company (pre-IPO startup) has been using strongSwan for 2+ years as site-to-site solution from AWS VPC to on-premises data centres (or other cloud virtual network), with 500+ instances deployed, track record has proved it reliable as long as it's properly configured (most outages were caused by AWS maintenance ;-) The only drawback is that strongSwan currently does NOT have a mature HA solution but it's shaping up (5.4.0 introduced IKEv2 redirect). We are currently building a custom HA solution (designed to work in VPC - provide similar redundancy to AWS VPN but a lot more flexible and controllable) using strongSwan (have to use route-based as syncing 2 policy based instances are too hard or impossible). NOTE: I've seen people mentioned L2TP, it is obsolete. L2TP does NOT provide encryption or confidentiality to traffic passes through it. L2TP/IPsec encapsulates data twice at layer 2, it has pros and cons. See this (may be out-dated) -> https://www.bestvpn.com/blog/4147/pptp-vs-l2tp-vs-openvpn-vs-sstp-vs-ikev2/ https://www.bestvpn.com/blog/4147/pptp-vs-l2tp-vs-openvpn-vs... IKEv{1,2} + IPsec (ESP) (tunnel mode) with PFS for both ike and esp is recommended configuration. As mentioned in another comment: To properly install and configure strongSwan, following the tutorials available over the Internet is not enough, it requires good networking knowledge (NAT, iptables in particular), understanding of IPsec protocol suite (including IKE, AH, ESP), PKI, Linux skills and etc. A good reference to start with: https://raymii.org/s/tutorials/IPSEC_vpn_with_Ubuntu_16.04.html https://raymii.org/s/tutorials/IPSEC_vpn_with_Ubuntu_16.04.h...
- Florin_Andrei 10y ago
  Yup, it's the most actively maintained branch of all the XXXswan projects. My experience has been that it's trivial to setup for site-to-site IPSec tunnels using PSK. It's literally install the package, copy a config file from the docs, start the service, done. I've been using it in scenarios like this for a while, works great even when the remote ends of the tunnel are something else (Cisco appliances, AWS VPN endpoints, etc). I'm a little less sure how to implement it as a VPN endpoint for employees. There are two main issues here: 1. Having to support a variety of clients (Android, iOS, Mac OS X - perhaps also Windows and Linux) 2. Doing multifactor authentication in a way that works well Especially when considering #1 and #2 together, it seems difficult to meet all demands. How to do multifactor in a way that works with many different clients? I don't much care what the "factors" are as long as they are "multi". E.g. certificate + individual password. If I only had to support, say, user/pass authentication, I think that would be somewhat easily doable. Any clues?
tamalsaha001 10y ago
We use Strongswan to secure host to host connections using pre-shared key when setting up Kubernetes clusters in simple VPS providers like DigitalOcean. This is important since DO, Linode etc does not provide private network. Flannel works with it transparently to provide a Kubernetes-aware ip network. You can see our work here: https://github.com/appscode/swanc https://github.com/appscode/swanc
- justinsaccount 10y ago
  That's pretty cool. I've considered doing things like that to set up a secure overlay network to lock down a 'sort of' private l2 network. Any reason you didn't use weave?
  - tamalsaha001 10y ago
    I have never tried Weave. But StrongSwan sets up host to host tunnel using Ikev2. So, it should probably work with weave. If you find problems, please let me know in github issues.
    - justinsaccount 10y ago
      Ah.. weave has built in encryption, so you would probably use that by itself.
- terrywang 10y ago
  Containerization is cool, however, if you use policy-based VPN, how do you address the use case with more than 1 strongSwan instance (container) running on the same host, obviously sharing the same host Linux kernel.
windexh8er 10y ago
