Welcome to our today’s guide on how to setup IPSec VPN server with Libreswan on Rocky Linux. Libreswan is a free implementation of IKE/IPsec for Linux. IPsec is the Internet Protocol Security which uses strong cryptography to provide both authentication and encryption services and allow you to build secure tunnels through untrusted networks. Everything passing through the untrusted network is encrypted by the ipsec gateway machine and decrypted by the gateway at the other end of the tunnel. The resulting tunnel is a virtual private network or VPN.
IKE manages the authentication between two communicating end points. It also enables endpoints to negotiate on algorithms to use to setup an IPsec tunnel.
In our previous guide, we covered how to install and configure IPSec VPN using StrongSwan on Ubuntu 18.04. See the link below;
Configure IPSEC VPN using StrongSwan on Ubuntu 18.04
Setup IPSec VPN Server with Libreswan on Rocky Linux
There are different VPN Server-client implementations of Libreswan.
In this guide, we are going to learn how setup IPSec VPN server for the mobile clients (clients with dynamically assigned IPs such as laptops) here in known as road warriors, so that they can be able to connect to local LAN from anywhere. Mobile clients are authenticated using certificates and hence uses the IKEv2 protocol.
IKEv2 (Internet Key Exchange version 2) is a VPN encryption protocol that handles request and response actions. IKE performs mutual authentication between two parties and establishes an IKE security association (SA) that includes shared secret information that can be used to efficiently establish SAs for Encapsulating Security Payload (ESP) or Authentication Header (AH) and a set of cryptographic algorithms to be used by the SAs to protect the traffic that they carry.
Run system Update
Update your system packages on the server to be used as Libreswan VPN server.
dnf updateInstall Libreswan on Rocky Linux
Once the update is done, install Libreswan. Libreswan is available on Rocky Linux AppStream repos and hence, you can simply install using the package manager as follows;
dnf install libreswanRunning Libreswan
Once the installation is done, start and enable Libreswan ipsec service to run on system boot.
systemctl enable --now ipsecInitialize IPSec NSS Database
Next, you need to initialize the Network Security Services (NSS) database. NSS database is used to store authentication keys and identity certificates.
ipsec initnssIf there is any previous database, you can remove it so that you can have a new database. The NSS database is stored under /etc/ipsec.d.
To remove any old databases, stop IPsec, if running and remove NSS databases by running the commands below;
systemctl stop ipsecrm -rf /etc/ipsec.d/*dbYou can then re-initialize the NSS database;
ipsec initnssThen start IPSec;
systemctl start ipsecOpen Libreswan Ports and Protocols on Firewall
The IKE protocol uses UDP port 500 and 4500 while IPsec protocols, Encapsulated Security Payload (ESP) and Authenticated Header (AH) uses protocol number 50 and 51 respectively.
Hence, open these ports and protocols on your active firewall zone on your VPN (Left Endpoint) Server in this guide.
firewall-cmd --get-active-zoneTo open the ports and firewall on the default firewalld zone;
firewall-cmd --add-port={4500,500}/udp --permanentfirewall-cmd --add-protocol={50,51} --permanentOr you can simply use the IPSec service;
firewall-cmd --add-service=ipsec --permanentReload FirewallD
firewall-cmd --reloadConfigure IPSec VPN Server with Libreswan
Libreswan doesn’t use the client-server model. It however uses the terms left and right to refer to endpoints involved in any given connection. The left/right terms can be used arbitrarily to refer to each system as long as you maintain consistency in using the terms while configuring your connections.
Enable IP Forwarding
On both the VPN server, you need to enable IP forwarding.
Run the command below to check if IP forwarding is enabled;
sysctl net.ipv4.ip_forwardIf the output is net.ipv4.ip_forward = 0, then IP forwarding is disabled and you need to enable.
IP forwarding can be enabled by just enabling IP masquerading on firewalld.
firewall-cmd --add-masquerade --permanent
firewall-cmd --reloadYou can the verify IP forwarding;
cat /proc/sys/net/ipv4/ip_forwardA value of 1 means, IP forwarding is enabled.
