1

Environment: Debian 10, KDE, Full desktop

# ipsec --version Linux strongSwan U5.7.2/K4.19.0-6-amd64 # swanctl --version strongSwan swanctl 5.7.2 # systemctl status strongswan ● strongswan.service - strongSwan IPsec IKEv1/IKEv2 daemon using ipsec.conf Loaded: loaded (/lib/systemd/system/strongswan.service; enabled; vendor preset: enabled) Active: inactive (dead) since Fri 2019-12-13 09:35:03 -03; 4h 34min ago Process: 6067 ExecStart=/usr/sbin/ipsec start --nofork (code=exited, status=0/SUCCESS) Main PID: 6067 (code=exited, status=0/SUCCESS) # systemctl status strongswan-swanctl ● strongswan-swanctl.service - strongSwan IPsec IKEv1/IKEv2 daemon using swanctl Loaded: loaded (/lib/systemd/system/strongswan-swanctl.service; enabled; vendor preset: enabled) Active: active (running) since Fri 2019-12-13 09:11:34 -03; 4h 56min ago Main PID: 6373 (charon-systemd) Status: "charon-systemd running, strongSwan 5.7.2, Linux 4.19.0-6-amd64, x86_64" Tasks: 17 (limit: 4915) Memory: 8.5M CGroup: /system.slice/strongswan-swanctl.service └─6373 /usr/sbin/charon-systemd

After spending almost two days learning and poking around IPSec and IKEv2 I managed to connect to the company gateway (Lancom LCOS, IKEv2 PSK, User-FQDN identities) using strongswan and swanctl.

After a reboot I have to run the following commands:

sudo /usr/sbin/swanctl --load-all 
no files found matching '/etc/swanctl/conf.d/*.conf' loaded ike secret 'ike' no authorities found, 0 unloaded no pools found, 0 unloaded loaded connection 'IKEv2PSK' successfully loaded 1 connections, 0 unloaded

and then sudo /usr/sbin/swanctl --initiate --child myVpn

[IKE] establishing CHILD_SA myVpn{2} ... lots of log lines ... initiate completed successfully

I'd like to have the tunnel started automatically, maybe using a systemd unit something like

sudo systemctl swanctl-myVpn start

However I don't find any documentation how to achieve this, which also makes me wonder if this is a bad idea?

Improve this question
3
  • Do you use the charon-systemd daemon? Or the old starter/charon combintation? Which strongSwan version do you use? Also note that the NetworkManager frontend uses a completely separate IKE daemon (charon-nm) that is not configured with swantl.conf/vici. Commented Dec 13, 2019 at 16:43
  • ummmm, good question. I guess the newer charon-systemd daemon is running, I posted the status summary above. Commented Dec 13, 2019 at 17:13
  • 1
    That systemd service unit should automatically load the config when the daemon starts. Check the documentation on how to initiate connections automatically (keyword: start_action). Commented Dec 13, 2019 at 18:23

2 Answers 2

Reset to default
2

@ecdsa pointed me into the right direction. Adding a start_action to the config is the solution:

connections { IKEv2PSK { remote_addrs = SOME.DYNDNS-IP.COM, 81.81.81.81 vips = 0.0.0.0 version = 2 dpd_delay = 30 dpd_timeout = 90 proposals = aes256-sha256-modp2048 local { auth = psk id = @@[email protected] } remote { auth = psk id = 81.81.81.81 } children { anicVpn { remote_ts = 192.168.0.0/24 updown = /usr/lib/ipsec/_updown iptables esp_proposals = aes256-sha256-modp2048 start_action = trap # <----- trap: on traffic | start: on boot } } } }

Now a simple ping to a server starts the tunnel. The option start could also be used to get the tunnel up and running directly on system start. Source: swanctl.conf

Update

Note that this doesn't work in Ubuntu, because AppArmor prevents the updown-script from running out of the box

Improve this answer
2

I was able to get the start_action = start option to work on Ubuntu by adding the following to the /etc/strongswan.d/charon.conf file:

# Section containing a list of scripts (name = path) that are executed when # the daemon is started. start-scripts { swanctl-creds = swanctl --load-creds --noprompt swanctl-conns = swanctl --load-conns }
Improve this answer
1
  • In the meantime I am on Fedora and managed to integrate my VPN config into Networkmanager, so I can't confirm this currently. But it looks very promising, thanks for sharing. Commented Jun 18, 2023 at 23:29

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.