Seeing all the complaints in here of how hard this is to setup brings back memories. I was the lead consultant on a project between a very large US retailer and Centrify to build a product called DirectSecure. It's generally very easy to deploy IPsec policy in a Windows environment via GPO and the customer wanted that to flow down into their nix environments. Centrify, having good hooks in to AD already, was chosen to build a product that did just the same thing in their nix environments by consuming IPsec configuration out of GPO. While not a sales pitch, and in fact I don't think the product seems to have sold well anyway, it was very interesting to work with them on the test harness we built to validate correct IPsec operations, configuration, validation that data wasn't leaking outside of the SAs that were being provisioned, and performance via the translated policy. The relatable component was this was mainly done against StrongSwan implementations of the IKE daemon if I remember correctly (Linux, AIX and Solaris mainly). I wonder if any of those bits flowed back upstream or if the bolt-on aspect kept that from happening. StrongSwan isn't complex if you are well versed in IPsec implementation as a whole. It's no more or less complicated than other implementation and is "better" than TLS in it's own right with regard to things that could go wrong. In static environments it's relatively painless once the learning curve is overcome. That being said I feel like IPsec has a badge it will never get rid of and people discard it before attempting implementation at this point. Hopefully, as mentioned amongst the comments, things like WireGuard will mature and become more mainstream. I very much like the concept carry over that both IPsec and WireGuard can be silent actors within the network not giving away hosts as things like OpenVPN and SSH do. IPsec can, unfortunately, also be implemented to squawk at spurious connection attempts - but at least doesn't rely on the premise as much as things like OpenVPN and SSH do. And for the record - you can tell someone who's dealt with IPsec extensively since they won't refer to it as IPSec. o_O Microsoft is notorious for getting it wrong.
- dguido 10y ago
  For an easier way, try Algo. Algo is a set of Ansible scripts that helps you deploy a fully functional StrongSwan IPSEC server with the most secure settings available: https://github.com/trailofbits/algo https://github.com/trailofbits/algo It even generates Apple profiles to auto configure your iPhone!
klinquist 10y ago
This works great for me to connect my Meraki MX-series firewall into my AWS VPC.
Nux 10y ago
On the subject of VPNs, if people find *swan or Openvpn difficult to get working, I highly recommend OpenConnect (ocserv); _so_ easy to setup. It's an open source implementation of the Cisco AnyConnect SSL vpn, works great and it's compatible with the AnyConnect clients.
- tehno 10y ago
  Any good Ansible (or other) recipes for this? One I found is [0] but can you point to any others? [0] https://github.com/ftao/vpn-deploy-playbook/tree/master/roles/ocserv https://github.com/ftao/vpn-deploy-playbook/tree/master/role...
  - Nux 10y ago
    No idea, sorry. But doing it manually only takes 5 minutes: http://www.infradead.org/ocserv/recipes-ocserv-configuration-basic.html http://www.infradead.org/ocserv/recipes-ocserv-configuration...
more_corn 10y ago
Good luck getting 2fa working
- mwj 10y ago
  What are you using for 2fa?
justinsaccount 10y ago
One of the reasons ipsec is tricky to understand is it doesn't create virtual interfaces like most other vpn systems on linux. With something like openvpn you can run tcpdump on eth0 / tun0 to figure out what is going on. With ipsec there's no 'ipsec0' interface and the way it works is a little more 'magic'.
peterposter 10y ago
This seems great, but what would I actually use this for? e: Everybody says that using a VPN is a "good thing" but I honestly can't find a use for one in my day-to-day.
- ktta 10y ago
  You really don't have to worry about all this if you're asking. Most people use VPN for security purposes. Now, when I mention security, there's various kinds. It can vary from hiding from state-attackers, to not wanting to be surveilled, to just torrenting stuff to avoiding a nasty letter from your ISP. If you have nothing to worry about in the last paragraph, then the other case is organisational policies or accessibility. Routing all client traffic through a companies server because some companies' internal servers only allow requests from whitelisted IPs and drop all other packets. Of course, as a consumer/employee this is not something you have to worry about but it is something for sysadmins, and/or the security person who makes decisions at a company. And looks like there are a few of those in this thread. Hence all these discussions. If you want to get into using VPNs, I'd suggest getting a server online first, something from digital ocean, AWS or Gcloud. If you want something super cheap, I suggest OVH's VPS. And the best tutorials in my opinion are from Digital Ocean[1]. If you only know how to use Ubuntu, here's[2] what you want. [1]:https://www.digitalocean.com/community/tags/vpn?type=tutorials https://www.digitalocean.com/community/tags/vpn?type=tutoria... [2]: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04 https://www.digitalocean.com/community/tutorials/how-to-set-...
  - thelittleone 10y ago
    Here is a nice tutorial for getting the excellent Streisand privacy server up and running on Digital Ocean. http://jerrygamblin.com/2016/07/10/the-vpn-you-should-be-using/ http://jerrygamblin.com/2016/07/10/the-vpn-you-should-be-usi...
shawkinaw 10y ago
It is indeed a bit of a pain to set up properly, but it can be done, I have a droplet running it 24/7 and have no problems connecting to it from Apple devices. Here are some helpful guides for setting up: https://www.zeitgeist.se/2013/11/22/strongswan-howto-create-your-own-vpn/ https://www.zeitgeist.se/2013/11/22/strongswan-howto-create-... http://www.jfcarter.net/~jimc/documents/strongswan-1308.html http://www.jfcarter.net/~jimc/documents/strongswan-1308.html
- ratherbefuddled 10y ago
  Both of these were immensely helpful resources to me when I did this last month.
ratherbefuddled 10y ago
I set this up a few weeks ago on a linux vps I'm using for dev. IPSEC with IKEV2 and certificates. Native clients on windows 10 and Ubuntu laptop (needed a network-manager plugin to be built), and took the shortcut and used the StrongSwan app on android. The process was complex and there are things I still don't understand but it does work and the documentation and examples are quite comprehensive. The only issue I had with them was they assume a fair amount of familiarity with subjects that I didn't have. I'm mainly a serverside developer not a network admin, and whilst I have a vague understanding of how certs work I didn't have much awareness of VPN protocols or terminology so I had to abuse google pretty thoroughly. It took about a day to do and I had to watch logs from server and client to figure it out, but it was interesting. I'm still pleased with the results and would recommend the product.
fulafel 10y ago
Anyone knows if Docker is using IPsec in some interoperable mode? They say here that they are using IPsec: https://docs.docker.com/engine/userguide/networking/overlay-security-model/ https://docs.docker.com/engine/userguide/networking/overlay-...
pYQAJ6Zm 10y ago
During the past holidays, at my parent’s, I set up some infrastructure to allow remote management of some network equipment and computers. I used to employ OpenVPN for this, but I decided to give IPsec a try. Since I have been learning CentOS, initially I went with RedHat’s suggested option: Libreswan. I tried and tried, yet couldn’t get it to work. Documentation surely was lacking for Libreswan. But then I found Strongswan, and after a few more attempts I managed to set a tunnel as I wanted it. The documentation is much more complete, and the examples were specially helpful. I am baffled by the choice made by RedHat, to use Libreswan as their official IPsec implementation. It gave me a “beta” feel, while Strongswan seems more solid. Plus the difference regarding documentation is like night and day.