Similarly. you can enable IP forwarding by running the commands below;
echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.confRefresh with the sysctl.conf with new configuration.
sysctl -pAlso, ensure that redirects are disabled.
less /etc/sysctl.d/50-libreswan.conf# We disable redirects for XFRM/IPsec
net.ipv6.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.rp_filter = 0
Generate VPN Server and Client Certificates
Next, you need to generate the VPN server and clients certificates for use in authentication.
Create Certificates Generation Database
Run the command below to create a database that can be used to generate store a private key and CA certificate for use in generating hosts certificates. We will be using certutil command to generate the certificates.
mkdir /etc/ipsec.d/certsdbcertutil -N -d sql:/etc/ipsec.d/certsdbThe command prompts you to enter the password for encrypting your keys.
Enter a password which will be used to encrypt your keys.
The password should be at least 8 characters long,
and should contain at least one non-alphabetic character.
Enter new password: StRONgPassw0Rd
Re-enter password: StRONgPassw0Rd
Generate CA Certificate
We use self signed certificates in this tutorial and hence, this is how we can generate our local CA certificate.
certutil -S -x -n "Kifarunix-demo CA" -s "O=Kifarunix-demo,CN=Kifarunix-demo CA" -k rsa -g 4096 -v 12 -d sql:/etc/ipsec.d/certsdb -t "CT,," -2Refer to man certutil to learn about the options used.
When the command runs, you will be first prompted to enter the password for encrypting keys you set above. Enter the password to proceed.
Next, you are required to generate random seed for use in creating of your keys by typing any keys on the keyboard until the progress meter is full. Once it is full, press enter to continue.
...
Continue typing until the progress meter is full:
|************************************************************|
Finished. Press enter to continue: ENTER
- Next, type y to specify that this is a CA certificate being generated.
- Press ENTER for the path length
- Enter n to specify that this is not a critical extension.
Generating key. This may take a few moments...
Is this a CA certificate [y/N]?
y
Enter the path length constraint, enter to skip [<0 for unlimited path]: > ENTER
Is this a critical extension [y/N]?
n
Generate the VPN Server Certificate
Next, generate the server certificate signed using the CA created above and assign extensions to it.
certutil -S -c "Kifarunix-demo CA" -n "vpn.kifarunix-demo.com" \
-s "O=Kifarunix-demo,CN=vpn.kifarunix-demo.com" -k rsa -g 4096 \
-v 12 -d sql:/etc/ipsec.d/certsdb -t ",," -1 -6 -8 "vpn.kifarunix-demo.com"Similarly, enter the keys encryption password, generate the seed from the keyboard and press ENTER to continue.
Define the key and the key extension usage.
Generating key. This may take a few moments...
0 - Digital Signature
1 - Non-repudiation
2 - Key encipherment
3 - Data encipherment
4 - Key agreement
5 - Cert signing key
6 - CRL signing key
Other to finish
> 0
0 - Digital Signature
1 - Non-repudiation
2 - Key encipherment
3 - Data encipherment
4 - Key agreement
5 - Cert signing key
6 - CRL signing key
Other to finish
> 2
0 - Digital Signature
1 - Non-repudiation
2 - Key encipherment
3 - Data encipherment
4 - Key agreement
5 - Cert signing key
6 - CRL signing key
Other to finish
> 8
Is this a critical extension [y/N]?
n
0 - Server Auth
1 - Client Auth
2 - Code Signing
3 - Email Protection
4 - Timestamp
5 - OCSP Responder
6 - Step-up
7 - Microsoft Trust List Signing
Other to finish
> 0
0 - Server Auth
1 - Client Auth
2 - Code Signing
3 - Email Protection
4 - Timestamp
5 - OCSP Responder
6 - Step-up
7 - Microsoft Trust List Signing
Other to finish
> 8
Is this a critical extension [y/N]?
N
Generate the VPN Client Certificate (for the road warrior)
Run the command below to generate a VPN client certificate. Replace the name of the certificate (hostname used here) with the name of the host whose client certificate you are generating for;
certutil -S -c "Kifarunix-demo CA" -n "janedoe.kifarunix-demo.com" \
-s "O=Kifarunix-demo,CN=janedoe.kifarunix-demo.com" -k rsa -g 4096 \
-v 12 -d sql:/etc/ipsec.d/certsdb -t ",," -1 -6 -8 "janedoe.kifarunix-demo.com"Similarly, enter the same options as above.
Listing the Available Certificates in the database
certutil -L -d sql:/etc/ipsec.d/certsdbCertificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Kifarunix-demo CA CTu,u,u
vpn.kifarunix-demo.com u,u,u
janedoe.kifarunix-demo.com u,u,u
johndoe.kifarunix-demo.com u,u,u
Export and import the gateway certificate into the pluto DB.
pk12util -o vpn.kifarunix-demo.com.p12 -n "vpn.kifarunix-demo.com" -d sql:/etc/ipsec.d/certsdbYou can skip the PKCS12 password.
lsvpn.kifarunix-demo.com.p12Once exported, Import the VPN server certificate to DB.
ipsec import vpn.kifarunix-demo.com.p12Export the client host certificates, private key, and CA certificate. All these will be stored in a .p12 file as specified output file in the command below.
pk12util -o janedoe.kifarunix-demo.com.p12 -n "janedoe.kifarunix-demo.com" -d sql:/etc/ipsec.d/certsdbSimilarly, skip the PKCS12 password.
lsjanedoe.kifarunix-demo.com.p12 vpn.kifarunix-demo.com.p12If you have generated certificates for other client hosts, you can as well export them.
Create IPSec VPN Endpoint Configuration file
On your IPSec VPN host, create a configuration file on /etc/ipsec.d directory for your mobile clients.
/etc/ipsec.conf is the default configuration file for Libreswan and it has a directive to include other configurations defined on /etc/ipsec.d directory.
vim /etc/ipsec.d/mobile-clients.confPut the following configurations on the file above.
conn roadwarriors
left=vpn.kifarunix-demo.com
leftsubnet=0.0.0.0/0
leftcert=vpn.kifarunix-demo.com
leftid=%fromcert
leftrsasigkey=%cert
leftsendcert=always
right=%any
rightaddresspool=10.0.8.10-10.0.8.254
rightca=%same
rightrsasigkey=%cert
modecfgdns="8.8.8.8,10.0.8.1"
authby=rsasig
auto=start
dpddelay=60
dpdtimeout=300
dpdaction=clear
mobike=yes
ikev2=insist
fragmentation=yes
type=tunnel
Refer to man ipsec.conf for a comprehensive description of the options used above.
Verify the configuration file for any errors;
/usr/libexec/ipsec/addconn --config /etc/ipsec.conf --checkconfigIf there is no error, command exit with 0 status.
echo $?Otherwise, any error is displayed on the standard output. Fix the errors before you can proceed.
Enable IPsec logging by uncommenting the line, #logfile=/var/log/pluto.log, on the /etc/ipsec.conf configuration.
config setup
# Normally, pluto logs via syslog.
logfile=/var/log/pluto.log
...Verify IPsec Configuration
To confirm that the IPsec configuration is fine, simply run the command below;
ipsec verify
Verifying installed system and configuration files
Version check and ipsec on-path [OK]
Libreswan 4.4 (netkey) on 4.18.0-348.20.1.el8_5.x86_64
Checking for IPsec support in kernel [OK]
NETKEY: Testing XFRM related proc values
ICMP default/send_redirects [OK]
ICMP default/accept_redirects [OK]
XFRM larval drop [OK]
Pluto ipsec.conf syntax [OK]
Checking rp_filter [OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for IKE/NAT-T on udp 4500 [OK]
Pluto ipsec.secret syntax [OK]
Checking 'ip' command [OK]
Checking 'iptables' command [OK]
Checking 'prelink' command does not interfere with FIPS [OK]
Checking for obsolete ipsec.conf options [OK]
Restart IPsec;
systemctl restart ipsecCheck status;
systemctl status ipsecIf ipsec fails to start, there must be a configuration syntax error. Run the command below to pinpoint the error.
