#strongswan — Public Fediverse posts

Note to self: Just don't touch #ipsec. It's shit all way round and always breaks. Just use something else.

Why?

Every time I want an encrypted tunnel between two public IPs I think like "oh yea, using IPSec here would be easy and straight forward".

And then it never fucking works reliably. And if it does work it stops to work the next time you try to apply the exact same config. And it fails with shit like this...

What have I done wrong?!? Why work sometimes??

#networking #strongswan #ipv6

#strongSwan 6.0.6 has been released ( #IPsec / #VPN / #IKE / #IKEv1 / #IKEv2 / #PostQuantumIKEv2 / #PostQuantumEncryption / #PostQuantum / #X509 / #FreeSWAN ) https://strongswan.org/

How To Set Up An IPsec With IKEv2 VPN Server On An Ubuntu Linux Cloud Server (VPS) https://youtu.be/RdgoB8HBx-I #Websplaining #IKEv2 #IPsec #VPN #VPS #CloudServer #VirtualPrivateServer #Ubuntu #Linux #strongSwan #hwdsl2 #Libreswan #xl2tpd #L2TP #Cisco #XAuth #VirualPrivateNetwork

A 15-year-old flaw in strongSwan lets attackers crash VPNs using a simple integer underflow flaw. No auth needed, affects versions used for over a decade. Patch now.

Read: https://hackread.com/strongswan-flaw-attackers-crash-vpn-integer-underflow/

#CyberSecurity #Infosec #VPN #Vulnerability #strongSwan

CVE Alert: CVE-2026-25075 - strongSwan - strongSwan - https://www.redpacketsecurity.com/cve-alert-cve-2026-25075-strongswan-strongswan/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-25075 #strongswan #

Da muss man auch erst mal drauf kommen dass das #vici plugin für #strongswan im Paket strongswan-swanctl steckt.

Anything missing for a general purpose x86 router?
#StrongSwan for my reverse proxy setup, and #netbird eventually for future usage.

#OpenWRT

Wow! After delving into IPSec strongSwan rekeying, I now know that the initial 'data key' (Child SA) is like a quick handshake with no fancy secret exchange (PFS) (RTFM! [1]). However, for rekeys, it's full secret agent handshake mode! Writing the GitHub bug report, which turned out not to be a bug, helped me to understand my situation better. [2] Finally migrated to the new IPSEC connection setup in OPNsense and updated my blog post. [3]

(Now I expect to get answers, aka 'Use WireGuard!')

[1]: https://docs.strongswan.org/docs/latest/config/rekeying.html#_ikev2
[2]: https://github.com/opnsense/core/issues/8631
[3]: https://du.nkel.dev/blog/2021-11-19_pfsense_opnsense_ipsec_cgnat/

#IPsec #PFS #strongSwan #GeekAdventures #OPNsense

I am struggling to get my #archlinux IKE2 VPN working. I used to be able to just add the certificate and private key with the NetworkManager plug- in but now it complains about not being able to find the private key.

#strongswan

Харденинг strongSwan на всякий постквантовый

strongSwan — опенсорсная имплементация IPsec, фреймворка VPN. Несмотря на полувековой стаж, проект продолжает развиваться: последняя на сегодня версия приложения вышла в декабре. У него подробная документация , есть блог с CVE и публичная база тестов . По полезной пропускной способности, задержке и утилизации CPU strongSwan превосходит Wireguard, но остаётся в тени — из-за сложности и малой пригодности для обхода блокировок. Зато перед теми, кто не ленится, он открывает широкий простор для экспериментов.

https://habr.com/ru/articles/887458/

#strongswan #mlkem #ppk #криптографические_алгоритмы

@lns Amen! I use strongSwan (maybe even more complex than ovpn?) but have it all tooled up, and not that impressed with #wg except on #pi4 and earlier where it smokes. But both #ovpn and #strongswan pretty much match it on a #pi5. I also like that literally EVERY OS has built-in drivers for strongSwan (#ipsec). https://github.com/gitbls/pistrong

#strongSwan VPN Client (An easy to use #IKEv2/#IPsec -based #VPN client.)
https://f-droid.org/packages/org.strongswan.android/
https://github.com/strongswan/strongswan
#android

@maswan @mhoye
I am surprised nobody has mentioned Cisco. They have made hardware so difficult to deploy with all their licensing BS that I'm now looking at alternatives such as #wireguard and #StrongSwan for VPN solutions.