141 points by spaceboy 10y ago

baby 10y ago

With the 4000 LOC Wireguard https://www.wireguard.io/ https://www.wireguard.io/ what are the incentives to continue using IPsec or Strongswan?

drdaeman 10y ago
Because IPSec is natively supported by many OSes out-of-box, while Wireguard doesn't seem to have even third-party packages for many systems?
- baby 10y ago
  Sure, but if you care about security you won't mind installing it.
  - JustSomeNobody 10y ago
    I don't see an iOS client.
  - q3k 10y ago
    I don't think I can install Wireguard on my Cisco ASAs or Juniper SRXes..?
  - drdaeman 10y ago
    Install what? I can install it on GNU/Linux machines. But there are no Android[1], Windows or macOS or iOS packages. [1] Well, it's theoretically possible to build a custom kernel for some devices, and manage VPN from terminal, but I'm not sure many would enjoy it this way.
  - derefr 10y ago
    You don't get to install software if you only control your end of the tunnel — because the other end is either a proprietary appliance (e.g. a Cisco router; an AWS Virtual Private Gateway) or someone else's computer (e.g. some other org you're peering an [semi-isolated] part of your network with for a shared project.)
  - discreditable 10y ago
    WireGuard is not production ready. > Warning: WireGuard is currently under heavy development, and therefore any installation steps here should be considered as experimental. Please do not rely on WireGuard at this stage. We are rapidly working toward a first release that we will consider secure and ready for widespread usage, but that time has not yet come. https://www.wireguard.io/install/ https://www.wireguard.io/install/
JustSomeNobody 10y ago
Can you clarify the point about the LOC? I don't understand why that would matter. Oh, and where is Wireguard supported out of the box like IPsec is?
- baby 10y ago
  https://twitter.com/lyon01_david/status/827918656562720769 https://twitter.com/lyon01_david/status/827918656562720769
  - JustSomeNobody 10y ago
    So, less code automagically makes it better. Ok.
    - orf 10y ago
      Don't be flippant. Less LOC means that the code is easier to audit, unlike large and older codebases. Easily audited code is good for security.
      - vetinari 10y ago
        It also means, that the functionality may not be there yet. For example, Strongswan, OpenVPN etc have already solved assignment of client IPs, with Wireguard you have to allocate them by hand in the config (good luck managing several hundreds of them). Strongswan, OpenVPN, etc have no problem operating the server with dynamic IP (you just create DNS record for the end point and update it, whenever the IP changes), with Wireguard you must define the server IP by hand and when it changes, you must change the config and reload it. Stuff like these is also a reason, why Strongswan, OpenVPN, etc have bigger LOC. I'm not saying that Wireguard is something bad, it just must go through a growing period, where it will gain additional LOC.
        orf 10y ago
        So, more code automagically makes it better. Ok.
cthalupa 10y ago
Because I need something that is natively supported on phones and can be set to 'always on' on managed iOS devices.
binalpatel 10y ago
You work in an industry like healthcare where it's IPSEC or bust for any tunneling.
danesparza 10y ago
Well, considering Wireguard says on their website "WireGuard is not yet complete. You should not rely on this code" ... I think the burden is on you to justify the comparison in the first place.
danudey 10y ago
For L2TP-over-IPSec, support for mobile devices, like iOS/Android, and relative simplicity of configuration for users (e.g. through provisioning profiles).
rkeene2 10y ago
StrongSWAN (and IPSec in general) supports smartcards. WireGuard does not. I've setup StrongSWAN using smartcards almost 15 years ago, at the time it was the only open source IPSec client that supported it. It was relatively easy to get going (the server was a Cisco VPN appliance, which I managed and it was relatively easy to extract the relevant IKE profiles).

dkhenry 10y ago

When I was looking to replace my OpenVPN server for a cloud based VPN one thing I wanted was to use the OS native VPN solution. Everything pointed me to L2TP/IPSec, I am wondering why I would choose IKEv2 over that.

cthalupa 10y ago
It's very good for mobile devices - it should fairly seamlessly reconnect when transitioning between networks/cell towers/etc
laura2013 10y ago
ikev2 is a key exchange protocol within IPSec (you may use pre-shared keys instead).
teilo 10y ago
First off, IKEv2 is IPSec. IPSec tunnels are either IKEv1 or IKEv2. The advantages: * It has a streamlined/faster key negotiation protocol. IKEv2 tunnels can be established in a fraction of the time it takes for IKEv1 negotiation, especially when negotiating multiple SAs. * More robust integrity algorithms which can detect and re-establish a tunnel faster. * It supports EAP, so in client/server mode (vs. tunnel mode) you can attach it to an AAA server to assign IP addresses and do user authentication, making L2TP and shared secrets unnecessary. (Note that when using IKEv2 for IPSec tunnels, one still must use either a shared secret or certificates for authentication.)
fulafel 10y ago
IKE is the protocol that negotiates the metadata for the IPsec connection. The encapsulated traffic itself is then carried IPsec's ESP protocol. (Technically you can also skip IKE and manually configure thesymmetric keys and parameters, using eg setkey from Linux ipsec-tools)

falcolas 10y ago

I've seen this implemented quite usefully in a corporate environment and for container-container communication; but attempting to set it up for my personal use was an absolute disaster. A bit over a week spent trying to make it work, and it never did. OpenVPN worked just fine, but I could never make StrongSwan work at all. Which is a shame, I really wanted to have an easy-to-use VPN for my phone and so forth. Settled on OpenVPN, which worked well enough with the iOS clients.

terrywang 10y ago
OpenVPN is SSL VPN, relatively easy to setup, it operates in transport layer. strongSwan (IPsec) works in layer 3. To properly install and configure strongSwan, following the tutorials available over the Nnternet is not enough. One needs to have basic networking knowledge (NAT, iptables in particular), good understanding of IPsec protocol suite (including IKE, AH, ESP), PKI, Linux skills and etc. This is a good reference but still needs the knowledge mentioned above to get it to work: https://raymii.org/s/tutorials/IPSEC_vpn_with_Ubuntu_16.04.html https://raymii.org/s/tutorials/IPSEC_vpn_with_Ubuntu_16.04.h...
- MichaelGG 10y ago
  OpenVPN isn't really an SSL VPN. In one of the major modes (preshared key), TLS isn't used at all. In client-server mode, TLS is only used for session negotiation (keys, options, user/pass) and the rest goes over their own protocol and doesn't use TLS at all. And even then it isn't TLS over TCP directly, but TLS over OpenVPN's own protocol. For whatever reason, OpenVPN is way easier to get up and running. Little knowledge required. UDP overhead is minimal. t. Recently implemented an OpenVPN client from scratch.
  - terrywang 10y ago
    Thanks for pointing out, good insight. Haven't really done a deep dive for OpenVPN as strongSwan works perfectly fine for pretty much all my use cases. However, strongSwan (IPsec) is easy to block (e.g. if detected by big brother - GFW in China) as by default is uses UDP ports 500, 4500, while OpenVPN can easily disguise as SSL/TLS or anything. In that sense, OpenVPN can be a backup for IPsec for remote access (fighting censorship).

1_player 10y ago

StrongSwan is a real powerhorse, even though a bit of a b*tch to configure to work out-of-the-box on most platforms. The documentation is scarce and the wiki was a bit out of date IIRC. I'm using it on my VPS, with my Mac as a client to bypass the UK big brother, and on Android to bypass tethering blocks (in conjunction with the Tether app)

Florin_Andrei 10y ago
For site-to-site PSK tunnels it's really trivial to setup. Just install the package, copy/paste a config from the docs, add the PSK on both sides, and start the service. Wham, bam, thank you ma'am, you're done.
- nikanj 10y ago
  And if it doesn't work, there's plenty of forum posts available listing the same symptoms. No solutions usually, but at least you're not suffering alone!

equalunique 10y ago

I'd only use StrongSwan if an OpenBSD gateway is not an option. Configuring IPsec IKEv2 on OpenBSD is very simple.

softwarelimits 10y ago
I would like to try that instead of a Linux implementation - it would be a great help if you would like to link to some (working) tutorials... of course I found something on search engines, but I expect to find many outdated things (as always with these kind of knowledge), so a link to THE right thing would be a very lovely shortcut. Thanks!
kchoudhu 10y ago
Yeah, I moved over to OpenBSD from FreeBSD because of their no-bullshit approach to supporting IPSEC -- everything just worked out of the box. I was thrilled when FreeBSD added IPSEC support in 11-RELEASE, but was less excited to learn that IPSEC_NAT_T wasn't compiled in, making it impossible to use strongswan. Oh well, maybe in 11.1 :)
- gonzo 10y ago
  > I was thrilled when FreeBSD added IPSEC support in 11-RELEASE You're welcome.
deleted 10y ago
[deleted]

post_break 10y ago

I could never get this to work. Tried for quite a while and just gave up.

