Strongswan für native Windows Client

StrongSwan IKEv2: Installation & Zertifikate (Minimalform)

StrongSwan installieren

• apt update
• apt install strongswan strongswan-swanctl libcharon-extra-plugins libstrongswan-extra-plugins

CA, Request, Signierung (Minimal für Windows IKEv2)

CA erstellen

• openssl req -new -x509 -newkey rsa:4096 -nodes -keyout ca.key -out ca.crt -days 3650 -subj "/CN=Echt-Jetzt VPN Root CA"

Server Request und Key erstellen

FQDN=vpn.echt-jetzt.de

• openssl req -new -newkey rsa:2048 -nodes -keyout $FQDN.key -out $FQDN.csr -subj "/CN=$FQDN"

Server Zertifikat signieren

• openssl x509 -req -days 825 -in $FQDN.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out $FQDN.crt -extfile <(cat <<EOF

subjectAltName=DNS:$FQDN,IP:194.59.156.167 extendedKeyUsage=TLS Web Server Authentication,1.3.6.1.5.5.8.2.2 keyUsage=critical,digitalSignature,keyEncipherment EOF )

Zertifikate nach StrongSwan kopieren

Server-Zertifikat

• cp $FQDN.crt /etc/swanctl/x509/server.crt

Server-Key

• cp $FQDN.key /etc/swanctl/private/server.key

CA-Zertifikat

• cp ca.crt /etc/swanctl/x509ca/ca.crt

Credentials laden

• swanctl --load-creds

StrongSwan IKEv2: swanctl Konfiguration (Windows 11, Full Tunnel, NAT)

swanctl Konfiguration

connections {
    rw-eap {
        version = 2
        local_addrs = 194.59.156.167

        proposals = aes256-sha256-modp2048, aes128-sha256-modp2048, aes256-sha1-modp1024, aes128-sha1-modp1024

        local {
            auth = pubkey
            certs = server.crt
            id = vpn.echt-jetzt.de
        }

        remote {
            auth = eap-mschapv2
        }

        children {
            net {
                local_ts = 0.0.0.0/0
                esp_proposals = aes256-sha1, aes128-sha1
                rekey_time = 0
                dpd_action = clear
            }
        }

        pools = vpn-pool
        fragmentation = yes
        encap = yes
        send_certreq = no
        unique = never
    }
}

pools {
    vpn-pool {
        addrs = 172.24.25.0/24
        dns = 1.1.1.1
    }
}

secrets {
    eap-kit01 {
        id = kit01
        secret = 12Drei4--
    }
}

StrongSwan Debugging (korrekt für Debian 12/13)

Konfiguration laden

• swanctl --load-all

Verbindungen prüfen

• swanctl --list-conns
• swanctl --list-sas

Verbindung initiieren

• swanctl --initiate --ike rw-eap

Logs ansehen

• journalctl -u strongswan-starter -f

XFRM Status prüfen

• ip xfrm state
• ip xfrm policy

Dienst neu starten

• systemctl restart strongswan-starter