6

I'm looking for a configuration instructions for IKEv2 VPN that uses pre-shared keys instead of certs (those are different methods for tunnel encryption I'd assume?).

I've followed this wonderful tutorial to get IKEv2 VPN working (with certificate) and it works.

My question is what needs to be changed so that it would use PSK instead? I'd assume changes in /etc/ipsec.secrets and /etc/ipsec.conf are to be made.

My current ipsec.conf looks like this:

config setup
    charondebug="ike 1, knl 1, cfg 0"
    uniqueids=no

conn ikev2-vpn
    auto=add
    compress=no
    type=tunnel
    keyexchange=ikev2
    fragmentation=yes
    forceencaps=yes
    ike=aes256-sha1-modp1024,3des-sha1-modp1024!
    esp=aes256-sha1,3des-sha1!
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%any
    leftid=@server_name_or_ip
    leftcert=/etc/ipsec.d/certs/vpn-server-cert.pem
    leftsendcert=always
    leftsubnet=0.0.0.0/0
    right=%any
    rightid=%any
    rightauth=eap-mschapv2
    rightdns=8.8.8.8,8.8.4.4
    rightsourceip=10.10.10.0/24
    rightsendcert=never
    eap_identity=%identity

UPD: Based on my tinkering and @ChandanK answer, I've made two scripts to deploy a StrongSwan VPN server on a fresh Ubuntu 16.04 install here: https://github.com/truemetal/ikev2_vpn

7

Assuming that you want to setup your right side with psk. This is fairly easy.

1. remove eap_identity and rightsendcert fields. 2. set rightauth=secret

Now edit /etc/ipsec.secrets file:

1. remove "your_username %any% : EAP "your_password"" line. 2. add ": PSK <your_password>"

Then reread the secrets and restart the service.

$sudo ipsec rereadsecrets $sudo ipsec reload $sudo ipsec restart

All set. Follow "Connecting from iOS" and create a new ikev2 vpn connection. In authentication settings select none and put the shared secret key. Hopefully you connect.

Edit:

Based on the comments, configuration changes required to switch to pre-shared key authentication:

config setup
    charondebug="ike 1, knl 1, cfg 0"
    uniqueids=no

conn ikev2-vpn
    auto=add
    compress=no
    type=tunnel
    keyexchange=ikev2
    fragmentation=yes
    forceencaps=yes
    ike=aes256-sha1-modp1024,3des-sha1-modp1024!
    esp=aes256-sha1,3des-sha1!
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%any
    leftid=@server_name_or_ip
    leftsubnet=0.0.0.0/0
    right=%any
    rightid=%any
    rightdns=8.8.8.8,8.8.4.4
    rightsourceip=10.10.10.0/24
    authby=secret

Remove the following line from ipsec.secrets:

server_name_or_ip : RSA "/etc/ipsec.d/private/vpn-server-key.pem

Then reread the secrets and restart the service.

  • Hey. Thanks for your answer. So left is VPN server, and right are iOS clients. I'd probably prefer to keep username/password pair and use PSK instead of cert. I do have to use either cert or PSK, correct? – Dannie P Aug 25 '17 at 12:07
  • Anything should be added to ipsec.conf for PSK? What about leftcert and leftsendcert fields, are those to be removed? – Dannie P Aug 25 '17 at 12:07
  • leftcert and leftsendcert is for server verification with client. In your client side ipsec.conf (on ubuntu client for example) you should have "rightauth=pubkey". Obviously you have to copy server-root-ca.pem at desired location. If your concern is this should also be psk, then remove these two lines and add leftauth=secret. Also you need to change the ipsec.secrets file too to incorporate this change and be careful with ids. Check out this: wiki.strongswan.org/projects/strongswan/wiki/Ipsecsecrets – ChandanK Aug 29 '17 at 16:14
  • 1
    @DenCowboy I think you can try the PSK as shared secret. It works here in macOS settings: evernote.com/l/AYVKjgmPfIVIGZ4csEQjNoSwIgy0R43Q79kB/image.png – Dannie P Jan 23 '18 at 12:11
  • 1
    @DenCowboy yes, right. I've found some time and posted my scripts on github, check it out - maybe you'll find it useful: github.com/truemetal/ikev2_vpn – Dannie P Jan 23 '18 at 13:58
2

Based on my tinkering and @ChandanK answer, I've made two scripts to deploy a StrongSwan VPN server on a fresh Ubuntu 16.04 install here: https://github.com/truemetal/ikev2_vpn

  • Hi I follow your thread and got this error unable to resolve %any, initiate aborted, any idea? – 23r23f23q Jul 4 '18 at 16:20
  • Hey @23r23f23q, I'm not sure what the problem could be, but you might want to check out the deployment demo video on the GitHub repo page - it worked in February. Cheers – Dannie P Jul 4 '18 at 17:04

protected by Community Jun 18 at 4:53

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.