Debian13 StrongSwan IKEv2 VPN für Windows 11 (EAP-MSCHAPv2)

STRONGSWAN EINFACH & SAUBER

• • Nur eine Datei: swanctl.conf** - alles andere löschen!

1. AUFRÄUMEN

# ALLES alte Zeug löschen
sudo rm -f /etc/ipsec.conf /etc/ipsec.secrets
sudo rm -rf /etc/strongswan.d/ /etc/ipsec.d/

# Nur swanctl behalten
sudo systemctl stop strongswan strongswan-swanctl

2. EINE DATEI - ALLES DRIN

/etc/swanctl/swanctl.conf (KOMPLETT ERSETZEN!):

# ============================================
# VPN KONFIGURATION FÜR KIT01-KIT13
# Server: 194.59.156.167
# Netz: 172.24.24.0/24
# ============================================

connections {
    vpn-kit {
        version = 2
        local_addrs = 194.59.156.167
        
        local {
            auth = psk
            id = 194.59.156.167
        }
        
        remote {
            auth = eap-mschapv2
        }
        
        children {
            tunnel {
                local_ts = 0.0.0.0/0
                remote_ts = 172.24.24.0/24
                start_action = trap
            }
        }
    }
}

pools {
    kit-pool {
        addrs = 172.24.24.100-172.24.24.200
    }
}

secrets {
    # Server-PSK (muss sein für IKEv2)
    ike-server {
        id = 194.59.156.167
        secret = "ServerKey123!"
    }
    
    # Benutzer kit01-kit13
    eap-kit01 { id = "kit01"; secret = "12Drei4--" }
    eap-kit02 { id = "kit02"; secret = "12Drei4--" }
    eap-kit03 { id = "kit03"; secret = "12Drei4--" }
    eap-kit04 { id = "kit04"; secret = "12Drei4--" }
    eap-kit05 { id = "kit05"; secret = "12Drei4--" }
    eap-kit06 { id = "kit06"; secret = "12Drei4--" }
    eap-kit07 { id = "kit07"; secret = "12Drei4--" }
    eap-kit08 { id = "kit08"; secret = "12Drei4--" }
    eap-kit09 { id = "kit09"; secret = "12Drei4--" }
    eap-kit10 { id = "kit10"; secret = "12Drei4--" }
    eap-kit11 { id = "kit11"; secret = "12Drei4--" }
    eap-kit12 { id = "kit12"; secret = "12Drei4--" }
    eap-kit13 { id = "kit13"; secret = "12Drei4--" }
}

3. STARTEN

# Konfiguration laden
sudo swanctl --load-all

# Dienst starten
sudo systemctl start strongswan-swanctl
sudo systemctl enable strongswan-swanctl

4. FIREWALL (EINFACH)

# IP Forwarding
sudo sysctl -w net.ipv4.ip_forward=1

# Einfache Regeln
sudo iptables -t nat -A POSTROUTING -s 172.24.24.0/24 -j MASQUERADE
sudo iptables -A FORWARD -s 172.24.24.0/24 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 500 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 4500 -j ACCEPT

5. WINDOWS 11

1. PowerShell als Admin:

# Registry FIX (MUSS!)
Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\RasMan\Parameters" "NegotiateDH2048_AES256" 1
Restart-Service RasMan

2. VPN erstellen: