12

I'm looking for a configuration instructions for IKEv2 VPN that uses pre-shared keys instead of certs (those are different methods for tunnel encryption I'd assume?).

I've followed this wonderful tutorial to get IKEv2 VPN working (with certificate) and it works.

My question is what needs to be changed so that it would use PSK instead? I'd assume changes in /etc/ipsec.secrets and /etc/ipsec.conf are to be made.

My current ipsec.conf looks like this:

config setup
    charondebug="ike 1, knl 1, cfg 0"
    uniqueids=no

conn ikev2-vpn
    auto=add
    compress=no
    type=tunnel
    keyexchange=ikev2
    fragmentation=yes
    forceencaps=yes
    ike=aes256-sha1-modp1024,3des-sha1-modp1024!
    esp=aes256-sha1,3des-sha1!
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%any
    leftid=@server_name_or_ip
    leftcert=/etc/ipsec.d/certs/vpn-server-cert.pem
    leftsendcert=always
    leftsubnet=0.0.0.0/0
    right=%any
    rightid=%any
    rightauth=eap-mschapv2
    rightdns=8.8.8.8,8.8.4.4
    rightsourceip=10.10.10.0/24
    rightsendcert=never
    eap_identity=%identity

UPD: Based on my tinkering and @ChandanK answer, I've made two scripts to deploy a StrongSwan VPN server on a fresh Ubuntu 16.04 install here: https://github.com/truemetal/ikev2_vpn

Improve this question

2 Answers 2

Reset to default
11

Assuming that you want to setup your right side with psk. This is fairly easy.

1. remove eap_identity and rightsendcert fields. 2. set rightauth=secret

Now edit /etc/ipsec.secrets file:

1. remove "your_username %any% : EAP "your_password"" line. 2. add ": PSK <your_password>"

Then reread the secrets and restart the service.

$sudo ipsec rereadsecrets $sudo ipsec reload $sudo ipsec restart

All set. Follow "Connecting from iOS" and create a new ikev2 vpn connection. In authentication settings select none and put the shared secret key. Hopefully you connect.

Edit:

Based on the comments, configuration changes required to switch to pre-shared key authentication:

config setup
    charondebug="ike 1, knl 1, cfg 0"
    uniqueids=no

conn ikev2-vpn
    auto=add
    compress=no
    type=tunnel
    keyexchange=ikev2
    fragmentation=yes
    forceencaps=yes
    ike=aes256-sha1-modp1024,3des-sha1-modp1024!
    esp=aes256-sha1,3des-sha1!
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%any
    leftid=@server_name_or_ip
    leftsubnet=0.0.0.0/0
    right=%any
    rightid=%any
    rightdns=8.8.8.8,8.8.4.4
    rightsourceip=10.10.10.0/24
    authby=secret

Remove the following line from ipsec.secrets:

server_name_or_ip : RSA "/etc/ipsec.d/private/vpn-server-key.pem

Then reread the secrets and restart the service.

Improve this answer
21
  • Hey. Thanks for your answer. So left is VPN server, and right are iOS clients. I'd probably prefer to keep username/password pair and use PSK instead of cert. I do have to use either cert or PSK, correct?
    – Dannie P
    Aug 25, 2017 at 12:07
  • Anything should be added to ipsec.conf for PSK? What about leftcert and leftsendcert fields, are those to be removed?
    – Dannie P
    Aug 25, 2017 at 12:07
  • 1
    For a simple setup: you can remove leftcert and leftsendcert fields. Also remove rightauth=secret and add authby=secret. This will take care both {left|rightauth=psk}. Also remove server_name_or_ip : RSA "/etc/ipsec.d/private/vpn-server-key.pem" from ipsec.secrets file. You don't need this. Finally sudo ipsec rereadsecrets|reload|restart. All set, connect from client.
    – ChandanK
    Aug 31, 2017 at 3:05
  • 1
    @DenCowboy I think you can try the PSK as shared secret. It works here in macOS settings: evernote.com/l/AYVKjgmPfIVIGZ4csEQjNoSwIgy0R43Q79kB/image.png
    – Dannie P
    Jan 23, 2018 at 12:11
  • 1
    @DenCowboy yes, right. I've found some time and posted my scripts on github, check it out - maybe you'll find it useful: github.com/truemetal/ikev2_vpn
    – Dannie P
    Jan 23, 2018 at 13:58
3

Based on my tinkering and @ChandanK answer, I've made two scripts to deploy a StrongSwan VPN server on a fresh Ubuntu 16.04 install here: https://github.com/truemetal/ikev2_vpn

Improve this answer
2
  • Hi I follow your thread and got this error unable to resolve %any, initiate aborted, any idea?
    – 23r23f23q
    Jul 4, 2018 at 16:20
  • Hey @23r23f23q, I'm not sure what the problem could be, but you might want to check out the deployment demo video on the GitHub repo page - it worked in February. Cheers
    – Dannie P
    Jul 4, 2018 at 17:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .