Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

strongswan.org

Post reply on HN
Print view View original

31–40 of 77 posts

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#31

Post by spaceboy »

falcolas wrote: post #15

I've seen this implemented quite usefully in a corporate environment and for container-container communication; but attempting to set it up for my personal use was an absolute disaster. A bit over a week spent trying to make it work, and it never did. OpenVPN worked just fine, but I could never make StrongSwan work at all. Which is a shame, I really wanted to have an easy-to-use VPN for my phone and so forth. Settled…

> A bit over a week spent trying to make it work, and it never did

I feel your pain. I remember trying to install DNSCrypt[1] on Linux and failing miserably. I was convinced it would work if only I found the right solution online, or if only the right amount of caffeine was in my bloodstream, or if by sheer effort of will I could get it working, but I still failed. I partially got it installed, error messages galore in my terminal, and all my /paths/ were wrong. It was a humbling experience. I quickly uninstalled it as I don't want partially working, broken soft running on my machine.

I guess for this situation a decent OpenVPN client would be ideal like Viscosity[2]

[1] https://www.dnscrypt.org/

[2] https://www.sparklabs.com/viscosity/

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#32

Post by tamalsaha001 »

We use Strongswan to secure host to host connections using pre-shared key when setting up Kubernetes clusters in simple VPS providers like DigitalOcean. This is important since DO, Linode etc does not provide private network. Flannel works with it transparently to provide a Kubernetes-aware ip network.

You can see our work here: https://github.com/appscode/swanc

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#33

Post by fulafel »

dkhenry wrote: post #7

When I was looking to replace my OpenVPN server for a cloud based VPN one thing I wanted was to use the OS native VPN solution. Everything pointed me to L2TP/IPSec, I am wondering why I would choose IKEv2 over that.

IKE is the protocol that negotiates the metadata for the IPsec connection. The encapsulated traffic itself is then carried IPsec's ESP protocol.

(Technically you can also skip IKE and manually configure thesymmetric keys and parameters, using eg setkey from Linux ipsec-tools)

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#34

Post by MichaelGG »

terrywang wrote: post #22
falcolas wrote: post #15

I've seen this implemented quite usefully in a corporate environment and for container-container communication; but attempting to set it up for my personal use was an absolute disaster. A bit over a week spent trying to make it work, and it never did. OpenVPN worked just fine, but I could never make StrongSwan work at all. Which is a shame, I really wanted to have an easy-to-use VPN for my phone and so forth. Settled…

OpenVPN is SSL VPN, relatively easy to setup, it operates in transport layer. strongSwan (IPsec) works in layer 3. To properly install and configure strongSwan, following the tutorials available over the Nnternet is not enough. One needs to have basic networking knowledge (NAT, iptables in particular), good understanding of IPsec protocol suite (including IKE, AH, ESP), PKI, Linux skills and etc. This is a good refer…

OpenVPN isn't really an SSL VPN. In one of the major modes (preshared key), TLS isn't used at all. In client-server mode, TLS is only used for session negotiation (keys, options, user/pass) and the rest goes over their own protocol and doesn't use TLS at all. And even then it isn't TLS over TCP directly, but TLS over OpenVPN's own protocol.

For whatever reason, OpenVPN is way easier to get up and running. Little knowledge required. UDP overhead is minimal.

t. Recently implemented an OpenVPN client from scratch.

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#35

Post by [deleted] »

terrywang wrote: post #22
falcolas wrote: post #15

I've seen this implemented quite usefully in a corporate environment and for container-container communication; but attempting to set it up for my personal use was an absolute disaster. A bit over a week spent trying to make it work, and it never did. OpenVPN worked just fine, but I could never make StrongSwan work at all. Which is a shame, I really wanted to have an easy-to-use VPN for my phone and so forth. Settled…

OpenVPN is SSL VPN, relatively easy to setup, it operates in transport layer. strongSwan (IPsec) works in layer 3. To properly install and configure strongSwan, following the tutorials available over the Nnternet is not enough. One needs to have basic networking knowledge (NAT, iptables in particular), good understanding of IPsec protocol suite (including IKE, AH, ESP), PKI, Linux skills and etc. This is a good refer…

[deleted]

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#36

Post by sedachv »

falcolas wrote: post #15

I've seen this implemented quite usefully in a corporate environment and for container-container communication; but attempting to set it up for my personal use was an absolute disaster. A bit over a week spent trying to make it work, and it never did. OpenVPN worked just fine, but I could never make StrongSwan work at all. Which is a shame, I really wanted to have an easy-to-use VPN for my phone and so forth. Settled…

I also could not get an IPSec VPN running on Debian in 2012 (I think it was FreeSWAN), while OpenVPN was no problem. I am planning to run a VPS for VPN and email again and this time looking to do all the setup with Ansible. Two roles came up for StrongSwan when searching: https://github.com/agdsn/ansible-strongswan-server https://github.com/jonathanio/ansible-role-strongswan Not sure how much those help with actual VPN configuation. Anyone have any experience with this?

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#37

Post by orf »

vetinari wrote: post #27
orf wrote: post #21

Earlier quoted context omitted.

Don't be flippant. Less LOC means that the code is easier to audit, unlike large and older codebases. Easily audited code is good for security.

