758f0e1418
- Windows 8.x and 10 require the IKEv2 machine certificate to have "Client Auth" EKU in addition to "Server Auth". Otherwise it gives "Error 13806: IKE failed to find valid machine certificate..." - The IKEv2 documentation has been updated to fix this issue - Also, this Libreswan wiki page may need to be updated. @letoams https://libreswan.org/wiki/VPN_server_for_remote_clients_using_IKEv2 - Ref: #106. Thanks @evil-shrike!
12 KiB
How-To: IKEv2 VPN for Windows 7 and newer
Read this in other languages: English, 简体中文.
IMPORTANT: This guide is for Advanced Users ONLY. Other users please use IPsec/L2TP or IPsec/XAuth.
Windows 7 and newer releases support the IKEv2 standard through Microsoft's Agile VPN functionality. Internet Key Exchange (IKE or IKEv2) is the protocol used to set up a Security Association (SA) in the IPsec protocol suite. Compared to IKE version 1, IKEv2 has multiple improvements such as Standard Mobility support through MOBIKE, and improved reliability.
Libreswan can authenticate IKEv2 clients on the basis of X.509 Machine Certificates using RSA signatures. This method does not require an IPsec PSK, username or password. It can be used with:
- Windows 7, 8.x and 10
- Windows Phone 8.1 and above
- strongSwan Android VPN client
- iOS (iPhone/iPad) and OS X (macOS) <-- See link
The following example shows how to configure IKEv2 with Libreswan. Commands below must be run as root.
Before continuing, make sure you have successfully set up your VPN server.
-
Find the public and private IP of your server, and make sure they are not empty. It is OK if they are the same.
$ PUBLIC_IP=$(wget -t 3 -T 15 -qO- http://ipv4.icanhazip.com) $ PRIVATE_IP=$(ip -4 route get 1 | awk '{print $NF;exit}') $ echo "$PUBLIC_IP" (Check the displayed public IP) $ echo "$PRIVATE_IP" (Check the displayed private IP) -
Add a new IKEv2 connection to
/etc/ipsec.conf:$ cat >> /etc/ipsec.conf <<EOF conn ikev2-cp left=$PRIVATE_IP leftcert=$PUBLIC_IP leftid=@$PUBLIC_IP leftsendcert=always leftsubnet=0.0.0.0/0 leftrsasigkey=%cert right=%any rightaddresspool=192.168.43.10-192.168.43.250 rightca=%same rightrsasigkey=%cert modecfgdns1=8.8.8.8 modecfgdns2=8.8.4.4 narrowing=yes dpddelay=30 dpdtimeout=120 dpdaction=clear auto=add ikev2=insist rekey=no fragmentation=yes ike=3des-sha1,3des-sha1;modp1024,aes-sha1,aes-sha1;modp1024,aes-sha2,aes-sha2;modp1024 phase2alg=3des-sha1,aes-sha1,aes-sha2 EOFWe need to add one more line to that file, based on your Libreswan version. Please run command:
$ if /usr/local/sbin/ipsec --version | grep -qs -F "3.19"; then echo " encapsulation=yes" >> /etc/ipsec.conf else echo " forceencaps=yes" >> /etc/ipsec.conf fi -
Generate Certificate Authority (CA) and VPN server certificates:
Note: Specify the certificate validity period (in months) using "-v". e.g. "-v 36".$ certutil -S -x -n "Example CA" -s "O=Example,CN=Example CA" -k rsa -g 4096 -v 36 -d sql:/etc/ipsec.d -t "CT,," -2 A random seed must be generated that will be used in the creation of your key. One of the easiest ways to create a random seed is to use the timing of keystrokes on a keyboard. To begin, type keys on the keyboard until this progress meter is full. DO NOT USE THE AUTOREPEAT FUNCTION ON YOUR KEYBOARD! Continue typing until the progress meter is full: |************************************************************| Finished. Press enter to continue: Generating key. This may take a few moments... Is this a CA certificate [y/N]? y Enter the path length constraint, enter to skip [<0 for unlimited path]: > Is this a critical extension [y/N]? N $ certutil -S -c "Example CA" -n "$PUBLIC_IP" -s "O=Example,CN=$PUBLIC_IP" -k rsa -g 4096 -v 36 -d sql:/etc/ipsec.d -t ",," -1 -6 -8 "$PUBLIC_IP" A random seed must be generated that will be used in the creation of your key. One of the easiest ways to create a random seed is to use the timing of keystrokes on a keyboard. To begin, type keys on the keyboard until this progress meter is full. DO NOT USE THE AUTOREPEAT FUNCTION ON YOUR KEYBOARD! Continue typing until the progress meter is full: |************************************************************| Finished. Press enter to continue: Generating key. This may take a few moments... 0 - Digital Signature 1 - Non-repudiation 2 - Key encipherment 3 - Data encipherment 4 - Key agreement 5 - Cert signing key 6 - CRL signing key Other to finish > 0 0 - Digital Signature 1 - Non-repudiation 2 - Key encipherment 3 - Data encipherment 4 - Key agreement 5 - Cert signing key 6 - CRL signing key Other to finish > 2 0 - Digital Signature 1 - Non-repudiation 2 - Key encipherment 3 - Data encipherment 4 - Key agreement 5 - Cert signing key 6 - CRL signing key Other to finish > 8 Is this a critical extension [y/N]? N 0 - Server Auth 1 - Client Auth 2 - Code Signing 3 - Email Protection 4 - Timestamp 5 - OCSP Responder 6 - Step-up 7 - Microsoft Trust List Signing Other to finish > 0 0 - Server Auth 1 - Client Auth 2 - Code Signing 3 - Email Protection 4 - Timestamp 5 - OCSP Responder 6 - Step-up 7 - Microsoft Trust List Signing Other to finish > 8 Is this a critical extension [y/N]? N -
