Vpn ikev2 настройка windows 10 сертификат

Сейчас все вокруг настраивают VPN для удаленных сотрудников. Мне больно смотреть, как люди устанавливают монструозные глючные программы, настраивают какие-то с...

Сейчас все вокруг настраивают VPN для удаленных сотрудников. Мне больно смотреть, как люди устанавливают монструозные глючные программы, настраивают какие-то сертификаты, устанавливают драйвера TUN/TAP и делают множество сложных операций, в то время как лучшее решение уже встроено в операционную систему.

IKEv2 — это современный протокол VPN, разработанный Microsoft и Cisco. Он используется по умолчанию для новых VPN-подключений в Windows, macOS, iOS. Он быстрее и безопаснее большинства VPN-протоколов и может легко настраиваться на стороне клиента в два клика без использования сторонних программ.

Я считаю, что IPsec IKEv2 отлично подходит не только для соединения серверов, но и для обычных VPN-подключений конечных пользователей. В этом посте я постараюсь убедить вас использовать IPsec IKEv2 для обычных домашних пользователей вместо OpenVPN.

IKEv2 быстрее

При прочих равных условиях, IKEv2 будет всегда быстрее OpenVPN. Это особенно заметно на маломощных системах с медленной памятью, например на роутерах или одноплатных компьютерах.

Дело в том, что IPsec работает в контексте ядра операционной системы, а OpenVPN в контексте пользователя (userspace), и на обработку каждого пакета происходит переключение контекста между процессами ядра и процессами пользователя. Это влияет как на пропускную способность, так и на задержки.

Сравнение задержек для разных протоколов VPN.

Скриншот выше показывает разницу в задержке в два раза между IPsec и OpenVPN. Разумеется, разницу в 1мс невозможно заметить на глаз, но при нагрузке на систему эти значения могут значительно изменяться. Кроме того, реальные показатели сильно зависят от характеристик конкретной системы, поэтому я не буду приводить абсолютные цифры для сравнения двух протоколов. Задержки очень важны при использовании голосовой и видеосвязи через VPN.

По моим субъективным ощущениям IKEv2 на Windows 10 работает заметно отзывчивее чем OpenVPN. Ведь реальное использование десктопного компьютера сильно отличается от синтетических тестов VPN-протоколов. Нагрузка на процессор и память непостоянная, пользователь может запускать ресурсоемкие программы, все это будет влиять на показатели.

IKEv2 проще в настройке

Все современные операционные системы (кроме Android) поддерживают IPsec IKEv2 прямо из коробки. Не нужно устанавливать никакие программы, драйвера виртуальных адаптеров TUN/TAP и прочее. Всё управление VPN происходит из системного меню.

При этом настройку на клиенте можно упростить до трех строчек:

  • Домен — для IPsec домен обязателен, так как для него выпускается SSL-сертификат
  • логин
  • пароль

Не нужно больше передавать клиенту файлы с сертификатами и ключами, заставлять его импортировать корневые сертификаты в системное хранилище. Достаточно логина и пароля, при этом соединение будет так же надежно защищено, как и в OpenVPN при использовании сертификатов, ведь для установки соединения используется такой же x.509 сертификат, как и для веб-сайтов с HTTPS.

Настройка на Windows 10

Мастер настройки VPN вызывается из меню подключения к WiFi. С настройкой одного окна справится пользователь любой квалификации. Созданное подключение активируется из меню со списком WiFi-сетей.

Интерфейс настройки нового IKEv2 подключения в Windows 10

Настройка macOS

В macOS поддерживается IKEv2 начиная с версии 10.11 (El Capitan). Создание подключения происходит через меню настроек сети.

image

Добавляем новое подключение. В качестве имени подключения задаем любое произвольное имя.

image

Для проверки подлинности сертификата, нужно указать доменное имя. При этом в поле «Server Address» можно указать IP-адрес сервера, а домен только в «Remote ID», тогда для подключения не будет выполняться DNS-резолв, и оно будет происходить чуть быстрее.

image

Логин и пароль пользователя указываем из файла /etc/ipsec.secrets

image

Настройка iOS

Настройку iOS можно выполнить вручную через мастер, но намного удобнее использовать профиль автоконфигурации mobileconfig.

Ручная настройка по смыслу аналогична десктопной macOS:

Настройки -> VPN -> Добавить конфигурацию VPN

IKEv2 это безопасно

На предыдущем шаге мы выяснили, что для настройки подключения достаточно логина и пароля. Но как клиенту проверить, что подключение не прослушивается, не подменяются данные и сервер действительно тот, за кого себя выдает? Для этого используются обычные SSL-сертификаты, которые мы привыкли использовать для веб-сайтов и HTTPS.

Клиент устанавливает защищенный SSL-тоннель с сервером, и уже внутри него передается логин-пароль. По умолчанию в Windows и macOS для передачи пароля используется алгоритм mschapv2. Таким образом с помощью SSL-сертификата клиент проверяет подлинность сервера, а по логину-паролю сервер проверяет подлинность клиента.

Сервер IKEv2 может использовать один и тот же сертификат вместе с веб-сервером, например от популярного Let’s Encrypt. Это сильно упрощает управлением сертификатами.

Такая же модель используется в OpenVPN, и при желании в нем можно использовать сертификат от Lets Encrypt, однако администратору в любом случае потребуется передать пользователю файл для настройки VPN.

Настраиваем IKEv2 сервер

Развернуть свой IKEv2 сервер можно за пару минут с помощью скриптов автоматической установки или используя готовые контейнеры. Использовать docker не рекомендуется, так как его сетевая подсистема снижает производительность IPsec на дешевых тарифах VPS. Вы также можете настроить IKEv2-сервер вручную, на Хабре есть статьи с примерами настройки сервера Strongswan.

Мы будем использовать один из наиболее удачных вариантов скриптов автонастройки github.com/jawj/IKEv2-setup
Этот скрипт хорош тем, что использует сертификаты от Lets Encrypt и автоматически генерирует валидный сертификат.

Шаг 1: Выбор сервера

Для запуска VPN сервера нам потребуется VDS. Подойдет самая простая конфигурация с одним ядром процессора. Скрипт из нашего примера лучше всего протестирован на Ubuntu 18.04, поэтому при создании сервера выбираем этот образ ОС.

Ждем окончания установки сервера и копируем реквизиты для подключения. Пароль root придет на почту, либо его можно задать вручную через веб-интервейс. Далее все команды мы вводим

Шаг 2: Установка Strongswan

Подключаемся SSH-клиентом и запускаем скрипт установки:

# запуск автоматической установки сервера IKEv2 
wget https://raw.githubusercontent.com/jawj/IKEv2-setup/master/setup.sh
chmod u+x setup.sh
./setup.sh
....
# Введите имя домена направленного на IP-адрес сервера
# используйте сервис sslip.io если у вас нет домена
Hostname for VPN: 123-45-67-89.sslip.io
# Имя пользователя VPN
VPN username: coolguy
# пароль 
VPN password (no quotes, please):
....
# скрипт запрос создать нового SSH-пользователя, этот шаг нельзя пропускать.

