Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I used Strong Swan (server/client cert) server before with a Windows 8.1 client base and it was a nightmare to configure (that's an understatement). The documentation was poor. I read books on OpenSSL, OpenSwap, and StrongSwan and I could still barely get the job done. And, after getting the job done I couldn't tell Windows to automatically connect, and re-connect and the connection would mysteriously drop.

After that whole experience, what is the easiest method to establish a virtual network if security isn't a high-concern?

I'm faced with the same sets of problems, but now I need to configure a VPN for a heterogeneous Window client base: certainly Windows 7, and Windows 8, and potentially Windows XP.

I mean some of the last configuration even required registry-mucking, and there was no logging and for the longest time it just wouldn't work. When the network changed out from under me, I got no information as to why it wouldn't work. There was no good logging on the client side whatsoever.

I can't imagine this is that difficult a task. I just want a split-network configuration where only VPN-destined traffic goes over the VPN.

Is it easier to configure Windows without openssl/certs, like with a PSK, or with CHAP?

share|improve this question

1 Answer 1

One option might be to use a distro like VyOS (a community fork of Vyatta) which does the hard parts of StrongSwan configuration for you.

It also supports OpenVPN (and PPTP, which I highly disrecommend :-). OpenVPN is quite simple to get working on Windows clients (at least 7 and XP; I'm not sure about its support for Windows 8.x).

share|improve this answer
I was actually going to try OpenVPN this time around because my experience with Strong Swan was so incredibly negative. Is there any reason why you dis-recommend it? –  Evan Carroll Jan 27 at 9:17
Edited to clarify that I'm disrecommending PPTP, not OpenVPN. –  Paul Gear Jan 27 at 9:19
I'll agree with you on OpenVPN for client VPNs. That use case is what it excels at. IPSec is great for more "infrastructure" VPNs, between networks where the IP addresses of the two endpoints and networks behind the endpoints are predictable. For that use case, I wouldn't use anything other than IPSec. IPSec can certainly be used for client "mobile" VPNs, but it's quite clumsy compared to other options. –  EEAA Jan 30 at 18:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.