https://leo.leung.xyz/wiki/index.php?action=history&feed=atom&title=StrongSwan 2026-10-14T11:49:54Z Revision history for this page on the wiki MediaWiki 1.43.6 https://leo.leung.xyz/wiki/index.php?title=StrongSwan&diff=4975&oldid=prev 2020-06-14T23:42:23Z

<p>Added categories</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 23:42, 14 June 2020</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l76">Line 76:</td> <td colspan="2" class="diff-lineno">Line 76:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Site B ===</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Site B ===</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Similar to Site A, but with the IPs for A and B swapped.</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Similar to Site A, but with the IPs for A and B swapped.</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">{{Navbox Linux}}[[Category:Linux]]</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">[[Category:LinuxUtilities]]</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">[[Category:Networking]]</ins></div></td></tr> <!-- diff cache key wiki:diff:1.41:old-4073:rev-4975:php=table --> </table>

Leo https://leo.leung.xyz/wiki/index.php?title=StrongSwan&diff=4073&oldid=prev 2019-11-02T21:17:49Z

<p>Created page with &quot;StrongSwan is an opensource IPsec implementation and can be used as a site-to-site VPN. == Installation == Assuming that we have the following sites: * Site A: 3.15.161.169,...&quot;</p> <p><b>New page</b></p><div>StrongSwan is an opensource IPsec implementation and can be used as a site-to-site VPN.<br /> <br /> == Installation ==<br /> Assuming that we have the following sites:<br /> * Site A: 3.15.161.169, 192.168.1.0/24<br /> * Site B: 107.189.11.145, 192.168.2.0/24<br /> <br /> === All Sites ===<br /> On all sites running CentOS 8, install and enable the EPEL repo and then install the StrongSwan package.<br /> {{highlight|lang=terminal|code=<br /> # yum -y install epel-release<br /> # yum -y install strongswan<br /> }}<br /> <br /> Allow IP forward and disable redirects:<br /> {{highlight|lang=terminal|code=<br /> # cat &gt;&gt; /etc/sysctl.conf &lt;&lt;EOF<br /> net.ipv4.ip_forward = 1<br /> net.ipv4.conf.all.accept_redirects = 0<br /> net.ipv4.conf.all.send_redirects = 0<br /> EOF<br /> # sysctl -p /etc/sysctl.conf<br /> }}<br /> <br /> All StrongSwan configs are located in {{code|/etc/strongswan/}}. There are two important files to configure: <br /> # {{code|ipsec.conf}} contains each remote site&#039;s configuration and <br /> # {{code|ipsec.secrets}} contains pre-shared secrets for each remote site.<br /> <br /> A pre-shared secret for each site can be created with {{code|openssl}}:<br /> {{highlight|lang=terminal|code=<br /> openssl rand -base64 64 | tr -d &quot;\r\n=&quot;<br /> }}<br /> <br /> === Site A ===<br /> <br /> On Site A, configure:<br /> <br /> {{code|/etc/strongswan/ipsec.secrets}}:<br /> {{highlight|lang=text|filename=/etc/strongswan/ipsec.secrets|code=<br /> # source destination<br /> 3.15.161.169 107.189.11.145 : PSK &quot;secret&quot;<br /> }}<br /> <br /> {{code|/etc/strongswan/ipsec.conf}}:<br /> {{highlight|lang=text|filename=/etc/strongswan/ipsec.conf|code=<br /> # basic configuration<br /> config setup<br /> charondebug=&quot;all&quot;<br /> uniqueids=yes<br /> strictcrlpolicy=no<br /> <br /> # connection to site B<br /> conn A-to-B<br /> authby=secret<br /> left=%defaultroute<br /> leftid=3.15.161.169<br /> leftsubnet=192.168.1.0/24<br /> right=107.189.11.145<br /> rightsubnet=192.168.2.0/24<br /> ike=aes256-sha2_256-modp1024!<br /> esp=aes256-sha2_256!<br /> keyingtries=0<br /> ikelifetime=1h<br /> lifetime=8h<br /> dpddelay=30<br /> dpdtimeout=120<br /> dpdaction=restart<br /> auto=start<br /> }}<br /> <br /> Masquerade traffic destined to this site from the remote site:<br /> {{highlight|lang=terminal|code=<br /> # iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -d 192.168.1.0/24 -j MASQUERADE<br /> }}<br /> <br /> === Site B ===<br /> Similar to Site A, but with the IPs for A and B swapped.</div>

Leo