Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

What's the differences between OpenSwan and StrongSwan? All I found is compartation between outdated FreeSwan and testing version of OpenSwan - i.e. current stable of OpenSwan is 2.6 (3.0 is comparation) and current stable for StrongSwan is 4.4 (4.1.7 in comparation) which seems grossly unfare (there is no point in comparing Windows 98 with Ubuntu 10.10 or Mac OS X 10.7 with Slackware 8.0).

From websites StrongSwan seems to be better maintained while OpenSwan seems to be more popular.

share|improve this question
@Sven my edit was meant to remove irrelevant and outdated stuff (the link is broken by the way) and to broaden the question to a third product (ipsec-tools mentioned in the answer below), but in the end the question stays the same and is still about the differences between the three IPSec stacks. Could you please review the edit again ? Thanks. –  user186340 Jan 1 at 12:47
@AndréDaniel: No, because I really can't. I also think your edit got too far, as it went way beyond fixing links and retroactively widened the scope of the question. Besides, I think this question is off-topic by todays standard. –  Sven Jan 1 at 14:56

2 Answers 2

up vote 12 down vote accepted

Both OpenSwan and StrongSwan are forks for continued development after FreeS/WAN project closed up shop. However, most of the Linux distributions have moved more towards IPsec-Tools since then.

You can use either one for IPsec on Linux, but unless you have a specific need for them, or you are trying to maintain configuration compatibility with older FreeS/WAN setups, you are probably better off using IPsec-Tools and Racoon (ISAKMP daemon from IPsec-Tools) for any new Linux IPSec Setups.

share|improve this answer
Red Hat 6 has moved away from IPSec-Tools and uses OpenSwan now. I still agree with this answer, though. –  joechip Jul 29 '11 at 10:38
Interesting, I hadn't realized they were doing that. I'll have to look into the changes. (Thanks for the tip.) –  Christopher Cashell Aug 1 '11 at 21:12
Looks like Ubuntu is moving from IPsec-Tools to StrongSwan in 14.04: wiki.ubuntu.com/TrustyTahr/ReleaseNotes#strongSwan –  alberge Apr 17 '14 at 21:38
IPSec-tools' racoon and offspring "racoon2" do not seem to be maintained since ~2010 (racoon2.wide.ad.jp/w/?News) –  gatopeich Jun 27 '14 at 13:40
As of RHEL7, it looks like the default IPSec system is Libreswan, a fork of OpenSwan. –  Christopher Cashell Jul 25 '14 at 16:38

Libreswan is the project the Openswan developers created after the company they had originally founded to develop Openswan sued them over the trademark. So Libreswan is what we will discuss here.

The most obvious differences are:

RHEL 7 ships Libreswan, though StrongSwan is available in EPEL.

IPSec-tools was a port of the KAME IPSec userland from BSD to Linux. It appears to be no longer maintained.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.