#strongSwan 6.0.0 has been released (#IPsec / #VPN / #IKE / #IKEv1 / #IKEv2 / #PostQuantumIKEv2 / #PostQuantumEncryption / #PostQuantum / #X509 / #FreeSWAN) https://strongswan.org

Мониторинг ipsec strongSwan

Всем привет! Работая DevOps-инженером, я задумался о мониторинге IPsec-туннелей, которых у нас уже накопилось достаточно. Они в основном используются для связи между облаками, так как инфраструктура разнесена — например, dev и prod живут у разных облачных провайдеров. Также есть интеграции со сторонними организациями, кластеры Kubernetes в AWS, GCP и т.д. Основная цель — получать алерты о падении туннеля раньше, чем сработают алерты о недоступности сервисов. Это особенно важно, поскольку Prometheus у нас один, он живёт в одном из облаков, а prometheus-stack в Kubernetes-кластерах работают в режиме агентов. Первая проблема - выбор экспортера или разработка своего Изначально наткнулся на экспортер от dennisstritzke , но проект уже архивный, последний релиз датируется сентябрем 2021 года, в README автор рекомендует использовать более свежий и поддерживаемый экспортер . Однако он использует VICI , соответственно необходима миграция с более старого подхода конфигурирования с помощью ipsec.conf на swanctl.conf. В документации есть подробное описание , и даже ссылка на скрипт-конвертор . Но зачем ломать то, что уже работает, пусть даже и deprecated? В итоге написал свой python скрипт, который дергает ipsec status, парсит вывод и формирует необходимые мне метрики для Prometheus.

https://habr.com/ru/articles/862506/

#prometheus #ipsec #strongswan

Bouncing around a few things today.

- Building custom #OpenWrt images for $dayjob to run on modified BT Home Hub 5a units
- Connecting to a test BT Hub 5a over TTL to see what's going on during boot
- Trying to remember #Strongswan configs for talking to Cisco ASAs over IPsec VPN, again for $dayjob
- Building #MAME 0.266 on #HaikuOS R1B5 in the background, because MAME 0.269 and 0.270 are failing and I don't know why
- Dipping into #CTRAN's #ObjectPascal source when I want a break (!!!)

@dan_nanni Nice. Aligns pretty well with the numbers I saw testing #strongSwan and #wireguard #VPN on #pi4 vs #pi5. #openVPN performance is said, but has flexible port/protocol features so a partial pass 👍

Интеграция защищённого контура в Yandex Cloud: делимся опытом

В этой небольшой статье расскажу, как мы организовали нашему клиенту закрытый контур в Yandex Cloud. Если конкретнее: покажу, как настроить StrongSwan site-to-site IKEv2 ipsec tunnel, а потом — инфраструктуру, состоящую в основном из кластера Kubernetes, GitLab, Vault и Keycloak. Приятного чтения! Посмотреть, как реализован закрытый контур

https://habr.com/ru/companies/nixys/articles/830694/

#yandexcloud #закрытый_контур #импортозамещение #usergate #kubernetes #keycloak #сertmanager #terraform #ikev2 #strongswan

@corenominal I've been using a #strongSwan #VPN server for years...love it! And on a Pi5 server it runs much closer to line speed.

Is anyone aware of work on having a way to establish #Wireguard tunnels using a private #ed25519 key that stays on a PKCS#11 token? That would need an userland session establishment likely. So far a #strongSwan based #IPsec solution does better to protect the credentials.

If anyone is familiar with IPsec or strongSwan: I would like to use IPsec as an alternative to WireGuard and keep the configuration simple and secure, but I can't manage to create a configuration file that works.

https://github.com/strongswan/strongswan/discussions/2154

#IPsec #strongSwan #dn42 #Tunneling #Networking

When we implemented live log display in #FRR|'s CLI client, it was an amazing feature but I didn't think much of it. Now I've seen #strongSwan|'s swanctl do even better (it seems to explicitly show logs related to the SA you're dealing with), and it's driving me to a conclusion:

All long-running daemons with a control interface need to do this. It's a basic UX requirement.

And this shouldn't just be "tail -f" on the log, it should show context-relevant low priority messages disabled elsewhere.

Can anyone tell me, how to connect to a #sophos #ipsec #vpn using #linux? I have configuration files (.scx and .tgb) at hand... is there a simple way to convert these files to something like #strongswan or #openvpn?

Today we tried to debug a #strongSwan based #neutron VPNaaS setup on a Ubuntu based #OpenStack 2023.1 #Antelope deployment.

As a first approach we expected hints in the syslog messages, but we find....

No charon logs (but `ps ax` shows that charon is running!). Absolutely nothing, nil, null, None, SILENCE! 😧

We need to go deeper... ⛏️

(1/5)

Quick and easy #strongswan #VPN install/management tool. Video: https://youtu.be/gDvglvgtYzY Tool: https://github.com/gitbls/pistrong

J’ai passé la journée à faire mumuse avec #StrongSwan entre deux machines #FreeBSD pour monter un VPN #IPSec hôte à hôte (l’une étant derrière un double NAT IPv4). J’ai réussi, mais sans obtenir ce que je voulais : j’aurais souhaité que ce VPN se matérialise sous la forme d’une interface réseau où il suffirait de se parler en IPv6 dans la plage fe80::/10, mais ça n’a pas marché.

De manière plus générale, je serais d’ailleurs preneur d’une bonne référence sur IPSec. 🙂