Шаг 3: Настройка клиента

Введенные реквизиты пользователя VPN теперь нужно использовать для настройки на клиенте. Важно использовать именно то доменное имя, которое вы вводили в Hostname for VPN.

Шаг 4: Добавление новых пользователей

Чтобы добавить нового пользователя в уже созданный сервер, отредактируйте файл /etc/ipsec.sectes.

# nano /etc/ipsec.secrets
123-45-67-89.sslip.io : RSA "privkey.pem"
coolguy : EAP "C00lPassword"
badguy : EAP "bAdP$$word"

После добавления пользователя выполните команду ipsec secrets чтобы Strongswan перечитал конфиг.

Заключение

Мы рассмотрели удобство IKEv2 со стороны пользователя. Администрирование такого сервера не сложнее, а иногда даже проще чем OpenVPN. Если вы только планируете организовать удаленный доступ для своих сотрудников, обязательно посмотрите в сторону IKEv2. Не заставляйте своих пользователей устанавливать лишние программы, если все необходимое уже есть на их компьютере. Это удобнее, безопаснее и намного прогрессивнее.

Источник

Home » How To » How to set up IKEv2 VPN Connection on Windows 10 with Certificate or EAP-MSCHAP v2 Authentication

    • Posted by
    • in How To
    • on October 10, 2019

    This guide assumes that you have obtained a Personal Information Exchange (p12) file from your VPN service provider. The file contains the server certificate and maybe the client private key & certificate (if using certificate authentication instead of EAP-MACHAP v2).

    There are two major tasks: install the certificates and create a VPN connection.

    Task 1: install the certificates.

    1. Double click the p12 file. Select “Local Machine” on the “Certificate Import Wizard” dialog.
    2. Click “Next”.
    3. Enter the password (if there is one).
    4. Select “Automatic…” for the certificate store.
    5. Click “Finish”.

    Task 2: create the VPN connection.

    1. Click the network icon at the bottom right corner of the screen, then click “Network & Internet Settings”.
    2. Click on the “Network and Sharing Center” link (you might need to scroll down a bit).
    3. Click on “Set up a new connection or network”.
    4. Select “Connect to a workplace”.
    5. Click on “Use my Internet connection (VPN)”.
    6. Enter the VPN server domain name or IP address, give a name to the VPN connection. Then click “Create”.
    7. Go back to the “Network and Sharing Center” dialog and click “Change adapter settings”.
    8. Right click on the newly created VPN connection, select “Properties”.
    9. Click on the “Security” tab, select “IKEv2” for “Type of VPN”. Select “Maximum strength encryption”, and “Use machine certificate” for Authentication (if you are authenticating with EAP-MSCHAP v2 user name and password, see alternative task below).
    10. Click on the “Networking” tab. Uncheck TCP/IPv6.
    11. Click the network icon at the bottom right corner of the screen, then click on the VPN connection to connect to the VPN.

    Alternative task 2: if authenticating with EAP-MSCHAP v2.

    1. In step 9 above, select “Use Extensible Authentication Protocol (EAP), then EAP-MSCHAP v2.
    2. Click the Windows icon at the left bottom corner of the screen and enter “vpn”. Then click on “VPN settings”.
    3. Click on the VPN connection, then click “Advanced options”.
    4. Click “Edit”.
    5. Select “User name and Password” for “Type of sign-in info”. Enter user name and password. Click “Save”.


    Task 3: Check that your VPN connection is working

    1. Open a web browser, enter https://ipleak.net/. Make sure that your IP address is that of the VPN service (i.e., no longer your ISP assigned IP address), and DNS addresses are also that from the VPN service.
    2. If your VPN server is located in the same geographical region as your ISP connection, sometimes it’s hard to tell if your DNS service has changed to that provided by the VPN. This page will tell you who is your DNS provider: http://whoismydns.com/
    3. There are instances that your browser is stuck with the ISP assigned DNS server. In that case, manually set the DNS service on your ISP connection (WiFi or Ethernet adapter) to a third party DNS service, for example, Cloudflare DNS. Just to be safe, disable IPv6 on the WiFi or Ethernet adapter too.



Источник

English | 中文

Guide: How to Set Up and Use IKEv2 VPN

  • Introduction
  • Configure IKEv2 VPN clients
  • IKEv2 troubleshooting
  • Manage IKEv2 clients
  • Change IKEv2 server address
  • Update IKEv2 helper script
  • Set up IKEv2 using helper script
  • Manually set up IKEv2
  • Remove IKEv2

Introduction

Modern operating systems support the IKEv2 standard. Internet Key Exchange (IKE or IKEv2) is the protocol used to set up a Security Association (SA) in the IPsec protocol suite. Compared to IKE version 1, IKEv2 contains improvements such as Standard Mobility support through MOBIKE, and improved reliability.

Libreswan can authenticate IKEv2 clients on the basis of X.509 Machine Certificates using RSA signatures. This method does not require an IPsec PSK, username or password. It can be used with Windows, macOS, iOS, Android, Chrome OS, Linux and RouterOS.

By default, IKEv2 is automatically set up when running the VPN setup script. If you want to learn more about setting up IKEv2, see Set up IKEv2 using helper script. Docker users, see Configure and use IKEv2 VPN.

Configure IKEv2 VPN clients

Note: To add or export IKEv2 clients, run sudo ikev2.sh. Use -h to show usage. Client config files can be safely deleted after import.

  • Windows 7, 8, 10 and 11
  • OS X (macOS)
  • iOS (iPhone/iPad)
  • Android
  • Chrome OS (Chromebook)
  • Linux
  • Mikrotik RouterOS

Learn how to change the IKEv2 server address.

In certain circumstances, you may need to change the IKEv2 server address. For example, to switch to use a DNS name, or after server IP changes. Learn more in this section.

Windows 7, 8, 10 and 11

Auto-import configuration

Screencast: IKEv2 Auto Import Configuration on Windows

Windows 8, 10 and 11 users can automatically import IKEv2 configuration:

  1. Securely transfer the generated .p12 file to your computer.
  2. Right-click on ikev2_config_import.cmd and save this helper script to the same folder as the .p12 file.
  3. Right-click on the saved script, select Properties. Click on Unblock at the bottom, then click on OK.
  4. Right-click on the saved script, select Run as administrator and follow the prompts.

To connect to the VPN: Click on the wireless/network icon in your system tray, select the new VPN entry, and click Connect. Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say «Your public IP address is Your VPN Server IP«.

If you get an error when trying to connect, see Troubleshooting.

Manually import configuration

[Supporters] Screencast: IKEv2 Manually Import Configuration on Windows

Alternatively, Windows 7, 8, 10 and 11 users can manually import IKEv2 configuration:

  1. Securely transfer the generated .p12 file to your computer, then import it into the certificate store.

    To import the .p12 file, run the following from an elevated command prompt:

    # Import .p12 file (replace with your own value)
certutil -f -importpfx "pathtoyourfile.p12" NoExport

    Note: If there is no password for client config files, press Enter to continue, or if manually importing the .p12 file, leave the password field blank.

    Alternatively, you can manually import the .p12 file. Make sure that the client cert is placed in «Personal -> Certificates», and the CA cert is placed in «Trusted Root Certification Authorities -> Certificates».

  2. On the Windows computer, add a new IKEv2 VPN connection.

    For Windows 8, 10 and 11, it is recommended to create the VPN connection using the following commands from a command prompt, for improved security and performance.

    # Create VPN connection (replace server address with your own value)
powershell -command ^"Add-VpnConnection -ServerAddress 'Your VPN Server IP (or DNS name)' ^
  -Name 'My IKEv2 VPN' -TunnelType IKEv2 -AuthenticationMethod MachineCertificate ^
  -EncryptionLevel Required -PassThru^"
# Set IPsec configuration
powershell -command ^"Set-VpnConnectionIPsecConfiguration -ConnectionName 'My IKEv2 VPN' ^
  -AuthenticationTransformConstants GCMAES128 -CipherTransformConstants GCMAES128 ^
  -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -PfsGroup None ^
  -DHGroup Group14 -PassThru -Force^"

    Windows 7 does not support these commands, you can manually create the VPN connection.

    Note: The server address you specify must exactly match the server address in the output of the IKEv2 helper script. For example, if you specified the server’s DNS name during IKEv2 setup, you must enter the DNS name in the Internet address field.

  3. This step is required if you manually created the VPN connection.

    Enable stronger ciphers for IKEv2 with a one-time registry change. Download and import the .reg file below, or run the following from an elevated command prompt. Read more here.

    • For Windows 7, 8, 10 and 11 (download .reg file)

      REG ADD HKLMSYSTEMCurrentControlSetServicesRasManParameters /v NegotiateDH2048_AES256 /t REG_DWORD /d 0x1 /f

To connect to the VPN: Click on the wireless/network icon in your system tray, select the new VPN entry, and click Connect. Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say «Your public IP address is Your VPN Server IP«.

If you get an error when trying to connect, see Troubleshooting.

Remove the IKEv2 VPN connection.

Using the following steps, you can remove the VPN connection and optionally restore the computer to the status before IKEv2 configuration import.

  1. Remove the added VPN connection in Windows Settings — Network — VPN. Windows 7 users can remove the VPN connection in Network and Sharing Center — Change adapter settings.

  2. (Optional) Remove IKEv2 certificates.

    1. Press Win+R, or search for mmc in the Start Menu. Open Microsoft Management Console.

    2. Open File - Add/Remove Snap-In. Select to add Certificates and in the window that opens, select Computer account -> Local Computer. Click on Finish -> OK to save the settings.

    3. Go to Certificates - Personal - Certificates and delete the IKEv2 client certificate. The name of the certificate is the same as the IKEv2 client name you specified (default: vpnclient). The certificate was issued by IKEv2 VPN CA.

    4. Go to Certificates - Trusted Root Certification Authorities - Certificates and delete the IKEv2 VPN CA certificate. The certificate was issued to IKEv2 VPN CA by IKEv2 VPN CA. Before deleting, make sure that there are no other certificate(s) issued by IKEv2 VPN CA in Certificates - Personal - Certificates.

  3. (Optional. For users who manually created the VPN connection) Restore registry settings. Note that you should backup the registry before editing.

    1. Press Win+R, or search for regedit in the Start Menu. Open Registry Editor.

    2. Go to HKEY_LOCAL_MACHINESystemCurrentControlSetServicesRasmanParameters and delete the item with name NegotiateDH2048_AES256, if it exists.

OS X (macOS)

[Supporters] Screencast: IKEv2 Import Configuration and Connect on macOS

First, securely transfer the generated .mobileconfig file to your Mac, then double-click and follow the prompts to import as a macOS profile. If your Mac runs macOS Big Sur or newer, open System Preferences and go to the Profiles section to finish importing. When finished, check to make sure «IKEv2 VPN» is listed under System Preferences -> Profiles.

To connect to the VPN:

  1. Open System Preferences and go to the Network section.
  2. Select the VPN connection with Your VPN Server IP (or DNS name).
  3. Check the Show VPN status in menu bar checkbox.
  4. Click Connect.

(Optional feature) Enable VPN On Demand to automatically start a VPN connection when your Mac is on Wi-Fi. To enable, check the Connect on demand checkbox for the VPN connection, and click Apply. You can customize VPN On Demand rules to exclude certain Wi-Fi network(s) such as your home network. See «Guide: Customize IKEv2 VPN On Demand rules for macOS and iOS» in 📖 Book: Set Up Your Own IPsec VPN, OpenVPN and WireGuard Server.

If you manually set up IKEv2 without using the helper script, click here for instructions.

First, securely transfer the generated .p12 file to your Mac, then double-click to import into the login keychain in Keychain Access. Next, double-click on the imported IKEv2 VPN CA certificate, expand Trust and select Always Trust from the IP Security (IPsec) drop-down menu. Close the dialog using the red «X» on the top-left corner. When prompted, use Touch ID or enter your password and click «Update Settings».

When finished, check to make sure both the new client certificate and IKEv2 VPN CA are listed under the Certificates category of login keychain.

  1. Open System Preferences and go to the Network section.
  2. Click the + button in the lower-left corner of the window.
  3. Select VPN from the Interface drop-down menu.
  4. Select IKEv2 from the VPN Type drop-down menu.
  5. Enter anything you like for the Service Name.
  6. Click Create.
  7. Enter Your VPN Server IP (or DNS name) for the Server Address.
    Note: If you specified the server’s DNS name (instead of its IP address) during IKEv2 setup, you must enter the DNS name in the Server Address and Remote ID fields.
  8. Enter Your VPN Server IP (or DNS name) for the Remote ID.
  9. Enter Your VPN client name in the Local ID field.
    Note: This must match exactly the client name you specified during IKEv2 setup. Same as the first part of your .p12 filename.
  10. Click the Authentication Settings… button.
  11. Select None from the Authentication Settings drop-down menu.
  12. Select the Certificate radio button, then select the new client certificate.
  13. Click OK.
  14. Check the Show VPN status in menu bar checkbox.
  15. Click Apply to save the VPN connection information.
  16. Click Connect.

Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say «Your public IP address is Your VPN Server IP«.

If you get an error when trying to connect, see Troubleshooting.

Remove the IKEv2 VPN connection.

To remove the IKEv2 VPN connection, open System Preferences -> Profiles and remove the IKEv2 VPN profile you added.

iOS

[Supporters] Screencast: IKEv2 Import Configuration and Connect on iOS (iPhone & iPad)

First, securely transfer the generated .mobileconfig file to your iOS device, then import it as an iOS profile. To transfer the file, you may use:

  1. AirDrop, or
  2. Upload to your device (any App folder) using File Sharing, then open the «Files» App on your iOS device, move the uploaded file to the «On My iPhone» folder. After that, tap the file and go to the «Settings» App to import, or
  3. Host the file on a secure website of yours, then download and import it in Mobile Safari.

When finished, check to make sure «IKEv2 VPN» is listed under Settings -> General -> VPN & Device Management or Profile(s).

To connect to the VPN:

  1. Go to Settings -> VPN. Select the VPN connection with Your VPN Server IP (or DNS name).
  2. Slide the VPN switch ON.

(Optional feature) Enable VPN On Demand to automatically start a VPN connection when your iOS device is on Wi-Fi. To enable, tap the «i» icon on the right of the VPN connection, and enable Connect On Demand. You can customize VPN On Demand rules to exclude certain Wi-Fi network(s) such as your home network, or to start the VPN connection both on Wi-Fi and cellular. See «Guide: Customize IKEv2 VPN On Demand rules for macOS and iOS» in 📖 Book: Set Up Your Own IPsec VPN, OpenVPN and WireGuard Server.

If you manually set up IKEv2 without using the helper script, click here for instructions.

First, securely transfer the generated ca.cer and .p12 files to your iOS device, then import them one by one as iOS profiles. To transfer the files, you may use:

  1. AirDrop, or
  2. Upload to your device (any App folder) using File Sharing, then open the «Files» App on your iOS device, move the uploaded files to the «On My iPhone» folder. After that, tap each file and go to the «Settings» App to import, or
  3. Host the files on a secure website of yours, then download and import them in Mobile Safari.

When finished, check to make sure both the new client certificate and IKEv2 VPN CA are listed under Settings -> General -> VPN & Device Management or Profile(s).

  1. Go to Settings -> General -> VPN & Device Management -> VPN.
  2. Tap Add VPN Configuration….
  3. Tap Type. Select IKEv2 and go back.
  4. Tap Description and enter anything you like.
  5. Tap Server and enter Your VPN Server IP (or DNS name).
    Note: If you specified the server’s DNS name (instead of its IP address) during IKEv2 setup, you must enter the DNS name in the Server and Remote ID fields.
  6. Tap Remote ID and enter Your VPN Server IP (or DNS name).
  7. Enter Your VPN client name in the Local ID field.
    Note: This must match exactly the client name you specified during IKEv2 setup. Same as the first part of your .p12 filename.
  8. Tap User Authentication. Select None and go back.
  9. Make sure the Use Certificate switch is ON.
  10. Tap Certificate. Select the new client certificate and go back.
  11. Tap Done.
  12. Slide the VPN switch ON.

Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say «Your public IP address is Your VPN Server IP«.

If you get an error when trying to connect, see Troubleshooting.

Remove the IKEv2 VPN connection.

To remove the IKEv2 VPN connection, open Settings -> General -> VPN & Device Management or Profile(s) and remove the IKEv2 VPN profile you added.

Android

[Supporters] Screencast: Connect using Android strongSwan VPN Client

  1. Securely transfer the generated .sswan file to your Android device.
  2. Install strongSwan VPN Client from Google Play, F-Droid or strongSwan download server.
  3. Launch the strongSwan VPN client.
  4. Tap the «more options» menu on top right, then tap Import VPN profile.
  5. Choose the .sswan file you transferred from the VPN server.
    Note: To find the .sswan file, tap the three-line menu button, then browse to the location you saved the file.
  6. On the «Import VPN profile» screen, tap IMPORT CERTIFICATE FROM VPN PROFILE, and follow the prompts.
  7. On the «Choose certificate» screen, select the new client certificate, then tap Select.
  8. Tap IMPORT.
  9. Tap the new VPN profile to connect.

Alternatively, Android 11+ users can also connect using the native IKEv2 client.

[Supporters] Screencast: Connect using Native VPN Client on Android 11+

  1. Securely transfer the generated .p12 file to your Android device.
  2. Launch the Settings application.
  3. Go to Security -> Advanced -> Encryption & credentials.
  4. Tap Install a certificate.
  5. Tap VPN & app user certificate.
  6. Choose the .p12 file you transferred from the VPN server.
    Note: To find the .p12 file, tap the three-line menu button, then browse to the location you saved the file.
  7. Enter a name for the certificate, then tap OK.
  8. Go to Settings -> Network & internet -> VPN, then tap the «+» button.
  9. Enter a name for the VPN profile.
  10. Select IKEv2/IPSec RSA from the Type drop-down menu.
  11. Enter Your VPN Server IP (or DNS name) in the Server address field.
    Note: This must exactly match the server address in the output of the IKEv2 helper script.
  12. Enter anything (e.g. empty) in the IPSec identifier field.
    Note: This field should not be required. It is a bug in Android.
  13. Select the certificate you imported from the IPSec user certificate drop-down menu.
  14. Select the certificate you imported from the IPSec CA certificate drop-down menu.
  15. Select (receive from server) from the IPSec server certificate drop-down menu.
  16. Tap Save. Then tap the new VPN connection and tap Connect.

If your device runs Android 6.0 or older, click here for additional instructions.

If your device runs Android 6.0 (Marshmallow) or older, in order to connect using the strongSwan VPN client, you must make the following change on the VPN server: Edit /etc/ipsec.d/ikev2.conf on the server. Append authby=rsa-sha1 to the end of the conn ikev2-cp section, indented by two spaces. Save the file and run service ipsec restart.

(Optional feature) You can choose to enable the «Always-on VPN» feature on Android. Launch the Settings app, go to Network & internet -> Advanced -> VPN, click the gear icon on the right of «strongSwan VPN Client», then enable the Always-on VPN and Block connections without VPN options.

If you manually set up IKEv2 without using the helper script, click here for instructions.

Android 10 and newer:

  1. Securely transfer the generated .p12 file to your Android device.
  2. Install strongSwan VPN Client from Google Play, F-Droid or strongSwan download server.
  3. Launch the Settings application.
  4. Go to Security -> Advanced -> Encryption & credentials.
  5. Tap Install a certificate.
  6. Tap VPN & app user certificate.
  7. Choose the .p12 file you transferred from the VPN server, and follow the prompts.
    Note: To find the .p12 file, tap the three-line menu button, then browse to the location you saved the file.
  8. Launch the strongSwan VPN client and tap Add VPN Profile.
  9. Enter Your VPN Server IP (or DNS name) in the Server field.
    Note: If you specified the server’s DNS name (instead of its IP address) during IKEv2 setup, you must enter the DNS name in the Server field.
  10. Select IKEv2 Certificate from the VPN Type drop-down menu.
  11. Tap Select user certificate, select the new client certificate and confirm.
  12. (Important) Tap Show advanced settings. Scroll down, find and enable the Use RSA/PSS signatures option.
  13. Save the new VPN connection, then tap to connect.

Android 4 to 9:

  1. Securely transfer the generated .p12 file to your Android device.
  2. Install strongSwan VPN Client from Google Play, F-Droid or strongSwan download server.
  3. Launch the strongSwan VPN client and tap Add VPN Profile.
  4. Enter Your VPN Server IP (or DNS name) in the Server field.
    Note: If you specified the server’s DNS name (instead of its IP address) during IKEv2 setup, you must enter the DNS name in the Server field.
  5. Select IKEv2 Certificate from the VPN Type drop-down menu.
  6. Tap Select user certificate, then tap Install certificate.
  7. Choose the .p12 file you transferred from the VPN server, and follow the prompts.
    Note: To find the .p12 file, tap the three-line menu button, then browse to the location you saved the file.
  8. (Important) Tap Show advanced settings. Scroll down, find and enable the Use RSA/PSS signatures option.
  9. Save the new VPN connection, then tap to connect.

Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say «Your public IP address is Your VPN Server IP«.

If you get an error when trying to connect, see Troubleshooting.

Chrome OS

First, on your VPN server, export the CA certificate as ca.cer:

sudo certutil -L -d sql:/etc/ipsec.d -n "IKEv2 VPN CA" -a -o ca.cer

Securely transfer the generated .p12 and ca.cer files to your Chrome OS device.

Install user and CA certificates:

  1. Open a new tab in Google Chrome.
  2. In the address bar, enter chrome://settings/certificates
  3. (Important) Click Import and Bind, not Import.
  4. In the box that opens, choose the .p12 file you transferred from the VPN server and select Open.
  5. Click OK if the certificate does not have a password. Otherwise, enter the certificate’s password.
  6. Click the Authorities tab. Then click Import.
  7. In the box that opens, select All files in the drop-down menu at the bottom left.
  8. Choose the ca.cer file you transferred from the VPN server and select Open.
  9. Keep the default options and click OK.

Add a new VPN connection:

  1. Go to Settings -> Network.
  2. Click Add connection, then click Add built-in VPN.
  3. Enter anything you like for the Service name.
  4. Select IPsec (IKEv2) in the Provider type drop-down menu.
  5. Enter Your VPN Server IP (or DNS name) for the Server hostname.
  6. Select User certificate in the Authentication type drop-down menu.
  7. Select IKEv2 VPN CA [IKEv2 VPN CA] in the Server CA certificate drop-down menu.
  8. Select IKEv2 VPN CA [client name] in the User certificate drop-down menu.
  9. Leave other fields blank.
  10. Enable Save identity and password.
  11. Click Connect.

Once connected, you will see a VPN icon overlay on the network status icon. You can verify that your traffic is being routed properly by looking up your IP address on Google. It should say «Your public IP address is Your VPN Server IP«.

(Optional feature) You can choose to enable the «Always-on VPN» feature on Chrome OS. To manage this setting, go to Settings -> Network, then click VPN.

If you get an error when trying to connect, see Troubleshooting.

Linux

Before configuring Linux VPN clients, you must make the following change on the VPN server: Edit /etc/ipsec.d/ikev2.conf on the server. Append authby=rsa-sha1 to the end of the conn ikev2-cp section, indented by two spaces. Save the file and run service ipsec restart.

To configure your Linux computer to connect to IKEv2 as a VPN client, first install the strongSwan plugin for NetworkManager:

# Ubuntu and Debian
sudo apt-get update
sudo apt-get install network-manager-strongswan

# Arch Linux
sudo pacman -Syu  # upgrade all packages
sudo pacman -S networkmanager-strongswan

# Fedora
sudo yum install NetworkManager-strongswan-gnome

# CentOS
sudo yum install epel-release
sudo yum --enablerepo=epel install NetworkManager-strongswan-gnome

Next, securely transfer the generated .p12 file from the VPN server to your Linux computer. After that, extract the CA certificate, client certificate and private key. Replace vpnclient.p12 in the example below with the name of your .p12 file.

# Example: Extract CA certificate, client certificate and private key.
#          You may delete the .p12 file when finished.
# Note: You may need to enter the import password, which can be found
#       in the output of the IKEv2 helper script. If the output does not
#       contain an import password, press Enter to continue.
# Note: If using OpenSSL 3.x (run "openssl version" to check),
#       append "-legacy" to the 3 commands below.
openssl pkcs12 -in vpnclient.p12 -cacerts -nokeys -out ca.cer
openssl pkcs12 -in vpnclient.p12 -clcerts -nokeys -out client.cer
openssl pkcs12 -in vpnclient.p12 -nocerts -nodes  -out client.key
rm vpnclient.p12

# (Important) Protect certificate and private key files
# Note: This step is optional, but strongly recommended.
sudo chown root.root ca.cer client.cer client.key
sudo chmod 600 ca.cer client.cer client.key

You can then set up and enable the VPN connection:

  1. Go to Settings -> Network -> VPN. Click the + button.
  2. Select IPsec/IKEv2 (strongswan).
  3. Enter anything you like in the Name field.
  4. In the Gateway (Server) section, enter Your VPN Server IP (or DNS name) for the Address.
  5. Select the ca.cer file for the Certificate.
  6. In the Client section, select Certificate(/private key) in the Authentication drop-down menu.
  7. Select Certificate/private key in the Certificate drop-down menu (if exists).
  8. Select the client.cer file for the Certificate (file).
  9. Select the client.key file for the Private key.
  10. In the Options section, check the Request an inner IP address checkbox.
  11. In the Cipher proposals (Algorithms) section, check the Enable custom proposals checkbox.
  12. Leave the IKE field blank.
  13. Enter aes128gcm16 in the ESP field.
  14. Click Add to save the VPN connection information.
  15. Turn the VPN switch ON.

Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say «Your public IP address is Your VPN Server IP«.

If you get an error when trying to connect, see Troubleshooting.

RouterOS

Note: These steps were contributed by @Unix-User. It is recommended to run terminal commands via an SSH connection, e.g. via Putty.

  1. Securely transfer the generated .p12 file to your computer.

    Click to see screencast.

    routeros get certificate

  2. In WinBox, go to System > certificates > import. Import the .p12 certificate file twice (yes, import the same file two times!). Verify in your certificates panel. You will see 2 files, the one that is marked KT is the key.

    Click to see screencast.

    routeros import certificate

    Or you can use terminal instead (empty passphrase):

    [admin@MikroTik] > /certificate/import file-name=mikrotik.p12
passphrase:

  certificates-imported: 2
  private-keys-imported: 0
         files-imported: 1
    decryption-failures: 0
  keys-with-no-certificate: 0

[admin@MikroTik] > /certificate/import file-name=mikrotik.p12
passphrase:

     certificates-imported: 0
     private-keys-imported: 1
            files-imported: 1
       decryption-failures: 0
  keys-with-no-certificate: 0

  3. Run these commands in terminal. Replace the following with your own values.
    YOUR_VPN_SERVER_IP_OR_DNS_NAME is your VPN server IP or DNS name.
    IMPORTED_CERTIFICATE is the name of the certificate from step 2 above, e.g. vpnclient.p12_0
    (the one flagged with KT — Priv. Key Trusted — if not flagged as KT, import certificate again).
    THESE_ADDRESSES_GO_THROUGH_VPN are the local network addresses that you want to browse through the VPN.
    Assuming that your local network behind RouterOS is 192.168.0.0/24, you can use 192.168.0.0/24
    for the entire network, or use 192.168.0.10 for just one device, and so on.

    /ip firewall address-list add address=THESE_ADDRESSES_GO_THROUGH_VPN list=local
/ip ipsec mode-config add name=ike2-rw responder=no src-address-list=local
/ip ipsec policy group add name=ike2-rw
/ip ipsec profile add name=ike2-rw
/ip ipsec peer add address=YOUR_VPN_SERVER_IP_OR_DNS_NAME exchange-mode=ike2 
    name=ike2-rw-client profile=ike2-rw
/ip ipsec proposal add name=ike2-rw pfs-group=none
/ip ipsec identity add auth-method=digital-signature certificate=IMPORTED_CERTIFICATE 
    generate-policy=port-strict mode-config=ike2-rw 
    peer=ike2-rw-client policy-template-group=ike2-rw
/ip ipsec policy add group=ike2-rw proposal=ike2-rw template=yes

  4. For more information, see #1112.

tested on
mar/02/2022 12:52:57 by RouterOS 6.48
RouterBOARD 941-2nD

IKEv2 troubleshooting

Read this in other languages: English, 中文.