terrywang 10y ago

strongSwan is the best free and open source IPsec implementation available on Linux, (much better than libreswan...), good documentation, use cases and examples etc, good quality of code (less bugs - that's what we've found running it in production for 2+ years with 500+ instances deployed) actively developed and maintained by a group of passionate developers that knows the stuff well. Personally I've been using strongSwan since its 5.0.x for remote access - protect privacy and fight censorship (yes, originally from China where the infamous GFW is deployed...). The native strongSwan client for Android is also a killer feature worth mentioning, RSA authentication with X509 certificates works flawlessly with 1 click ;-) My company (pre-IPO startup) has been using strongSwan for 2+ years as site-to-site solution from AWS VPC to on-premises data centres (or other cloud virtual network), with 500+ instances deployed, track record has proved it reliable as long as it's properly configured (most outages were caused by AWS maintenance ;-) The only drawback is that strongSwan currently does NOT have a mature HA solution but it's shaping up (5.4.0 introduced IKEv2 redirect). We are currently building a custom HA solution (designed to work in VPC - provide similar redundancy to AWS VPN but a lot more flexible and controllable) using strongSwan (have to use route-based as syncing 2 policy based instances are too hard or impossible). NOTE: I've seen people mentioned L2TP, it is obsolete. L2TP does NOT provide encryption or confidentiality to traffic passes through it. L2TP/IPsec encapsulates data twice at layer 2, it has pros and cons. See this (may be out-dated) -> https://www.bestvpn.com/blog/4147/pptp-vs-l2tp-vs-openvpn-vs-sstp-vs-ikev2/ https://www.bestvpn.com/blog/4147/pptp-vs-l2tp-vs-openvpn-vs... IKEv{1,2} + IPsec (ESP) (tunnel mode) with PFS for both ike and esp is recommended configuration. As mentioned in another comment: To properly install and configure strongSwan, following the tutorials available over the Internet is not enough, it requires good networking knowledge (NAT, iptables in particular), understanding of IPsec protocol suite (including IKE, AH, ESP), PKI, Linux skills and etc. A good reference to start with: https://raymii.org/s/tutorials/IPSEC_vpn_with_Ubuntu_16.04.html https://raymii.org/s/tutorials/IPSEC_vpn_with_Ubuntu_16.04.h...

Florin_Andrei 10y ago
Yup, it's the most actively maintained branch of all the XXXswan projects. My experience has been that it's trivial to setup for site-to-site IPSec tunnels using PSK. It's literally install the package, copy a config file from the docs, start the service, done. I've been using it in scenarios like this for a while, works great even when the remote ends of the tunnel are something else (Cisco appliances, AWS VPN endpoints, etc). I'm a little less sure how to implement it as a VPN endpoint for employees. There are two main issues here: 1. Having to support a variety of clients (Android, iOS, Mac OS X - perhaps also Windows and Linux) 2. Doing multifactor authentication in a way that works well Especially when considering #1 and #2 together, it seems difficult to meet all demands. How to do multifactor in a way that works with many different clients? I don't much care what the "factors" are as long as they are "multi". E.g. certificate + individual password. If I only had to support, say, user/pass authentication, I think that would be somewhat easily doable. Any clues?

