Good luck getting 2fa working
StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows
51–60 of 77 posts
Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows
#52StrongSwan is a real powerhorse, even though a bit of a b*tch to configure to work out-of-the-box on most platforms. The documentation is scarce and the wiki was a bit out of date IIRC. I'm using it on my VPS, with my Mac as a client to bypass the UK big brother, and on Android to bypass tethering blocks (in conjunction with the Tether app)
For site-to-site PSK tunnels it's really trivial to setup. Just install the package, copy/paste a config from the docs, add the PSK on both sides, and start the service. Wham, bam, thank you ma'am, you're done.
And if it doesn't work, there's plenty of forum posts available listing the same symptoms. No solutions usually, but at least you're not suffering alone!
Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows
#53Good luck getting 2fa working
What are you using for 2fa?
Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows
#54One of the reasons ipsec is tricky to understand is it doesn't create virtual interfaces like most other vpn systems on linux. With something like openvpn you can run tcpdump on eth0 / tun0 to figure out what is going on. With ipsec there's no 'ipsec0' interface and the way it works is a little more 'magic'.
Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows
#55We use Strongswan to secure host to host connections using pre-shared key when setting up Kubernetes clusters in simple VPS providers like DigitalOcean. This is important since DO, Linode etc does not provide private network. Flannel works with it transparently to provide a Kubernetes-aware ip network. You can see our work here: https://github.com/appscode/swanc
That's pretty cool. I've considered doing things like that to set up a secure overlay network to lock down a 'sort of' private l2 network.
Any reason you didn't use weave?
Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows
#56This seems great, but what would I actually use this for?
e: Everybody says that using a VPN is a "good thing" but I honestly can't find a use for one in my day-to-day.
Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows
#57We use Strongswan to secure host to host connections using pre-shared key when setting up Kubernetes clusters in simple VPS providers like DigitalOcean. This is important since DO, Linode etc does not provide private network. Flannel works with it transparently to provide a Kubernetes-aware ip network. You can see our work here: https://github.com/appscode/swanc
That's pretty cool. I've considered doing things like that to set up a secure overlay network to lock down a 'sort of' private l2 network. Any reason you didn't use weave?
I have never tried Weave. But StrongSwan sets up host to host tunnel using Ikev2. So, it should probably work with weave. If you find problems, please let me know in github issues.
Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows
#58This seems great, but what would I actually use this for? e: Everybody says that using a VPN is a "good thing" but I honestly can't find a use for one in my day-to-day.
You really don't have to worry about all this if you're asking.
Most people use VPN for security purposes. Now, when I mention security, there's various kinds. It can vary from hiding from state-attackers, to not wanting to be surveilled, to just torrenting stuff to avoiding a nasty letter from your ISP.
If you have nothing to worry about in the last paragraph, then the other case is organisational policies or accessibility. Routing all client traffic through a companies server because some companies' internal servers only allow requests from whitelisted IPs and drop all other packets. Of course, as a consumer/employee this is not something you have to worry about but it is something for sysadmins, and/or the security person who makes decisions at a company. And looks like there are a few of those in this thread. Hence all these discussions.
If you want to get into using VPNs, I'd suggest getting a server online first, something from digital ocean, AWS or Gcloud. If you want something super cheap, I suggest OVH's VPS. And the best tutorials in my opinion are from Digital Ocean[1]. If you only know how to use Ubuntu, here's[2] what you want.
[1]:https://www.digitalocean.com/community/tags/vpn?type=tutoria...
[2]: https://www.digitalocean.com/community/tutorials/how-to-set-...
Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows
#59It is indeed a bit of a pain to set up properly, but it can be done, I have a droplet running it 24/7 and have no problems connecting to it from Apple devices. Here are some helpful guides for setting up:
https://www.zeitgeist.se/2013/11/22/strongswan-howto-create-...
http://www.jfcarter.net/~jimc/documents/strongswan-1308.html
Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows
#60I'd only use StrongSwan if an OpenBSD gateway is not an option. Configuring IPsec IKEv2 on OpenBSD is very simple.
Yeah, I moved over to OpenBSD from FreeBSD because of their no-bullshit approach to supporting IPSEC -- everything just worked out of the box. I was thrilled when FreeBSD added IPSEC support in 11-RELEASE, but was less excited to learn that IPSEC_NAT_T wasn't compiled in, making it impossible to use strongswan. Oh well, maybe in 11.1 :)
> I was thrilled when FreeBSD added IPSEC support in 11-RELEASE
You're welcome.