See also: Check logs and VPN status, IKEv1 troubleshooting and Advanced usage.

  • Cannot connect to the VPN server
  • Unable to connect multiple IKEv2 clients
  • IKE authentication credentials are unacceptable
  • Policy match error
  • Parameter is incorrect
  • Cannot open websites after connecting to IKEv2
  • Windows 10 connecting
  • Other known issues

Cannot connect to the VPN server

First, make sure that the VPN server address specified on your VPN client device exactly matches the server address in the output of the IKEv2 helper script. Refer to the sections below and Check logs and VPN status.

For servers with an external firewall (e.g. EC2/GCE), open UDP ports 500 and 4500 for the VPN. Aliyun users, see #433.

Unable to connect multiple IKEv2 clients

To connect multiple IKEv2 clients from behind the same NAT (e.g. home router) at the same time, you will need to generate a unique certificate for each client. Otherwise, you could encounter the issue where a later connected client affects the VPN connection of an existing client, which may lose Internet access.

To generate certificates for additional IKEv2 clients, run the helper script with the --addclient option. To customize client options, run the script without arguments.

sudo ikev2.sh --addclient [client name]

IKE authentication credentials are unacceptable

If you encounter this error, make sure that the VPN server address specified on your VPN client device exactly matches the server address in the output of the IKEv2 helper script. For example, you cannot use a DNS name to connect if it was not specified when setting up IKEv2. To change the IKEv2 server address, read this section.

Policy match error

To fix this error, you will need to enable stronger ciphers for IKEv2 with a one-time registry change. Download and import the .reg file below, or run the following from an elevated command prompt.

  • For Windows 7, 8, 10 and 11 (download .reg file)
REG ADD HKLMSYSTEMCurrentControlSetServicesRasManParameters /v NegotiateDH2048_AES256 /t REG_DWORD /d 0x1 /f

Parameter is incorrect

If you encounter «Error 87: The parameter is incorrect» when trying to connect using IKEv2 mode, try the solutions in this issue, more specifically, step 2 «reset device manager adapters».

Cannot open websites after connecting to IKEv2

If your VPN client device cannot open websites after successfully connecting to IKEv2, try the following fixes:

  1. Some cloud providers, such as Google Cloud, set a lower MTU by default. This could cause network issues with IKEv2 VPN clients. To fix, try setting the MTU to 1500 on the VPN server:

    # Replace ens4 with the network interface name on your server
sudo ifconfig ens4 mtu 1500

    This setting does not persist after a reboot. To change the MTU size permanently, refer to relevant articles on the web.

  2. If changing the MTU size does not fix the issue, try the fix in Android MTU/MSS issues.

  3. In certain circumstances, Windows does not use the DNS servers specified by IKEv2 after connecting. This can be fixed by manually entering DNS servers such as Google Public DNS (8.8.8.8, 8.8.4.4) in network interface properties -> TCP/IPv4.

Windows 10 connecting

If using Windows 10 and the VPN is stuck on «connecting» for more than a few minutes, try these steps:

  1. Right-click on the wireless/network icon in your system tray.
  2. Select Open Network & Internet settings, then on the page that opens, click VPN on the left.
  3. Select the new VPN entry, then click Connect.

Other known issues

The built-in VPN client in Windows may not support IKEv2 fragmentation (this feature requires Windows 10 v1803 or newer). On some networks, this can cause the connection to fail or have other issues. You may instead try the IPsec/L2TP or IPsec/XAuth mode.

Manage IKEv2 clients

  • List existing clients
  • Add a client certificate
  • Export configuration for an existing client
  • Delete a client certificate
  • Revoke a client certificate

List existing clients

To list the names of existing IKEv2 clients, run the helper script with the --listclients option. Use option -h to show usage.

sudo ikev2.sh --listclients

Add a client certificate

To generate certificates for additional IKEv2 clients, run the helper script with the --addclient option. To customize client options, run the script without arguments.

sudo ikev2.sh --addclient [client name]

Alternatively, you may manually add a client certificate. Refer to step 4 in this section.

Export configuration for an existing client

By default, the IKEv2 helper script exports client configuration after running. If later you want to export an existing client, you may use:

sudo ikev2.sh --exportclient [client name]

Delete a client certificate

Important: Deleting a client certificate from the IPsec database WILL NOT prevent VPN client(s) from connecting using that certificate! For this use case, you MUST revoke the client certificate instead of deleting it.

First, read the important note above. Then click here for instructions.

Warning: The client certificate and private key will be permanently deleted. This cannot be undone!

To delete an existing client:

sudo ikev2.sh --deleteclient [client name]

Alternatively, you can manually delete a client certificate.

  1. List certificates in the IPsec database:

    certutil -L -d sql:/etc/ipsec.d

    Example output:

    Certificate Nickname                               Trust Attributes
                                                   SSL,S/MIME,JAR/XPI

IKEv2 VPN CA                                       CTu,u,u
($PUBLIC_IP)                                       u,u,u
vpnclient                                          u,u,u

  2. Delete the client certificate and private key. Replace «Nickname» below with the nickname of the client certificate you want to delete, e.g. vpnclient.

    certutil -F -d sql:/etc/ipsec.d -n "Nickname"
certutil -D -d sql:/etc/ipsec.d -n "Nickname" 2>/dev/null

  3. (Optional) Delete the previously generated client configuration files (.p12, .mobileconfig and .sswan files) for this VPN client, if any.

Revoke a client certificate

In certain circumstances, you may need to revoke a previously generated VPN client certificate.

To revoke an existing client:

sudo ikev2.sh --revokeclient [client name]

Alternatively, you can manually revoke a client certificate.

Alternatively, you can manually revoke a client certificate. This can be done using crlutil. See example steps below, commands must be run as root.

  1. Check the database, and identify the nickname of the client certificate you want to revoke.

    certutil -L -d sql:/etc/ipsec.d
    Certificate Nickname                               Trust Attributes
                                                   SSL,S/MIME,JAR/XPI

IKEv2 VPN CA                                       CTu,u,u
($PUBLIC_IP)                                       u,u,u
vpnclient-to-revoke                                u,u,u

    In this example, we will revoke the certificate with nickname vpnclient-to-revoke, issued by IKEv2 VPN CA.

  2. Find the serial number of this client certificate.

    certutil -L -d sql:/etc/ipsec.d -n "vpnclient-to-revoke"
    Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            00:cd:69:ff:74
... ...

    From the output, we see that the serial number is CD69FF74 in hexadecimal, which is 3446275956 in decimal. It will be used in the next steps.