journalctl -xeDisable rp_filter for Libreswan and reload all Kernel configurations.
echo "net.ipv4.conf.all.rp_filter = 0" >> /etc/sysctl.d/50-libreswan.confsysctl --systemYou can also check the status using the command;
ipsec status
000 using kernel interface: xfrm
000
000 interface lo UDP [::1]:500
000 interface lo UDP 127.0.0.1:4500
000 interface lo UDP 127.0.0.1:500
000 interface enp0s3 UDP 10.0.2.15:4500
000 interface enp0s3 UDP 10.0.2.15:500
000 interface enp0s8 UDP 192.168.58.43:4500
000 interface enp0s8 UDP 192.168.58.43:500
000
000 fips mode=disabled;
000 SElinux=enabled
000 seccomp=disabled
000
000 config setup options:
000
000 configdir=/etc, configfile=/etc/ipsec.conf, secrets=/etc/ipsec.secrets, ipsecdir=/etc/ipsec.d
000 nssdir=/etc/ipsec.d, dumpdir=/run/pluto, statsbin=unset
000 dnssec-rootkey-file=/var/lib/unbound/root.key, dnssec-trusted=
000 sbindir=/usr/sbin, libexecdir=/usr/libexec/ipsec
000 pluto_version=4.4, pluto_vendorid=OE-Libreswan-4.4, audit-log=yes
000 nhelpers=-1, uniqueids=yes, dnssec-enable=yes, logappend=yes, logip=yes, shuntlifetime=900s, xfrmlifetime=30s
000 ddos-cookies-threshold=25000, ddos-max-halfopen=50000, ddos-mode=auto, ikev1-policy=accept
000 ikebuf=0, msg_errqueue=yes, crl-strict=no, crlcheckinterval=0, listen=, nflog-all=0
000 ocsp-enable=no, ocsp-strict=no, ocsp-timeout=2, ocsp-uri=
000 ocsp-trust-name=
000 ocsp-cache-size=1000, ocsp-cache-min-age=3600, ocsp-cache-max-age=86400, ocsp-method=get
000 global-redirect=no, global-redirect-to=
000 secctx-attr-type=32001
000 debug:
000
000 nat-traversal=yes, keep-alive=20, nat-ikeport=4500
000 virtual-private (%priv):
000 - allowed subnets: 192.168.0.0/16, 172.16.0.0/12, 25.0.0.0/8, 100.64.0.0/10, fd00::/8, fe80::/10,
000
000 Kernel algorithms supported:
000
000 algorithm ESP encrypt: name=3DES_CBC, keysizemin=192, keysizemax=192
000 algorithm ESP encrypt: name=AES_CBC, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_CCM_12, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_CCM_16, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_CCM_8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_CTR, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_GCM_12, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_GCM_16, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=AES_GCM_8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=CAMELLIA_CBC, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: name=CHACHA20_POLY1305, keysizemin=256, keysizemax=256
000 algorithm ESP encrypt: name=NULL, keysizemin=0, keysizemax=0
000 algorithm ESP encrypt: name=NULL_AUTH_AES_GMAC, keysizemin=128, keysizemax=256
000 algorithm AH/ESP auth: name=AES_CMAC_96, key-length=128
000 algorithm AH/ESP auth: name=AES_XCBC_96, key-length=128
000 algorithm AH/ESP auth: name=HMAC_MD5_96, key-length=128
000 algorithm AH/ESP auth: name=HMAC_SHA1_96, key-length=160
