The dhcp plugin allows to forward requests for virtual IP addresses to a DHCP server.
To enable the plugin, add
--enable-dhcpto the ./configure options.
It has been available since 4.4.0.
The plugin only supports DHCP for IPv4.
When an IKEv2 client requests a virtual IP address via a configuration payload, the plugin allows the daemon to forward this request to a DHCP server. By default the plugin uses broadcasts, but a designated DHCP server can be configured in strongswan.conf.
DNS/WINS server information is additionally served to clients if the DHCP server provides such information.
The MAC address used in the DHCP request is either randomly generated or can optionally be based on the IKEv2 identity of the client.
In combination with the farp plugin this plugin lets a road-warrior act as a client on the local LAN of the responder.
To enable the plugin for a connection the following option must be specified in ipsec.conf:
The plugin may be configured using the following strongswan.conf options.
|charon.plugins.dhcp.force_server_address||no||Always use the configured server address. See the note below for details.|
|charon.plugins.dhcp.identity_lease||no||Derive user-defined MAC address from hash of IKEv2 identity.|
|charon.plugins.dhcp.interface||Interface name the plugin uses for address allocation. The default is to bind to any (0.0.0.0) and let the system decide which way to route the packets to the DHCP server.|
|charon.plugins.dhcp.server||255.255.255.255||DHCP server unicast or broadcast IP address.|
Note: If the DHCP server runs on the same host as the daemon with DHCP plugin, you may need to enable charon.plugins.dhcp.force_server_address and then set charon.plugins.dhcp.server to the local broadcast address (e.g. 192.168.0.255). That's because some DHCP daemons do not listen on the loopback interface and, thus, can't be reached via unicast (or even broadcast, 255.255.255.255) from the same host.