  3. Create a new Certificate Revocation List (CRL). You only need to do this once for each CA.

    if ! crlutil -L -d sql:/etc/ipsec.d -n "IKEv2 VPN CA" 2>/dev/null; then
  crlutil -G -d sql:/etc/ipsec.d -n "IKEv2 VPN CA" -c /dev/null
fi
    CRL Info:
:
    Version: 2 (0x1)
    Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
    Issuer: "O=IKEv2 VPN,CN=IKEv2 VPN CA"
    This Update: Sat Jun 06 22:00:00 2020
    CRL Extensions:

  4. Add the client certificate you want to revoke to the CRL. Here we specify the certificate’s serial number in decimal, and the revocation time in GeneralizedTime format (YYYYMMDDhhmmssZ) in UTC.

    crlutil -M -d sql:/etc/ipsec.d -n "IKEv2 VPN CA" <<EOF
addcert 3446275956 20200606220100Z
EOF
    CRL Info:
:
    Version: 2 (0x1)
    Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
    Issuer: "O=IKEv2 VPN,CN=IKEv2 VPN CA"
    This Update: Sat Jun 06 22:02:00 2020
    Entry 1 (0x1):
        Serial Number:
            00:cd:69:ff:74
        Revocation Date: Sat Jun 06 22:01:00 2020
    CRL Extensions:

    Note: If you want to remove a certificate from the CRL, replace addcert 3446275956 20200606220100Z above with rmcert 3446275956. For other crlutil usage, read here.

  5. Finally, let Libreswan re-read the updated CRL.

Change IKEv2 server address

In certain circumstances, you may need to change the IKEv2 server address after setup. For example, to switch to use a DNS name, or after server IP changes. Note that the server address you specify on VPN client devices must exactly match the server address in the output of the IKEv2 helper script. Otherwise, devices may be unable to connect.

To change the server address, run the helper script and follow the prompts.

wget https://get.vpnsetup.net/ikev2addr -O ikev2addr.sh
sudo bash ikev2addr.sh

Important: After running this script, you must manually update the server address (and remote ID, if applicable) on any existing IKEv2 client devices. For iOS clients, you’ll need to export and re-import client configuration using the IKEv2 helper script.

Update IKEv2 helper script

The IKEv2 helper script is updated from time to time for bug fixes and improvements (commit log). When a newer version is available, you may optionally update the IKEv2 helper script on your server. Note that these commands will overwrite any existing ikev2.sh.

wget https://get.vpnsetup.net/ikev2 -O /opt/src/ikev2.sh
chmod +x /opt/src/ikev2.sh && ln -s /opt/src/ikev2.sh /usr/bin 2>/dev/null

Set up IKEv2 using helper script

Note: By default, IKEv2 is automatically set up when running the VPN setup script. You may skip this section and continue to configure IKEv2 VPN clients.

Important: Before continuing, you should have successfully set up your own VPN server. Docker users, see here.

Use this helper script to automatically set up IKEv2 on the VPN server:

# Set up IKEv2 using default options
sudo ikev2.sh --auto
# Alternatively, you may customize IKEv2 options
sudo ikev2.sh

Note: If IKEv2 is already set up, but you want to customize IKEv2 options, first remove IKEv2, then set it up again using sudo ikev2.sh.

When finished, continue to configure IKEv2 VPN clients. Advanced users can optionally enable IKEv2-only mode.

Error: «sudo: ikev2.sh: command not found».

This is normal if you used an older version of the VPN setup script. First, download the IKEv2 helper script:

wget https://get.vpnsetup.net/ikev2 -O /opt/src/ikev2.sh
chmod +x /opt/src/ikev2.sh && ln -s /opt/src/ikev2.sh /usr/bin

Then run the script using the instructions above.

You may optionally specify a DNS name, client name and/or custom DNS servers.

When running IKEv2 setup in auto mode, advanced users can optionally specify a DNS name for the IKEv2 server address. The DNS name must be a fully qualified domain name (FQDN). Example:

sudo VPN_DNS_NAME='vpn.example.com' ikev2.sh --auto

Similarly, you may specify a name for the first IKEv2 client. The default is vpnclient if not specified.

sudo VPN_CLIENT_NAME='your_client_name' ikev2.sh --auto

By default, IKEv2 clients are set to use Google Public DNS when the VPN is active. You may specify custom DNS server(s) for IKEv2. Example:

sudo VPN_DNS_SRV1=1.1.1.1 VPN_DNS_SRV2=1.0.0.1 ikev2.sh --auto

By default, no password is required when importing IKEv2 client configuration. You can choose to protect client config files using a random password.

sudo VPN_PROTECT_CONFIG=yes ikev2.sh --auto

View usage information for the IKEv2 script.

Usage: bash ikev2.sh [options]

Options:
  --auto                        run IKEv2 setup in auto mode using default options (for initial setup only)
  --addclient [client name]     add a new client using default options
  --exportclient [client name]  export configuration for an existing client
  --listclients                 list the names of existing clients
  --revokeclient [client name]  revoke an existing client
  --deleteclient [client name]  delete an existing client
  --removeikev2                 remove IKEv2 and delete all certificates and keys from the IPsec database
  -h, --help                    show this help message and exit

To customize IKEv2 or client options, run this script without arguments.

Manually set up IKEv2

As an alternative to using the helper script, advanced users can manually set up IKEv2 on the VPN server. Before continuing, it is recommended to update Libreswan to the latest version.

The following example shows how to manually configure IKEv2 with Libreswan. Commands below must be run as root.

View example steps for manually configuring IKEv2 with Libreswan.

  1. Find the VPN server’s public IP, save it to a variable and check.

    PUBLIC_IP=$(dig @resolver1.opendns.com -t A -4 myip.opendns.com +short)
[ -z "$PUBLIC_IP" ] && PUBLIC_IP=$(wget -t 2 -T 10 -qO- http://ipv4.icanhazip.com)
printf '%sn' "$PUBLIC_IP"

    Check to make sure the output matches the server’s public IP. This variable is required in the steps below.

    Note: Alternatively, you may specify the server’s DNS name here. e.g. PUBLIC_IP=myvpn.example.com.

  2. Add a new IKEv2 connection:

    if ! grep -qs '^include /etc/ipsec.d/*.conf$' /etc/ipsec.conf; then
  echo >> /etc/ipsec.conf
  echo 'include /etc/ipsec.d/*.conf' >> /etc/ipsec.conf
fi

    Note: If you specified the server’s DNS name (instead of its IP address) in step 1 above, you must replace leftid=$PUBLIC_IP in the command below with leftid=@$PUBLIC_IP.

    cat > /etc/ipsec.d/ikev2.conf <<EOF

conn ikev2-cp
  left=%defaultroute
  leftcert=$PUBLIC_IP
  leftid=$PUBLIC_IP
  leftsendcert=always
  leftsubnet=0.0.0.0/0
  leftrsasigkey=%cert
  right=%any
  rightid=%fromcert
  rightaddresspool=192.168.43.10-192.168.43.250
  rightca=%same
  rightrsasigkey=%cert
  narrowing=yes
  dpddelay=30
  retransmit-timeout=300s
  dpdaction=clear
  auto=add
  ikev2=insist
  rekey=no
  pfs=no
  ike=aes256-sha2,aes128-sha2,aes256-sha1,aes128-sha1
  phase2alg=aes_gcm-null,aes128-sha1,aes256-sha1,aes128-sha2,aes256-sha2
  ikelifetime=24h
  salifetime=24h
EOF

    We need to add a few more lines to that file. First check your Libreswan version, then run one of the following commands:

    For Libreswan 3.23 and newer:

    cat >> /etc/ipsec.d/ikev2.conf <<EOF
  modecfgdns="8.8.8.8 8.8.4.4"
  encapsulation=yes
  mobike=no
EOF

    Note: The MOBIKE IKEv2 extension allows VPN clients to change network attachment points, e.g. switch between mobile data and Wi-Fi and keep the IPsec tunnel up on the new IP. If your server (or Docker host) is NOT running Ubuntu Linux, and you wish to enable MOBIKE support, replace mobike=no with mobike=yes in the command above. DO NOT enable this option on Ubuntu systems or Raspberry Pis.

