Setting Up a VPN with IPsec and StrongSwan on Linux

Setting up a VPN with IPsec and StrongSwan on Linux is an excellent choice for creating a secure and reliable connection for remote users. IPsec (Internet Protocol Security) is a framework for securing Internet Protocol (IP) communications through encryption and authentication. StrongSwan is a popular open-source software for implementing IPsec on Linux-based systems. In this article, we will go through the detailed steps to set up a VPN using IPsec and StrongSwan.

Installing StrongSwan on Linux

First, we need to install StrongSwan on our Linux server. The installation process will depend on the Linux distribution being used. Below are the steps for both Ubuntu and CentOS.

Installing on Ubuntu

sudo apt update
sudo apt install strongswan strongswan-plugin-eap-mschapv2

Installing on CentOS

sudo yum install epel-release
sudo yum install strongswan

Once installed, you can check that StrongSwan is correctly installed by running:

sudo systemctl status strongswan

Configuring StrongSwan for IPsec

Now that StrongSwan is installed, we can begin configuring it to support IPsec. We will need to modify the configuration files, primarily /etc/ipsec.conf and /etc/ipsec.secrets.

Configuring the ipsec.conf file

The ipsec.conf file is the main configuration file for StrongSwan. Here, you will define the connections, security policies, and encryption algorithms.

Open the ipsec.conf file:

sudo nano /etc/ipsec.conf

Add the following configuration to define a basic IPsec VPN connection:

config setup
    charondebug="ike 2, knl 2, net 2, dmn 2,  mgr 2"

conn myvpn
    keyexchange=ikev2
    left=
    leftsubnet=0.0.0.0/0
    leftfirewall=yes
    right=%any
    rightdns=
    rightsourceip=10.10.10.0/24
    auto=add

Explanation of parameters:

keyexchange=ikev2 specifies the IKEv2 protocol for secure key exchange.
left refers to the server’s public IP address.
leftsubnet defines the allowed IP range for local connections.
right is set to %any, which means the client can connect from any IP.
rightsourceip assigns an IP address range for the VPN clients.
auto=add automatically starts the connection when the service is restarted.

Configuring the ipsec.secrets file

Next, we need to configure authentication secrets in ipsec.secrets. This file stores the shared secrets or certificates used to authenticate the VPN peers.

Edit the ipsec.secrets file:

sudo nano /etc/ipsec.secrets

Add the following lines for a simple pre-shared key (PSK) authentication:

 : PSK "your_shared_secret"

Enabling and Starting StrongSwan

Once the configuration files are updated, we can enable and start the StrongSwan service.

sudo systemctl enable strongswan
sudo systemctl start strongswan

Testing the VPN Connection

To test the VPN connection, use the ipsec status command to verify that the IPsec tunnels are up and running:

sudo ipsec status

If everything is set up correctly, you should see the active connection listed. Additionally, use the ping command from a client machine to test the VPN connection:

ping 10.10.10.1

Advanced Configuration: Using Certificates for Authentication

For increased security, it’s recommended to use certificates for authentication instead of a pre-shared key. This involves generating certificates for both the server and the client, then configuring StrongSwan to use them.

Generating Certificates

You can generate the necessary certificates using the ipsec pki command:

ipsec pki --gen --type rsa --size 4096 --outform pem > ca.key
ipsec pki --self --ca --in ca.key --type rsa --outform pem > ca.cert.pem

Once the certificates are generated, you need to configure StrongSwan to use them for authentication.

Modifying the ipsec.conf for Certificates

Edit the ipsec.conf file to enable certificate-based authentication:

conn myvpn
    keyexchange=ikev2
    left=
    leftcert=server.cert.pem
    right=%any
    rightdns=
    rightsourceip=10.10.10.0/24
    auto=add

Configuring the ipsec.secrets for Certificates

Next, modify the ipsec.secrets file to use the private key for the server:

leftcert server.cert.pem
leftkey server.key

Firewall Configuration

Finally, ensure that the server’s firewall allows IPsec traffic. You can open the necessary ports by running:

sudo ufw allow 500,4500/udp
sudo ufw reload

We earn commissions using affiliate links.