000 algorithm AH/ESP auth: name=HMAC_SHA2_256_128, key-length=256
000 algorithm AH/ESP auth: name=HMAC_SHA2_256_TRUNCBUG, key-length=256
000 algorithm AH/ESP auth: name=HMAC_SHA2_384_192, key-length=384
000 algorithm AH/ESP auth: name=HMAC_SHA2_512_256, key-length=512
000 algorithm AH/ESP auth: name=NONE, key-length=0
000
000 IKE algorithms supported:
000
000 algorithm IKE encrypt: v1id=5, v1name=OAKLEY_3DES_CBC, v2id=3, v2name=3DES, blocksize=8, keydeflen=192
000 algorithm IKE encrypt: v1id=8, v1name=OAKLEY_CAMELLIA_CBC, v2id=23, v2name=CAMELLIA_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=20, v2name=AES_GCM_C, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=19, v2name=AES_GCM_B, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=18, v2name=AES_GCM_A, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=13, v1name=OAKLEY_AES_CTR, v2id=13, v2name=AES_CTR, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=7, v1name=OAKLEY_AES_CBC, v2id=12, v2name=AES_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=-1, v1name=n/a, v2id=28, v2name=CHACHA20_POLY1305, blocksize=16, keydeflen=256
000 algorithm IKE PRF: name=HMAC_MD5, hashlen=16
000 algorithm IKE PRF: name=HMAC_SHA1, hashlen=20
000 algorithm IKE PRF: name=HMAC_SHA2_256, hashlen=32
000 algorithm IKE PRF: name=HMAC_SHA2_384, hashlen=48
000 algorithm IKE PRF: name=HMAC_SHA2_512, hashlen=64
000 algorithm IKE PRF: name=AES_XCBC, hashlen=16
000 algorithm IKE DH Key Exchange: name=MODP1024, bits=1024
000 algorithm IKE DH Key Exchange: name=MODP1536, bits=1536
000 algorithm IKE DH Key Exchange: name=MODP2048, bits=2048
000 algorithm IKE DH Key Exchange: name=MODP3072, bits=3072
000 algorithm IKE DH Key Exchange: name=MODP4096, bits=4096
000 algorithm IKE DH Key Exchange: name=MODP6144, bits=6144
000 algorithm IKE DH Key Exchange: name=MODP8192, bits=8192
000 algorithm IKE DH Key Exchange: name=DH19, bits=512
000 algorithm IKE DH Key Exchange: name=DH20, bits=768
000 algorithm IKE DH Key Exchange: name=DH21, bits=1056
000 algorithm IKE DH Key Exchange: name=DH31, bits=256
000
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0}
000
000 Connection list:
000
000 "roadwarriors": 0.0.0.0/0===192.168.58.43[CN=vpn.kifarunix-demo.com, O=Kifarunix-demo,MS+S=C]...%any[+MC+S=C]; unrouted; eroute owner: #0
000 "roadwarriors": oriented; my_ip=unset; their_ip=unset; mycert=vpn.kifarunix-demo.com; my_updown=ipsec _updown;
000 "roadwarriors": xauth us:none, xauth them:none, my_username=[any]; their_username=[any]
000 "roadwarriors": our auth:rsasig, their auth:rsasig
000 "roadwarriors": modecfg info: us:server, them:client, modecfg policy:push, dns:8.8.8.8,10.0.8.1, domains:unset, cat:unset;
000 "roadwarriors": sec_label:unset;
000 "roadwarriors": CAs: 'CN=Kifarunix-demo CA, O=Kifarunix-demo'...'CN=Kifarunix-demo CA, O=Kifarunix-demo'