tamalsaha001 10y ago

We use Strongswan to secure host to host connections using pre-shared key when setting up Kubernetes clusters in simple VPS providers like DigitalOcean. This is important since DO, Linode etc does not provide private network. Flannel works with it transparently to provide a Kubernetes-aware ip network. You can see our work here: https://github.com/appscode/swanc https://github.com/appscode/swanc

justinsaccount 10y ago
That's pretty cool. I've considered doing things like that to set up a secure overlay network to lock down a 'sort of' private l2 network. Any reason you didn't use weave?
- tamalsaha001 10y ago
  I have never tried Weave. But StrongSwan sets up host to host tunnel using Ikev2. So, it should probably work with weave. If you find problems, please let me know in github issues.
  - justinsaccount 10y ago
    Ah.. weave has built in encryption, so you would probably use that by itself.
terrywang 10y ago
Containerization is cool, however, if you use policy-based VPN, how do you address the use case with more than 1 strongSwan instance (container) running on the same host, obviously sharing the same host Linux kernel.

windexh8er 10y ago

Seeing all the complaints in here of how hard this is to setup brings back memories. I was the lead consultant on a project between a very large US retailer and Centrify to build a product called DirectSecure. It's generally very easy to deploy IPsec policy in a Windows environment via GPO and the customer wanted that to flow down into their nix environments. Centrify, having good hooks in to AD already, was chosen to build a product that did just the same thing in their nix environments by consuming IPsec configuration out of GPO. While not a sales pitch, and in fact I don't think the product seems to have sold well anyway, it was very interesting to work with them on the test harness we built to validate correct IPsec operations, configuration, validation that data wasn't leaking outside of the SAs that were being provisioned, and performance via the translated policy. The relatable component was this was mainly done against StrongSwan implementations of the IKE daemon if I remember correctly (Linux, AIX and Solaris mainly). I wonder if any of those bits flowed back upstream or if the bolt-on aspect kept that from happening. StrongSwan isn't complex if you are well versed in IPsec implementation as a whole. It's no more or less complicated than other implementation and is "better" than TLS in it's own right with regard to things that could go wrong. In static environments it's relatively painless once the learning curve is overcome. That being said I feel like IPsec has a badge it will never get rid of and people discard it before attempting implementation at this point. Hopefully, as mentioned amongst the comments, things like WireGuard will mature and become more mainstream. I very much like the concept carry over that both IPsec and WireGuard can be silent actors within the network not giving away hosts as things like OpenVPN and SSH do. IPsec can, unfortunately, also be implemented to squawk at spurious connection attempts - but at least doesn't rely on the premise as much as things like OpenVPN and SSH do. And for the record - you can tell someone who's dealt with IPsec extensively since they won't refer to it as IPSec. o_O Microsoft is notorious for getting it wrong.

dguido 10y ago
For an easier way, try Algo. Algo is a set of Ansible scripts that helps you deploy a fully functional StrongSwan IPSEC server with the most secure settings available: https://github.com/trailofbits/algo https://github.com/trailofbits/algo It even generates Apple profiles to auto configure your iPhone!

klinquist 10y ago

This works great for me to connect my Meraki MX-series firewall into my AWS VPC.

Nux 10y ago

On the subject of VPNs, if people find *swan or Openvpn difficult to get working, I highly recommend OpenConnect (ocserv); _so_ easy to setup. It's an open source implementation of the Cisco AnyConnect SSL vpn, works great and it's compatible with the AnyConnect clients.

tehno 10y ago
Any good Ansible (or other) recipes for this? One I found is [0] but can you point to any others? [0] https://github.com/ftao/vpn-deploy-playbook/tree/master/roles/ocserv https://github.com/ftao/vpn-deploy-playbook/tree/master/role...
- Nux 10y ago
  No idea, sorry. But doing it manually only takes 5 minutes: http://www.infradead.org/ocserv/recipes-ocserv-configuration-basic.html http://www.infradead.org/ocserv/recipes-ocserv-configuration...

more_corn 10y ago

Good luck getting 2fa working

mwj 10y ago
What are you using for 2fa?

justinsaccount 10y ago

One of the reasons ipsec is tricky to understand is it doesn't create virtual interfaces like most other vpn systems on linux. With something like openvpn you can run tcpdump on eth0 / tun0 to figure out what is going on. With ipsec there's no 'ipsec0' interface and the way it works is a little more 'magic'.

