Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

strongswan.org

Post reply on HN
Print view View original

41–50 of 77 posts

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#41

Post by JustSomeNobody »

orf wrote: post #37
vetinari wrote: post #27

Earlier quoted context omitted.

It also means, that the functionality may not be there yet. For example, Strongswan, OpenVPN etc have already solved assignment of client IPs, with Wireguard you have to allocate them by hand in the config (good luck managing several hundreds of them). Strongswan, OpenVPN, etc have no problem operating the server with dynamic IP (you just create DNS record for the end point and update it, whenever the IP changes), wi…

So, more code automagically makes it better. Ok.

Don't be flippant.

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#42

Post by RJIb8RBYxzAMX9u »

terrywang wrote: post #26

strongSwan is the best free and open source IPsec implementation available on Linux, (much better than libreswan...), good documentation, use cases and examples etc, good quality of code (less bugs - that's what we've found running it in production for 2+ years with 500+ instances deployed) actively developed and maintained by a group of passionate developers that knows the stuff well. Personally I've been using stro…

> NOTE: I've seen people mentioned L2TP, it is obsolete. L2TP does NOT provide encryption or confidentiality to traffic passes through it.

Would you clarify how it's obsolete, because it's doesn't follow from "L2TP does NOT provide encryption or confidentiality..."? AFAIK no one uses L2TP by itself, as there's no shortage of encapsulation protocols (GRE, AYIYA, vxlan, etc.) for other purposes. In practice L2TP/IPsec are always paired akin to TCP/IP, even though in theory you could do things like TCP/IPX or TCP/AppleTalk, or whatever. In the context of VPNs, L2TP/IPsec is "the protocol" even though they are two distinct pieces.

> L2TP/IPsec encapsulates data twice at layer 2, it has pros and cons. See this (may be out-dated) -> https://www.bestvpn.com/blog/4147/pptp-vs-l2tp-vs-openvpn-vs....

Sure it's not optimal, but for its intended purpose, establishing VPNs from roaming devices to intranets, the overhead hardly matters. IMO, what does matter is client device and network[0] compatibility, and L2TP/IPsec is hard to beat here. I wouldn't say that OpenVPN or other VPN solutions obsolete L2TP/IPsec in this aspect, either.

For (semi-)permanent site-to-site VPNs I agree just use IPsec.

[0] IIRC last time I chimed in on L2TP/IPsec you or someone else in the thread disputed that firewalls were generally not an issue for IPsec, contrary to my personal experience. Maybe I've just been extremely lucky, so I'll conceded this point.

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#43

Post by kchoudhu »

equalunique wrote: post #23

I'd only use StrongSwan if an OpenBSD gateway is not an option. Configuring IPsec IKEv2 on OpenBSD is very simple.

Yeah, I moved over to OpenBSD from FreeBSD because of their no-bullshit approach to supporting IPSEC -- everything just worked out of the box.

I was thrilled when FreeBSD added IPSEC support in 11-RELEASE, but was less excited to learn that IPSEC_NAT_T wasn't compiled in, making it impossible to use strongswan. Oh well, maybe in 11.1 :)

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#45

Post by dguido »

windexh8er wrote: post #39

Seeing all the complaints in here of how hard this is to setup brings back memories. I was the lead consultant on a project between a very large US retailer and Centrify to build a product called DirectSecure. It's generally very easy to deploy IPsec policy in a Windows environment via GPO and the customer wanted that to flow down into their nix environments. Centrify, having good hooks in to AD already, was chosen t…

For an easier way, try Algo. Algo is a set of Ansible scripts that helps you deploy a fully functional StrongSwan IPSEC server with the most secure settings available:

https://github.com/trailofbits/algo

It even generates Apple profiles to auto configure your iPhone!

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#46

Post by orf »

windexh8er wrote: post #39

Seeing all the complaints in here of how hard this is to setup brings back memories. I was the lead consultant on a project between a very large US retailer and Centrify to build a product called DirectSecure. It's generally very easy to deploy IPsec policy in a Windows environment via GPO and the customer wanted that to flow down into their nix environments. Centrify, having good hooks in to AD already, was chosen t…

Strongswan is indeed complex to setup. I tried on my server, and ended up using this docker image[1].

Was pretty painless.

1. https://github.com/hwdsl2/docker-ipsec-vpn-server

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#47

Post by gmac »

dguido wrote: post #45
windexh8er wrote: post #39

Seeing all the complaints in here of how hard this is to setup brings back memories. I was the lead consultant on a project between a very large US retailer and Centrify to build a product called DirectSecure. It's generally very easy to deploy IPsec policy in a Windows environment via GPO and the customer wanted that to flow down into their nix environments. Centrify, having good hooks in to AD already, was chosen t…

For an easier way, try Algo. Algo is a set of Ansible scripts that helps you deploy a fully functional StrongSwan IPSEC server with the most secure settings available: https://github.com/trailofbits/algo It even generates Apple profiles to auto configure your iPhone!

I have a simple bash script that does something similar, including the Apple profile, and also gets you a Let's Encrypt server cert that auto-renews.

https://github.com/jawj/IKEv2-setup

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#48

Post by benmmurphy »

windexh8er wrote: post #39

Seeing all the complaints in here of how hard this is to setup brings back memories. I was the lead consultant on a project between a very large US retailer and Centrify to build a product called DirectSecure. It's generally very easy to deploy IPsec policy in a Windows environment via GPO and the customer wanted that to flow down into their nix environments. Centrify, having good hooks in to AD already, was chosen t…

i have a slightly different opinion of ipsec vs tls and this is probably mostly formed because it is being 'abused' where we use it. so we have a bunch of point to point connections to other companies and all of these companies except for one that uses http as its protocol has chosen to use ipsec to protect the connections. it believe it would be much better operationally and in terms of security if these connections were protected by TLS instead.

have a look at how 'rekeying' is done. look at the numerous bugs in strongswan issue tracker related to this. the whole protocol is a shit show and it is really surprising that anything actually works between different vendors.

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#50

Post by Nux »

On the subject of VPNs, if people find *swan or Openvpn difficult to get working, I highly recommend OpenConnect (ocserv); _so_ easy to setup.

It's an open source implementation of the Cisco AnyConnect SSL vpn, works great and it's compatible with the AnyConnect clients.

Post reply on HN