Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently set up a strongswan IPSec VPN to access some non-public services of my home server from my android smartphone. I am using OpenVPN on some other devices for the same task, but chose strongswan for the phone, as IKEv2 is supposed (correct me if I am wrong) to be very resource friendly on mobile devices.

The current (openvpn) setup consists of one server (virtual ip: and multiple clients (all in the subnet). The routes on all parties are set up to route only packets through the vpn, that are dedicated to this subnet. (I don't want to access the local subnet of my server from a client and I also don't want to route all the traffic of my clients through the server)

Now I kind of managed to get things going with strongswan (server: 5.0.4, client: official strongswan android app 1.3.0), but I am not completely there yet. First of all, the server configuration:

config setup

conn %default

conn android

This assigns the IP to my phone, but no IP to the server on any if its interfaces, which would be what I want. I can still access my server via the VPN by using its local IP (, which is not really what I intended ;)

I would like to migrate all clients (mostly notebooks) from OpenVPN to strongswan, but the issue above prevents me from making the switch. I tried numerous different strongswan configurations, but none could match my OpenVPN config. Is that even possible, if so how?

share|improve this question

closed as off-topic by MDMarra, mdpc, Bryan, Falcon Momot, Sirex Jul 28 '13 at 22:13

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is a site dedicated to professionals; novice questions are off-topic. Please see the Help Center for more information on topicality. The best advice we can give you is to hire a professional to help you out." – MDMarra, mdpc, Bryan, Falcon Momot, Sirex
If this question can be reworded to fit the rules in the help center, please edit the question.

This question, although interesting, appears to be off-topic because it is about a home setting, please take a look here – dawud Jul 28 '13 at 16:38
Point taken. I didn't know about that policy. However serverfault is full of obvious home settings (e.g. here or here) and I imagine that my question is also relevant for some enterprise applications. Additionally, all the servers that I manage for a living are in the OpenVPN network, so ... ;-) – Fabian Henze Jul 28 '13 at 16:49
up vote 3 down vote accepted

Note that opposed to OpenVPN, StrongSWAN is not intended to be used in this fashion - it does not create virtual interfaces and does not assign virtual IP addresses to both sides of the tunnel. What you definitely could do is adding the address to one of your interfaces on the server side

ip addr add dev eth0

and adding the appropriate "leftsubnet" directive to your config so it would be part of the IPSEC Phase 2 exchange. Needless to say you would need to be using ESP with tunneling in this case.

share|improve this answer
I was under the impression, that I am already using ESP with tunneling. Is that not the case? – Fabian Henze Jul 28 '13 at 16:52
Assigning the IP adress and adding the leftsubnet works, thanks! Could you elaborate what you mean by ESP with tunneling? – Fabian Henze Jul 28 '13 at 17:21
@FabianHenze yes, you do - StrongSwan uses the tunnel mode by default. I just added the remark to make the point that transport mode would not work out with this kind of configuration. – the-wabbit Jul 28 '13 at 21:03
"it does not create virtual interfaces and does not assign virtual IP addresses to both sides of the tunnel." --> How about this: – quanta Jul 22 '15 at 0:47
@quanta it still would not support adding a virtual IP to the server - which is what the OP wanted. As for the clients, it would work, but you would not get separate interfaces unless you are using something like the libipsec plugin – the-wabbit Jul 27 '15 at 10:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.