peterposter 10y ago

This seems great, but what would I actually use this for? e: Everybody says that using a VPN is a "good thing" but I honestly can't find a use for one in my day-to-day.

ktta 10y ago
You really don't have to worry about all this if you're asking. Most people use VPN for security purposes. Now, when I mention security, there's various kinds. It can vary from hiding from state-attackers, to not wanting to be surveilled, to just torrenting stuff to avoiding a nasty letter from your ISP. If you have nothing to worry about in the last paragraph, then the other case is organisational policies or accessibility. Routing all client traffic through a companies server because some companies' internal servers only allow requests from whitelisted IPs and drop all other packets. Of course, as a consumer/employee this is not something you have to worry about but it is something for sysadmins, and/or the security person who makes decisions at a company. And looks like there are a few of those in this thread. Hence all these discussions. If you want to get into using VPNs, I'd suggest getting a server online first, something from digital ocean, AWS or Gcloud. If you want something super cheap, I suggest OVH's VPS. And the best tutorials in my opinion are from Digital Ocean[1]. If you only know how to use Ubuntu, here's[2] what you want. [1]:https://www.digitalocean.com/community/tags/vpn?type=tutorials https://www.digitalocean.com/community/tags/vpn?type=tutoria... [2]: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04 https://www.digitalocean.com/community/tutorials/how-to-set-...
- thelittleone 10y ago
  Here is a nice tutorial for getting the excellent Streisand privacy server up and running on Digital Ocean. http://jerrygamblin.com/2016/07/10/the-vpn-you-should-be-using/ http://jerrygamblin.com/2016/07/10/the-vpn-you-should-be-usi...

shawkinaw 10y ago

It is indeed a bit of a pain to set up properly, but it can be done, I have a droplet running it 24/7 and have no problems connecting to it from Apple devices. Here are some helpful guides for setting up: https://www.zeitgeist.se/2013/11/22/strongswan-howto-create-your-own-vpn/ https://www.zeitgeist.se/2013/11/22/strongswan-howto-create-... http://www.jfcarter.net/~jimc/documents/strongswan-1308.html http://www.jfcarter.net/~jimc/documents/strongswan-1308.html

ratherbefuddled 10y ago
Both of these were immensely helpful resources to me when I did this last month.

ratherbefuddled 10y ago

I set this up a few weeks ago on a linux vps I'm using for dev. IPSEC with IKEV2 and certificates. Native clients on windows 10 and Ubuntu laptop (needed a network-manager plugin to be built), and took the shortcut and used the StrongSwan app on android. The process was complex and there are things I still don't understand but it does work and the documentation and examples are quite comprehensive. The only issue I had with them was they assume a fair amount of familiarity with subjects that I didn't have. I'm mainly a serverside developer not a network admin, and whilst I have a vague understanding of how certs work I didn't have much awareness of VPN protocols or terminology so I had to abuse google pretty thoroughly. It took about a day to do and I had to watch logs from server and client to figure it out, but it was interesting. I'm still pleased with the results and would recommend the product.

fulafel 10y ago

Anyone knows if Docker is using IPsec in some interoperable mode? They say here that they are using IPsec: https://docs.docker.com/engine/userguide/networking/overlay-security-model/ https://docs.docker.com/engine/userguide/networking/overlay-...

pYQAJ6Zm 10y ago

During the past holidays, at my parent’s, I set up some infrastructure to allow remote management of some network equipment and computers. I used to employ OpenVPN for this, but I decided to give IPsec a try. Since I have been learning CentOS, initially I went with RedHat’s suggested option: Libreswan. I tried and tried, yet couldn’t get it to work. Documentation surely was lacking for Libreswan. But then I found Strongswan, and after a few more attempts I managed to set a tunnel as I wanted it. The documentation is much more complete, and the examples were specially helpful. I am baffled by the choice made by RedHat, to use Libreswan as their official IPsec implementation. It gave me a “beta” feel, while Strongswan seems more solid. Plus the difference regarding documentation is like night and day.