IPSec Strongswan mit Linux Beispiel: Unterschied zwischen den Versionen

Aus Xinux Wiki
Zur Navigation springen Zur Suche springen
 
(3 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt)
Zeile 16: Zeile 16:
 
| '''Pre-Shared Key (PSK)''' || colspan="2" | 123Start$
 
| '''Pre-Shared Key (PSK)''' || colspan="2" | 123Start$
 
|-
 
|-
−
| '''Phase 1''' || colspan="2" | AES256 – SHA256 – DH16
+
| '''Phase 1''' || colspan="2" | AES256 – SHA256 – DH16(modp4096)
 
|-
 
|-
−
| '''Phase 2''' || colspan="2" | AES256 – SHA256 – DH16
+
| '''Phase 2 (esp)''' || colspan="2" | AES256 – SHA256 – DH16(modp4096)
 
|}
 
|}
 +
 +
=Die linke Seite=
 +
*cat /etc/swanctl/conf.d/site-to-site.conf
 +
<pre>
 +
connections {
 +
  site-to-site {
 +
    local_addrs  = 192.168.5.193
 +
    remote_addrs = 192.168.5.194
 +
    mobike = no
 +
    local {
 +
      auth = psk
 +
      id = 192.168.5.193
 +
    }
 +
    remote {
 +
      auth = psk
 +
      id = 192.168.5.194
 +
    }
 +
    children {
 +
      net {
 +
        local_ts  = 172.26.193.0/24
 +
        remote_ts = 172.26.194.0/24
 +
        esp_proposals = aes256-sha256-modp4096
 +
        start_action = start
 +
        close_action = none
 +
        dpd_action = restart
 +
        mode = tunnel
 +
      }
 +
    }
 +
    version = 2
 +
    proposals = aes256-sha256-modp4096
 +
  }
 +
}
 +
secrets {
 +
  ike-1 {
 +
    id-1 = 192.168.5.193
 +
    id-2 = 192.168.5.194
 +
    secret = "123Start$"
 +
  }
 +
}
 +
</pre>
 +
=Die rechte Seite=
 +
*cat /etc/swanctl/conf.d/site-to-site.conf
 +
<pre>
 +
connections {
 +
  site-to-site {
 +
    local_addrs  = 192.168.5.194
 +
    remote_addrs = 192.168.5.193
 +
    mobike = no
 +
    local {
 +
      auth = psk
 +
      id = 192.168.5.194
 +
    }
 +
    remote {
 +
      auth = psk
 +
      id = 192.168.5.193
 +
    }
 +
    children {
 +
      net {
 +
        local_ts  = 172.26.194.0/24
 +
        remote_ts = 172.26.193.0/24
 +
        esp_proposals = aes256-sha256-modp4096
 +
        start_action = start
 +
        close_action = none
 +
        dpd_action = restart
 +
        mode = tunnel
 +
      }
 +
    }
 +
    version = 2
 +
    proposals = aes256-sha256-modp4096
 +
  }
 +
}
 +
secrets {
 +
  ike-1 {
 +
    id-1 = 192.168.5.194
 +
    id-2 = 192.168.5.193
 +
    secret = "123Start$"
 +
  }
 +
}
 +
</pre>

Aktuelle Version vom 3. August 2026, 09:06 Uhr

Installation

  • apt update
  • apt install strongswan strongswan-swanctl

Voraussetzungen

  • Beide Systeme: Linux mit strongSwan und VICI-Unterstützung (swanctl)
  • Nur VICI (swanctl), keine ipsec.conf oder ipsec.secrets
  • XX eigene Seite, gegenüberliegende Seite YY

Szenario

Einstellung links rechts
VPN-GW-IP Address 192.168.5.193 192.168.5.194
Internes Netz 172.26.193.0/24 172.26.194.0/24
Pre-Shared Key (PSK) 123Start$
Phase 1 AES256 – SHA256 – DH16(modp4096)
Phase 2 (esp) AES256 – SHA256 – DH16(modp4096)

Die linke Seite

  • cat /etc/swanctl/conf.d/site-to-site.conf
connections {
  site-to-site {
    local_addrs  = 192.168.5.193
    remote_addrs = 192.168.5.194
    mobike = no
    local {
      auth = psk
      id = 192.168.5.193
    }
    remote {
      auth = psk
      id = 192.168.5.194
    }
    children {
      net {
        local_ts  = 172.26.193.0/24
        remote_ts = 172.26.194.0/24
        esp_proposals = aes256-sha256-modp4096
        start_action = start
        close_action = none
        dpd_action = restart
        mode = tunnel
      }
    }
    version = 2
    proposals = aes256-sha256-modp4096
  }
}
secrets {
  ike-1 {
    id-1 = 192.168.5.193
    id-2 = 192.168.5.194
    secret = "123Start$"
  }
}

Die rechte Seite

  • cat /etc/swanctl/conf.d/site-to-site.conf
connections {
  site-to-site {
    local_addrs  = 192.168.5.194
    remote_addrs = 192.168.5.193
    mobike = no
    local {
      auth = psk
      id = 192.168.5.194
    }
    remote {
      auth = psk
      id = 192.168.5.193
    }
    children {
      net {
        local_ts  = 172.26.194.0/24
        remote_ts = 172.26.193.0/24
        esp_proposals = aes256-sha256-modp4096
        start_action = start
        close_action = none
        dpd_action = restart
        mode = tunnel
      }
    }
    version = 2
    proposals = aes256-sha256-modp4096
  }
}
secrets {
  ike-1 {
    id-1 = 192.168.5.194
    id-2 = 192.168.5.193
    secret = "123Start$"
  }
}
Abgerufen von „https://xinux.net/index.php?title=IPSec_Strongswan_mit_Linux_Beispiel&oldid=72397“