strongSwan User Documentation¶

Features¶

• Virtual IP via mode-config (IKEv1) or configuration payload (IKEv2)
• NAT Traversal
• MOBIKE

Configuration Files¶

• ipsec.conf file
• ipsec.secrets file
• ipsec.d directory
• strongswan.conf file

Configuration HOWTOs¶

• Configuration HOWTO
• Hash-and-URL HOWTO
• SQLite HOWTO
• Logger configuration HOWTO
• IKE_SA lookup tuning HOWTO
• Mobile IPv6 HOWTO
• NetworkManager client setup
• Authenticate road warriors using EAP-GTC and a PAM service

Configuration Examples¶

Dozens of both simple and advanced VPN scenarios:

• IKEv1 examples
• IKEv2 examples - NEW with EAP-RADIUS support
• IKEv2 Hash-and-URL example
• IKEv2 Mediation Extension mediation service examples
• Mixed IKEv1/IKEv2 examples
• IPv6 examples
• SQLite database backend examples
• OpenSSL crypto plugin examples

Interoperability¶

• Windows 7 with IKEv2
• Windows Vista with IKEv1

Management Commands¶

• The powerful ipsec command starts, stops and monitors IPsec connections.

Auxiliary Tools¶

• ipsec openac generates X.509 attribute certificates
• ipsec scepclient implements the Simple Certificate Enrollment Protocol (SCEP)
• ipsec pool manages virtual IP address pools stored in an SQL database
• ipsec leases shows the assignment of virtual IP adresses stored in volatile memory
• ipsec starter starts, stops, and configures the IKE daemons
• ipsec stroke controls the IKEv2 charon daemon
• ipsec whack controls the IKEv1 pluto daemon
• ipsec uci configuration plugin for OpenWRT
• ipsec X-WRT end user configuration of X-WRT for OpenWRT

Linux 2.6 IPsec¶

• Firewalling mit Linux 2.6 IPsec
• Linux netfilter IPsec policy matching

Frequently Asked Questions¶

• A FAQ is maintained here.