IPSec Strongswan mit Linux Beispiel: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| Zeile 56: | Zeile 56: | ||
id-1 = 192.168.5.193 | id-1 = 192.168.5.193 | ||
id-2 = 192.168.5.194 | id-2 = 192.168.5.194 | ||
| + | secret = "123Start$" | ||
| + | } | ||
| + | } | ||
| + | </pre> | ||
| + | =Die rechte Seite= | ||
| + | *cat /etc/swanctl/conf.d/site-to-site.conf | ||
| + | <pre> | ||
| + | connections { | ||
| + | site-to-site { | ||
| + | local_addrs = 192.168.5.194 | ||
| + | remote_addrs = 192.168.5.193 | ||
| + | mobike = no | ||
| + | local { | ||
| + | auth = psk | ||
| + | id = 192.168.5.194 | ||
| + | } | ||
| + | remote { | ||
| + | auth = psk | ||
| + | id = 192.168.5.193 | ||
| + | } | ||
| + | children { | ||
| + | net { | ||
| + | local_ts = 172.26.194.0/24 | ||
| + | remote_ts = 172.26.193.0/24 | ||
| + | esp_proposals = aes256-sha256-modp4096 | ||
| + | start_action = start | ||
| + | close_action = none | ||
| + | dpd_action = restart | ||
| + | mode = tunnel | ||
| + | } | ||
| + | } | ||
| + | version = 2 | ||
| + | proposals = aes256-sha256-modp4096 | ||
| + | } | ||
| + | } | ||
| + | secrets { | ||
| + | ike-1 { | ||
| + | id-1 = 192.168.5.194 | ||
| + | id-2 = 192.168.5.193 | ||
secret = "123Start$" | secret = "123Start$" | ||
} | } | ||
} | } | ||
</pre> | </pre> | ||
Aktuelle Version vom 3. August 2026, 09:06 Uhr
Installation
- apt update
- apt install strongswan strongswan-swanctl
Voraussetzungen
- Beide Systeme: Linux mit strongSwan und VICI-Unterstützung (swanctl)
- Nur VICI (swanctl), keine ipsec.conf oder ipsec.secrets
- XX eigene Seite, gegenüberliegende Seite YY
Szenario
| Einstellung | links | rechts |
|---|---|---|
| VPN-GW-IP Address | 192.168.5.193 | 192.168.5.194 |
| Internes Netz | 172.26.193.0/24 | 172.26.194.0/24 |
| Pre-Shared Key (PSK) | 123Start$ | |
| Phase 1 | AES256 – SHA256 – DH16(modp4096) | |
| Phase 2 (esp) | AES256 – SHA256 – DH16(modp4096) | |
Die linke Seite
- cat /etc/swanctl/conf.d/site-to-site.conf
connections {
site-to-site {
local_addrs = 192.168.5.193
remote_addrs = 192.168.5.194
mobike = no
local {
auth = psk
id = 192.168.5.193
}
remote {
auth = psk
id = 192.168.5.194
}
children {
net {
local_ts = 172.26.193.0/24
remote_ts = 172.26.194.0/24
esp_proposals = aes256-sha256-modp4096
start_action = start
close_action = none
dpd_action = restart
mode = tunnel
}
}
version = 2
proposals = aes256-sha256-modp4096
}
}
secrets {
ike-1 {
id-1 = 192.168.5.193
id-2 = 192.168.5.194
secret = "123Start$"
}
}
Die rechte Seite
- cat /etc/swanctl/conf.d/site-to-site.conf
connections {
site-to-site {
local_addrs = 192.168.5.194
remote_addrs = 192.168.5.193
mobike = no
local {
auth = psk
id = 192.168.5.194
}
remote {
auth = psk
id = 192.168.5.193
}
children {
net {
local_ts = 172.26.194.0/24
remote_ts = 172.26.193.0/24
esp_proposals = aes256-sha256-modp4096
start_action = start
close_action = none
dpd_action = restart
mode = tunnel
}
}
version = 2
proposals = aes256-sha256-modp4096
}
}
secrets {
ike-1 {
id-1 = 192.168.5.194
id-2 = 192.168.5.193
secret = "123Start$"
}
}