21–30 of 77 posts
I've seen this implemented quite usefully in a corporate environment and for container-container communication; but attempting to set it up for my personal use was an absolute disaster. A bit over a week spent trying to make it work, and it never did. OpenVPN worked just fine, but I could never make StrongSwan work at all. Which is a shame, I really wanted to have an easy-to-use VPN for my phone and so forth. Settled…
To properly install and configure strongSwan, following the tutorials available over the Nnternet is not enough. One needs to have basic networking knowledge (NAT, iptables in particular), good understanding of IPsec protocol suite (including IKE, AH, ESP), PKI, Linux skills and etc.
This is a good reference but still needs the knowledge mentioned above to get it to work: https://raymii.org/s/tutorials/IPSEC_vpn_with_Ubuntu_16.04.h...
With the 4000 LOC Wireguard https://www.wireguard.io/ what are the incentives to continue using IPsec or Strongswan?
Personally I've been using strongSwan since its 5.0.x for remote access - protect privacy and fight censorship (yes, originally from China where the infamous GFW is deployed...). The native strongSwan client for Android is also a killer feature worth mentioning, RSA authentication with X509 certificates works flawlessly with 1 click ;-)
My company (pre-IPO startup) has been using strongSwan for 2+ years as site-to-site solution from AWS VPC to on-premises data centres (or other cloud virtual network), with 500+ instances deployed, track record has proved it reliable as long as it's properly configured (most outages were caused by AWS maintenance ;-) The only drawback is that strongSwan currently does NOT have a mature HA solution but it's shaping up (5.4.0 introduced IKEv2 redirect). We are currently building a custom HA solution (designed to work in VPC - provide similar redundancy to AWS VPN but a lot more flexible and controllable) using strongSwan (have to use route-based as syncing 2 policy based instances are too hard or impossible).
NOTE: I've seen people mentioned L2TP, it is obsolete. L2TP does NOT provide encryption or confidentiality to traffic passes through it. L2TP/IPsec encapsulates data twice at layer 2, it has pros and cons. See this (may be out-dated) -> https://www.bestvpn.com/blog/4147/pptp-vs-l2tp-vs-openvpn-vs...
IKEv{1,2} + IPsec (ESP) (tunnel mode) with PFS for both ike and esp is recommended configuration.
As mentioned in another comment: To properly install and configure strongSwan, following the tutorials available over the Internet is not enough, it requires good networking knowledge (NAT, iptables in particular), understanding of IPsec protocol suite (including IKE, AH, ESP), PKI, Linux skills and etc.
A good reference to start with: https://raymii.org/s/tutorials/IPSEC_vpn_with_Ubuntu_16.04.h...
Earlier quoted context omitted.
So, less code automagically makes it better. Ok.
Don't be flippant. Less LOC means that the code is easier to audit, unlike large and older codebases. Easily audited code is good for security.
Stuff like these is also a reason, why Strongswan, OpenVPN, etc have bigger LOC. I'm not saying that Wireguard is something bad, it just must go through a growing period, where it will gain additional LOC.
StrongSwan is a real powerhorse, even though a bit of a b*tch to configure to work out-of-the-box on most platforms. The documentation is scarce and the wiki was a bit out of date IIRC. I'm using it on my VPS, with my Mac as a client to bypass the UK big brother, and on Android to bypass tethering blocks (in conjunction with the Tether app)
I'd only use StrongSwan if an OpenBSD gateway is not an option. Configuring IPsec IKEv2 on OpenBSD is very simple.
strongSwan is the best free and open source IPsec implementation available on Linux, (much better than libreswan...), good documentation, use cases and examples etc, good quality of code (less bugs - that's what we've found running it in production for 2+ years with 500+ instances deployed) actively developed and maintained by a group of passionate developers that knows the stuff well. Personally I've been using stro…
My experience has been that it's trivial to setup for site-to-site IPSec tunnels using PSK. It's literally install the package, copy a config file from the docs, start the service, done. I've been using it in scenarios like this for a while, works great even when the remote ends of the tunnel are something else (Cisco appliances, AWS VPN endpoints, etc).
I'm a little less sure how to implement it as a VPN endpoint for employees. There are two main issues here:
1. Having to support a variety of clients (Android, iOS, Mac OS X - perhaps also Windows and Linux)
2. Doing multifactor authentication in a way that works well
Especially when considering #1 and #2 together, it seems difficult to meet all demands. How to do multifactor in a way that works with many different clients? I don't much care what the "factors" are as long as they are "multi". E.g. certificate + individual password.
If I only had to support, say, user/pass authentication, I think that would be somewhat easily doable.
Any clues?