Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

strongswan.org

Post reply on HN
Print view View original

61–70 of 77 posts

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#61

Post by ratherbefuddled »

I set this up a few weeks ago on a linux vps I'm using for dev. IPSEC with IKEV2 and certificates. Native clients on windows 10 and Ubuntu laptop (needed a network-manager plugin to be built), and took the shortcut and used the StrongSwan app on android.

The process was complex and there are things I still don't understand but it does work and the documentation and examples are quite comprehensive. The only issue I had with them was they assume a fair amount of familiarity with subjects that I didn't have. I'm mainly a serverside developer not a network admin, and whilst I have a vague understanding of how certs work I didn't have much awareness of VPN protocols or terminology so I had to abuse google pretty thoroughly.

It took about a day to do and I had to watch logs from server and client to figure it out, but it was interesting. I'm still pleased with the results and would recommend the product.

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#62

Post by ratherbefuddled »

shawkinaw wrote: post #59

It is indeed a bit of a pain to set up properly, but it can be done, I have a droplet running it 24/7 and have no problems connecting to it from Apple devices. Here are some helpful guides for setting up: https://www.zeitgeist.se/2013/11/22/strongswan-howto-create-... http://www.jfcarter.net/~jimc/documents/strongswan-1308.html

Both of these were immensely helpful resources to me when I did this last month.

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#63

Post by thelittleone »

windexh8er wrote: post #39

Seeing all the complaints in here of how hard this is to setup brings back memories. I was the lead consultant on a project between a very large US retailer and Centrify to build a product called DirectSecure. It's generally very easy to deploy IPsec policy in a Windows environment via GPO and the customer wanted that to flow down into their nix environments. Centrify, having good hooks in to AD already, was chosen t…

Another great option is the Streisand privacy stack. Streisand sets up a new hosted server running L2TP/IPsec, OpenConnect, OpenSSH, OpenVPN, Shadowsocks, sslh, Stunnel, a Tor bridge, and WireGuard. Once the ansible scripts complete (10-20mins), it shows you an HTML page with client config instructions.

https://github.com/jlund/streisand

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#64

Post by newman314 »

windexh8er wrote: post #39

Seeing all the complaints in here of how hard this is to setup brings back memories. I was the lead consultant on a project between a very large US retailer and Centrify to build a product called DirectSecure. It's generally very easy to deploy IPsec policy in a Windows environment via GPO and the customer wanted that to flow down into their nix environments. Centrify, having good hooks in to AD already, was chosen t…

Do you have a write up anywhere of best practices?

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#65

Post by thelittleone »

ktta wrote: post #58
peterposter wrote: post #56

This seems great, but what would I actually use this for? e: Everybody says that using a VPN is a "good thing" but I honestly can't find a use for one in my day-to-day.

You really don't have to worry about all this if you're asking. Most people use VPN for security purposes. Now, when I mention security, there's various kinds. It can vary from hiding from state-attackers, to not wanting to be surveilled, to just torrenting stuff to avoiding a nasty letter from your ISP. If you have nothing to worry about in the last paragraph, then the other case is organisational policies or access…

Here is a nice tutorial for getting the excellent Streisand privacy server up and running on Digital Ocean.

http://jerrygamblin.com/2016/07/10/the-vpn-you-should-be-usi...

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#67

Post by pYQAJ6Zm »

During the past holidays, at my parent’s, I set up some infrastructure to allow remote management of some network equipment and computers. I used to employ OpenVPN for this, but I decided to give IPsec a try. Since I have been learning CentOS, initially I went with RedHat’s suggested option: Libreswan.

I tried and tried, yet couldn’t get it to work. Documentation surely was lacking for Libreswan. But then I found Strongswan, and after a few more attempts I managed to set a tunnel as I wanted it. The documentation is much more complete, and the examples were specially helpful.

I am baffled by the choice made by RedHat, to use Libreswan as their official IPsec implementation. It gave me a “beta” feel, while Strongswan seems more solid. Plus the difference regarding documentation is like night and day.

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#68

Post by thesmok »

orf wrote: post #46
windexh8er wrote: post #39

Seeing all the complaints in here of how hard this is to setup brings back memories. I was the lead consultant on a project between a very large US retailer and Centrify to build a product called DirectSecure. It's generally very easy to deploy IPsec policy in a Windows environment via GPO and the customer wanted that to flow down into their nix environments. Centrify, having good hooks in to AD already, was chosen t…

Strongswan is indeed complex to setup. I tried on my server, and ended up using this docker image[1]. Was pretty painless. 1. https://github.com/hwdsl2/docker-ipsec-vpn-server

I started docker image by gaomd[1] on my $5 Digital Ocean server. It generates .mobileconfig files for mac/iOS. Setting it up and connecting was super easy.

1. https://github.com/gaomd/docker-ikev2-vpn-server

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#69

Post by tehno »

Nux wrote: post #50

On the subject of VPNs, if people find *swan or Openvpn difficult to get working, I highly recommend OpenConnect (ocserv); _so_ easy to setup. It's an open source implementation of the Cisco AnyConnect SSL vpn, works great and it's compatible with the AnyConnect clients.

Any good Ansible (or other) recipes for this? One I found is [0] but can you point to any others?

[0] https://github.com/ftao/vpn-deploy-playbook/tree/master/role...

Re: StrongSwan – IPsec VPN for Linux, Android, FreeBSD, Mac OS X, Windows

#70

Post by dguido »

gmac wrote: post #47
dguido wrote: post #45

Earlier quoted context omitted.

For an easier way, try Algo. Algo is a set of Ansible scripts that helps you deploy a fully functional StrongSwan IPSEC server with the most secure settings available: https://github.com/trailofbits/algo It even generates Apple profiles to auto configure your iPhone!

I have a simple bash script that does something similar, including the Apple profile, and also gets you a Let's Encrypt server cert that auto-renews. https://github.com/jawj/IKEv2-setup

Bash is not idempotent, using a public CA has downsides, and MSCHAP has known weaknesses that make the crypto easier to bruteforce.
Post reply on HN