Generate client certificate(s), and export the
.p12file that contains the client certificate, private key, and CA certificate:$ certutil -S -c "Example CA" -n "vpnclient" -s "O=Example,CN=vpnclient" -k rsa -g 4096 -v 36 -d sql:/etc/ipsec.d -t ",," -1 -6 -8 "vpnclient" A random seed must be generated that will be used in the creation of your key. One of the easiest ways to create a random seed is to use the timing of keystrokes on a keyboard. To begin, type keys on the keyboard until this progress meter is full. DO NOT USE THE AUTOREPEAT FUNCTION ON YOUR KEYBOARD! Continue typing until the progress meter is full: |************************************************************| Finished. Press enter to continue: Generating key. This may take a few moments... 0 - Digital Signature 1 - Non-repudiation 2 - Key encipherment 3 - Data encipherment 4 - Key agreement 5 - Cert signing key 6 - CRL signing key Other to finish > 0 0 - Digital Signature 1 - Non-repudiation 2 - Key encipherment 3 - Data encipherment 4 - Key agreement 5 - Cert signing key 6 - CRL signing key Other to finish > 2 0 - Digital Signature 1 - Non-repudiation 2 - Key encipherment 3 - Data encipherment 4 - Key agreement 5 - Cert signing key 6 - CRL signing key Other to finish > 8 Is this a critical extension [y/N]? N 0 - Server Auth 1 - Client Auth 2 - Code Signing 3 - Email Protection 4 - Timestamp 5 - OCSP Responder 6 - Step-up 7 - Microsoft Trust List Signing Other to finish > 0 0 - Server Auth 1 - Client Auth 2 - Code Signing 3 - Email Protection 4 - Timestamp 5 - OCSP Responder 6 - Step-up 7 - Microsoft Trust List Signing Other to finish > 1 0 - Server Auth 1 - Client Auth 2 - Code Signing 3 - Email Protection 4 - Timestamp 5 - OCSP Responder 6 - Step-up 7 - Microsoft Trust List Signing Other to finish > 8 Is this a critical extension [y/N]? N $ pk12util -o vpnclient.p12 -n "vpnclient" -d sql:/etc/ipsec.d Enter password for PKCS12 file: Re-enter password: pk12util: PKCS12 EXPORT SUCCESSFULRepeat this step for additional VPN clients, but replace every
vpnclientwithvpnclient2, etc. -
The database should now contain:
$ certutil -L -d sql:/etc/ipsec.d Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI Example CA CTu,u,u ($PUBLIC_IP) u,u,u vpnclient u,u,uNote: To delete a certificate, use
certutil -D -d sql:/etc/ipsec.d -n "Certificate Nickname". -
Restart IPsec service:
$ service ipsec restart -
The
vpnclient.p12file should then be securely transferred to the VPN client device. Next steps:Windows 7, 8.x and 10
Import the
.p12file to the "Computer account" certificate store. Make sure that the client cert is placed in "Personal -> Certificates", and the CA cert is placed in "Trusted Root Certification Authorities -> Certificates".Detailed instructions:
https://wiki.strongswan.org/projects/strongswan/wiki/Win7CertsOn the Windows computer, add a new IKEv2 VPN connection：
https://wiki.strongswan.org/projects/strongswan/wiki/Win7Config
Start the new IKEv2 VPN connection, and enjoy your own VPN!
https://wiki.strongswan.org/projects/strongswan/wiki/Win7Connect
(Optional) You may enable stronger ciphers by adding this registry key and reboot.
Windows Phone 8.1 and above
First import the
.p12file, then follow these instructions to configure a certificate-based IKEv2 VPN.Android 4.x and newer
Please refer to: https://wiki.strongswan.org/projects/strongswan/wiki/AndroidVpnClient
Once successfully connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say "Your public IP address is
Your VPN Server IP".
Known Issues
The built-in VPN client in Windows 7 and newer does not support IKEv2 fragmentation. On some networks, this can cause the connection to fail, or you may be unable to open any website after connecting. If this happens, first try this workaround. If it doesn't work, please connect using IPsec/L2TP or IPsec/XAuth mode instead.