000 "roadwarriors": ike_life: 28800s; ipsec_life: 28800s; replay_window: 32; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0;
000 "roadwarriors": retransmit-interval: 500ms; retransmit-timeout: 60s; iketcp:no; iketcp-port:4500;
000 "roadwarriors": initial-contact:no; cisco-unity:no; fake-strongswan:no; send-vendorid:no; send-no-esp-tfc:no;
000 "roadwarriors": policy: IKEv2+RSASIG+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+MOBIKE+ESN_NO+RSASIG_v1_5;
000 "roadwarriors": v2-auth-hash-policy: none;
000 "roadwarriors": conn_prio: 0,0; interface: enp0s8; metric: 0; mtu: unset; sa_prio:auto; sa_tfc:none;
000 "roadwarriors": nflog-group: unset; mark: unset; vti-iface:unset; vti-routing:no; vti-shared:no; nic-offload:auto;
000 "roadwarriors": our idtype: ID_DER_ASN1_DN; our id=CN=vpn.kifarunix-demo.com, O=Kifarunix-demo; their idtype: %none; their id=(none)
000 "roadwarriors": dpd: action:clear; delay:60; timeout:300; nat-t: encaps:auto; nat_keepalive:yes; ikev1_natt:both
000 "roadwarriors": newest ISAKMP SA: #0; newest IPsec SA: #0; conn serial: $1;
000 "roadwarriors": IKE algorithms: AES_GCM_16_256-HMAC_SHA2_512+HMAC_SHA2_256-DH19+DH20+DH21+MODP2048+MODP3072+MODP4096+MODP8192, CHACHA20_POLY1305-HMAC_SHA2_512+HMAC_SHA2_256-DH19+DH20+DH21+MODP2048+MODP3072+MODP4096+MODP8192, AES_CBC_256-HMAC_SHA2_512+HMAC_SHA2_256-DH19+DH20+DH21+MODP2048+MODP3072+MODP4096+MODP8192, AES_GCM_16_128-HMAC_SHA2_512+HMAC_SHA2_256-DH19+DH20+DH21+MODP2048+MODP3072+MODP4096+MODP8192, AES_CBC_128-HMAC_SHA2_256-DH19+DH20+DH21+MODP2048+MODP3072+MODP4096+MODP8192
000 "roadwarriors": ESP algorithms: AES_GCM_16_256-NONE, CHACHA20_POLY1305-NONE, AES_CBC_256-HMAC_SHA2_512_256+HMAC_SHA1_96+HMAC_SHA2_256_128, AES_GCM_16_128-NONE, AES_CBC_128-HMAC_SHA1_96+HMAC_SHA2_256_128
000 "roadwarriors"[12]: 0.0.0.0/0===192.168.58.43[CN=vpn.kifarunix-demo.com, O=Kifarunix-demo,MS+S=C]...192.168.58.1[CN=janedoe.kifarunix-demo.com, O=Kifarunix-demo,+MC+S=C]===10.0.8.10/32; erouted; eroute owner: #12
000 "roadwarriors"[12]: oriented; my_ip=unset; their_ip=unset; mycert=vpn.kifarunix-demo.com; my_updown=ipsec _updown;
000 "roadwarriors"[12]: xauth us:none, xauth them:none, my_username=[any]; their_username=[any]
000 "roadwarriors"[12]: our auth:rsasig, their auth:rsasig
000 "roadwarriors"[12]: modecfg info: us:server, them:client, modecfg policy:push, dns:8.8.8.8, domains:unset, cat:unset;
000 "roadwarriors"[12]: sec_label:unset;
000 "roadwarriors"[12]: CAs: 'CN=Kifarunix-demo CA, O=Kifarunix-demo'...'CN=Kifarunix-demo CA, O=Kifarunix-demo'
000 "roadwarriors"[12]: ike_life: 28800s; ipsec_life: 28800s; replay_window: 32; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0;
000 "roadwarriors"[12]: retransmit-interval: 500ms; retransmit-timeout: 60s; iketcp:no; iketcp-port:4500;
000 "roadwarriors"[12]: initial-contact:no; cisco-unity:no; fake-strongswan:no; send-vendorid:no; send-no-esp-tfc:no;
000 "roadwarriors"[12]: policy: IKEv2+RSASIG+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+MOBIKE+ESN_NO+RSASIG_v1_5;
000 "roadwarriors"[12]: v2-auth-hash-policy: none;
000 "roadwarriors"[12]: conn_prio: 0,32; interface: enp0s8; metric: 0; mtu: unset; sa_prio:auto; sa_tfc:none;
000 "roadwarriors"[12]: nflog-group: unset; mark: unset; vti-iface:unset; vti-routing:no; vti-shared:no; nic-offload:auto;
000 "roadwarriors"[12]: our idtype: ID_DER_ASN1_DN; our id=CN=vpn.kifarunix-demo.com, O=Kifarunix-demo; their idtype: ID_DER_ASN1_DN; their id=CN=janedoe.kifarunix-demo.com, O=Kifarunix-demo
000 "roadwarriors"[12]: dpd: action:clear; delay:60; timeout:300; nat-t: encaps:auto; nat_keepalive:yes; ikev1_natt:both
000 "roadwarriors"[12]: newest ISAKMP SA: #11; newest IPsec SA: #12; conn serial: $13, instantiated from: $1;
000 "roadwarriors"[12]: IKE algorithms: AES_GCM_16_256-HMAC_SHA2_512+HMAC_SHA2_256-DH19+DH20+DH21+MODP2048+MODP3072+MODP4096+MODP8192, CHACHA20_POLY1305-HMAC_SHA2_512+HMAC_SHA2_256-DH19+DH20+DH21+MODP2048+MODP3072+MODP4096+MODP8192, AES_CBC_256-HMAC_SHA2_512+HMAC_SHA2_256-DH19+DH20+DH21+MODP2048+MODP3072+MODP4096+MODP8192, AES_GCM_16_128-HMAC_SHA2_512+HMAC_SHA2_256-DH19+DH20+DH21+MODP2048+MODP3072+MODP4096+MODP8192, AES_CBC_128-HMAC_SHA2_256-DH19+DH20+DH21+MODP2048+MODP3072+MODP4096+MODP8192
000 "roadwarriors"[12]: IKEv2 algorithm newest: AES_GCM_16_256-HMAC_SHA2_512-DH19
000 "roadwarriors"[12]: ESP algorithms: AES_GCM_16_256-NONE, CHACHA20_POLY1305-NONE, AES_CBC_256-HMAC_SHA2_512_256+HMAC_SHA1_96+HMAC_SHA2_256_128, AES_GCM_16_128-NONE, AES_CBC_128-HMAC_SHA1_96+HMAC_SHA2_256_128
000 "roadwarriors"[12]: ESP algorithm newest: AES_GCM_16_256-NONE; pfsgroup=
000
000 Total IPsec connections: loaded 2, active 1
000
000 State Information: DDoS cookies not required, Accepting new IKE connections
000 IKE SAs: total(1), half-open(0), open(0), authenticated(1), anonymous(0)
000 IPsec SAs: total(1), authenticated(1), anonymous(0)
000
000 #11: "roadwarriors"[12] 192.168.58.1:35535 STATE_V2_ESTABLISHED_IKE_SA (established IKE SA); EVENT_SA_REKEY in 27977s; newest ISAKMP; idle;
000 #12: "roadwarriors"[12] 192.168.58.1:35535 STATE_V2_ESTABLISHED_CHILD_SA (IPsec SA established); EVENT_SA_REKEY in 27978s; newest IPSEC; eroute owner; isakmp#11; idle;
000 #12: "roadwarriors"[12] 192.168.58.1 [email protected] [email protected] [email protected] [email protected] Traffic: ESPin=410B ESPout=0B! ESPmax=0B
000
000 Bare Shunt list:
000
Copy VPN Client Certificates to your Mobile Clients
You can now copy the client certificates to your remote clients and connect to the VPN server.
See how to configure Libreswan IPSec VPN clients by following the link below;
Install and Configure Libreswan VPN Client on Ubuntu/Debian
That brings us to the end of our tutorial.
Further Reading/Reference
Libreswan Configuration Examples
Related Tutorials
Setup IPSec Site-to-Site VPN Tunnel on pfSense
