StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows • Hacker News Board

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#11

Post by cthalupa » Wed, Feb 15, 2017, 5:33 PM UTC

dkhenry wrote: post #7

When I was looking to replace my OpenVPN server for a cloud based VPN one thing I wanted was to use the OS native VPN solution. Everything pointed me to L2TP/IPSec, I am wondering why I would choose IKEv2 over that.

It's very good for mobile devices - it should fairly seamlessly reconnect when transitioning between networks/cell towers/etc

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#12

Post by q3k » Wed, Feb 15, 2017, 5:36 PM UTC

baby wrote: post #6

drdaeman wrote: post #3

Earlier quoted context omitted.

Because IPSec is natively supported by many OSes out-of-box, while Wireguard doesn't seem to have even third-party packages for many systems?

Sure, but if you care about security you won't mind installing it.

I don't think I can install Wireguard on my Cisco ASAs or Juniper SRXes..?

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#13

Post by binalpatel » Wed, Feb 15, 2017, 5:37 PM UTC

baby wrote: post #2

With the 4000 LOC Wireguard https://www.wireguard.io/ what are the incentives to continue using IPsec or Strongswan?

You work in an industry like healthcare where it's IPSEC or bust for any tunneling.

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#14

Post by drdaeman » Wed, Feb 15, 2017, 5:37 PM UTC

baby wrote: post #6

drdaeman wrote: post #3

Earlier quoted context omitted.

Because IPSec is natively supported by many OSes out-of-box, while Wireguard doesn't seem to have even third-party packages for many systems?

Sure, but if you care about security you won't mind installing it.

Install what? I can install it on GNU/Linux machines. But there are no Android[1], Windows or macOS or iOS packages.

[1] Well, it's theoretically possible to build a custom kernel for some devices, and manage VPN from terminal, but I'm not sure many would enjoy it this way.

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#15

Post by falcolas » Wed, Feb 15, 2017, 5:38 PM UTC

I've seen this implemented quite usefully in a corporate environment and for container-container communication; but attempting to set it up for my personal use was an absolute disaster. A bit over a week spent trying to make it work, and it never did.

OpenVPN worked just fine, but I could never make StrongSwan work at all. Which is a shame, I really wanted to have an easy-to-use VPN for my phone and so forth. Settled on OpenVPN, which worked well enough with the iOS clients.

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#16

Post by laura2013 » Wed, Feb 15, 2017, 5:38 PM UTC

dkhenry wrote: post #7

When I was looking to replace my OpenVPN server for a cloud based VPN one thing I wanted was to use the OS native VPN solution. Everything pointed me to L2TP/IPSec, I am wondering why I would choose IKEv2 over that.

ikev2 is a key exchange protocol within IPSec (you may use pre-shared keys instead).

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#17

Post by derefr » Wed, Feb 15, 2017, 5:39 PM UTC

baby wrote: post #6

drdaeman wrote: post #3

Earlier quoted context omitted.

Because IPSec is natively supported by many OSes out-of-box, while Wireguard doesn't seem to have even third-party packages for many systems?

Sure, but if you care about security you won't mind installing it.

You don't get to install software if you only control your end of the tunnel — because the other end is either a proprietary appliance (e.g. a Cisco router; an AWS Virtual Private Gateway) or someone else's computer (e.g. some other org you're peering an [semi-isolated] part of your network with for a shared project.)

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#18

Post by teilo » Wed, Feb 15, 2017, 5:42 PM UTC

dkhenry wrote: post #7

When I was looking to replace my OpenVPN server for a cloud based VPN one thing I wanted was to use the OS native VPN solution. Everything pointed me to L2TP/IPSec, I am wondering why I would choose IKEv2 over that.

First off, IKEv2 is IPSec. IPSec tunnels are either IKEv1 or IKEv2.

The advantages:

* It has a streamlined/faster key negotiation protocol. IKEv2 tunnels can be established in a fraction of the time it takes for IKEv1 negotiation, especially when negotiating multiple SAs.

* More robust integrity algorithms which can detect and re-establish a tunnel faster.

* It supports EAP, so in client/server mode (vs. tunnel mode) you can attach it to an AAA server to assign IP addresses and do user authentication, making L2TP and shared secrets unnecessary. (Note that when using IKEv2 for IPSec tunnels, one still must use either a shared secret or certificates for authentication.)

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#19

Post by 1_player » Wed, Feb 15, 2017, 5:56 PM UTC

StrongSwan is a real powerhorse, even though a bit of a b*tch to configure to work out-of-the-box on most platforms. The documentation is scarce and the wiki was a bit out of date IIRC.

I'm using it on my VPS, with my Mac as a client to bypass the UK big brother, and on Android to bypass tethering blocks (in conjunction with the Tether app)

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#20

Post by danesparza » Wed, Feb 15, 2017, 6:01 PM UTC

baby wrote: post #2

With the 4000 LOC Wireguard https://www.wireguard.io/ what are the incentives to continue using IPsec or Strongswan?

Well, considering Wireguard says on their website "WireGuard is not yet complete. You should not rely on this code" ... I think the burden is on you to justify the comparison in the first place.