It also means, that the functionality may not be there yet. For example, Strongswan, OpenVPN etc have already solved assignment of client IPs, with Wireguard you have to allocate them by hand in the config (good luck managing several hundreds of them). Strongswan, OpenVPN, etc have no problem operating the server with dynamic IP (you just create DNS record for the end point and update it, whenever the IP changes), wi…

So, more code automagically makes it better. Ok.

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#38

Post by discreditable »

baby wrote: post #6
drdaeman wrote: post #3

Earlier quoted context omitted.

Because IPSec is natively supported by many OSes out-of-box, while Wireguard doesn't seem to have even third-party packages for many systems?

Sure, but if you care about security you won't mind installing it.

WireGuard is not production ready.

> Warning: WireGuard is currently under heavy development, and therefore any installation steps here should be considered as experimental. Please do not rely on WireGuard at this stage. We are rapidly working toward a first release that we will consider secure and ready for widespread usage, but that time has not yet come.

https://www.wireguard.io/install/

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#39

Post by windexh8er »

Seeing all the complaints in here of how hard this is to setup brings back memories. I was the lead consultant on a project between a very large US retailer and Centrify to build a product called DirectSecure. It's generally very easy to deploy IPsec policy in a Windows environment via GPO and the customer wanted that to flow down into their nix environments. Centrify, having good hooks in to AD already, was chosen to build a product that did just the same thing in their nix environments by consuming IPsec configuration out of GPO.

While not a sales pitch, and in fact I don't think the product seems to have sold well anyway, it was very interesting to work with them on the test harness we built to validate correct IPsec operations, configuration, validation that data wasn't leaking outside of the SAs that were being provisioned, and performance via the translated policy. The relatable component was this was mainly done against StrongSwan implementations of the IKE daemon if I remember correctly (Linux, AIX and Solaris mainly). I wonder if any of those bits flowed back upstream or if the bolt-on aspect kept that from happening.

StrongSwan isn't complex if you are well versed in IPsec implementation as a whole. It's no more or less complicated than other implementation and is "better" than TLS in it's own right with regard to things that could go wrong. In static environments it's relatively painless once the learning curve is overcome.

That being said I feel like IPsec has a badge it will never get rid of and people discard it before attempting implementation at this point. Hopefully, as mentioned amongst the comments, things like WireGuard will mature and become more mainstream. I very much like the concept carry over that both IPsec and WireGuard can be silent actors within the network not giving away hosts as things like OpenVPN and SSH do. IPsec can, unfortunately, also be implemented to squawk at spurious connection attempts - but at least doesn't rely on the premise as much as things like OpenVPN and SSH do.

And for the record - you can tell someone who's dealt with IPsec extensively since they won't refer to it as IPSec. o_O Microsoft is notorious for getting it wrong.

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#40

Post by rantam0ct »

Florin_Andrei wrote: post #30
terrywang wrote: post #26

strongSwan is the best free and open source IPsec implementation available on Linux, (much better than libreswan...), good documentation, use cases and examples etc, good quality of code (less bugs - that's what we've found running it in production for 2+ years with 500+ instances deployed) actively developed and maintained by a group of passionate developers that knows the stuff well. Personally I've been using stro…

Yup, it's the most actively maintained branch of all the XXXswan projects. My experience has been that it's trivial to setup for site-to-site IPSec tunnels using PSK. It's literally install the package, copy a config file from the docs, start the service, done. I've been using it in scenarios like this for a while, works great even when the remote ends of the tunnel are something else (Cisco appliances, AWS VPN endpo…

No idea for #1, but regarding multifactor, I've used Strongswan with Feitian PKI smartcards. Basically, I have one card that I set up as a CA and use to sign CSRs for "user" smartcards as well as for the VPN servers. You need to have your card and PIN to connect. The private keys are stored on the cards - no PSKs. This is something cool to do if you are cheap. You may be able to do this with Yubikeys, though I haven't tried this.

https://wiki.strongswan.org/projects/strongswan/wiki/SmartCa... https://github.com/OpenSC/OpenSC/wiki/Feitian-PKI-card

edit:

Some quick and dirty instructions to generate keys/certs that you can use with a Linux or Android client:

git clone https://github.com/ramann/smartcard-pki

cd smartcard-pki

git checkout vpn-phone

# Edit etc/vpn_server.conf to use your server's IP address

bash -x # Move vpn_server_key.pem, ca/signing-ca.crt, certs/vpn_server.crt, certs/phone.pem to your VPN server's /etc/ipsec.d/

# Edit your VPN server's /etc/ipsec.conf so that leftcert=vpn_server.crt and rightcert=phone.crt

# To set up your Android phone, just import the phone-and-ca.pfx file

# To set up your Linux client (Ubuntu 16.04 in my case), move phone_key.pem, ca/signing-ca.crt, certs/vpn_server.crt, and certs/phone.crt to /etc/ipsec.d

# Edit your client's /etc/ipsec.conf so that leftcert=phone.crt and rightcert=vpn_server.crt

# To start server: sudo ipsec start

# How to start the Android client should be obvious.

# To start linux client: sudo ipsec start; sudo ipsec up connection_name

Post reply on HN