    For Libreswan 3.19-3.22:

    cat >> /etc/ipsec.d/ikev2.conf <<EOF
  modecfgdns1=8.8.8.8
  modecfgdns2=8.8.4.4
  encapsulation=yes
EOF

    For Libreswan 3.18 and older:

    cat >> /etc/ipsec.d/ikev2.conf <<EOF
  modecfgdns1=8.8.8.8
  modecfgdns2=8.8.4.4
  forceencaps=yes
EOF

  3. Generate Certificate Authority (CA) and VPN server certificates.

    Note: Specify the certificate validity period (in months) with «-v». e.g. «-v 120».

    Generate CA certificate:

    certutil -z <(head -c 1024 /dev/urandom) 
  -S -x -n "IKEv2 VPN CA" 
  -s "O=IKEv2 VPN,CN=IKEv2 VPN CA" 
  -k rsa -g 3072 -v 120 
  -d sql:/etc/ipsec.d -t "CT,," -2
    Generating key.  This may take a few moments...

Is this a CA certificate [y/N]?
y
Enter the path length constraint, enter to skip [<0 for unlimited path]: >
Is this a critical extension [y/N]?
N

    Generate VPN server certificate:

    Note: If you specified the server’s DNS name (instead of its IP address) in step 1 above, you must replace --extSAN "ip:$PUBLIC_IP,dns:$PUBLIC_IP" in the command below with --extSAN "dns:$PUBLIC_IP".

    certutil -z <(head -c 1024 /dev/urandom) 
  -S -c "IKEv2 VPN CA" -n "$PUBLIC_IP" 
  -s "O=IKEv2 VPN,CN=$PUBLIC_IP" 
  -k rsa -g 3072 -v 120 
  -d sql:/etc/ipsec.d -t ",," 
  --keyUsage digitalSignature,keyEncipherment 
  --extKeyUsage serverAuth 
  --extSAN "ip:$PUBLIC_IP,dns:$PUBLIC_IP"
    Generating key.  This may take a few moments...

  4. Generate client certificate(s), then export the .p12 file that contains the client certificate, private key, and CA certificate.

    Note: You may repeat this step to generate certificates for additional VPN clients, but make sure to replace every vpnclient with vpnclient2, etc. To connect multiple IKEv2 clients from behind the same NAT (e.g. home router) at the same time, you will need to generate a unique certificate for each client.

    Generate client certificate:

    certutil -z <(head -c 1024 /dev/urandom) 
  -S -c "IKEv2 VPN CA" -n "vpnclient" 
  -s "O=IKEv2 VPN,CN=vpnclient" 
  -k rsa -g 3072 -v 120 
  -d sql:/etc/ipsec.d -t ",," 
  --keyUsage digitalSignature,keyEncipherment 
  --extKeyUsage serverAuth,clientAuth -8 "vpnclient"
    Generating key.  This may take a few moments...

    Export .p12 file:

    pk12util -d sql:/etc/ipsec.d -n "vpnclient" -o vpnclient.p12
    Enter password for PKCS12 file:
Re-enter password:
pk12util: PKCS12 EXPORT SUCCESSFUL

    Enter a secure password to protect the exported .p12 file (when importing into an iOS or macOS device, this password cannot be empty).

  5. (For iOS clients) Export the CA certificate as ca.cer:

    certutil -L -d sql:/etc/ipsec.d -n "IKEv2 VPN CA" -a -o ca.cer

  6. The database should now contain:

    certutil -L -d sql:/etc/ipsec.d
    Certificate Nickname                               Trust Attributes
                                                   SSL,S/MIME,JAR/XPI

IKEv2 VPN CA                                       CTu,u,u
($PUBLIC_IP)                                       u,u,u
vpnclient                                          u,u,u

    Note: To display a certificate, use certutil -L -d sql:/etc/ipsec.d -n "Nickname". To revoke a client certificate, follow these steps. For other certutil usage, read here.

  7. (Important) Restart the IPsec service:

Before continuing, you must restart the IPsec service. The IKEv2 setup on the VPN server is now complete. Follow instructions to configure VPN clients.

Remove IKEv2

If you want to remove IKEv2 from the VPN server, but keep the IPsec/L2TP and IPsec/XAuth («Cisco IPsec») modes (if installed), run the helper script. Warning: All IKEv2 configuration including certificates and keys will be permanently deleted. This cannot be undone!

sudo ikev2.sh --removeikev2

After removing IKEv2, if you want to set it up again, refer to this section.

Alternatively, you can manually remove IKEv2.

To manually remove IKEv2 from the VPN server, but keep the IPsec/L2TP and IPsec/XAuth («Cisco IPsec») modes, follow these steps. Commands must be run as root.

Warning: All IKEv2 configuration including certificates and keys will be permanently deleted. This cannot be undone!

  1. Rename (or delete) the IKEv2 config file:

    mv /etc/ipsec.d/ikev2.conf /etc/ipsec.d/ikev2.conf.bak

    Note: If you used an older version (before 2020-05-31) of the IKEv2 helper script or instructions, file /etc/ipsec.d/ikev2.conf may not exist. In this case, please instead remove the conn ikev2-cp section from file /etc/ipsec.conf.

  2. (Important) Restart the IPsec service:

  3. List certificates in the IPsec database:

    certutil -L -d sql:/etc/ipsec.d

    Example output:

    Certificate Nickname                               Trust Attributes
                                                   SSL,S/MIME,JAR/XPI

IKEv2 VPN CA                                       CTu,u,u
($PUBLIC_IP)                                       u,u,u
vpnclient                                          u,u,u

  4. Delete the Certificate Revocation List (CRL), if any:

    crlutil -D -d sql:/etc/ipsec.d -n "IKEv2 VPN CA" 2>/dev/null

  5. Delete certificates and keys. Replace «Nickname» below with each certificate’s nickname. Repeat these commands for each certificate. When finished, list certificates in the IPsec database again, and confirm that the list is empty.

    certutil -F -d sql:/etc/ipsec.d -n "Nickname"
certutil -D -d sql:/etc/ipsec.d -n "Nickname" 2>/dev/null

References

  • https://libreswan.org/wiki/VPN_server_for_remote_clients_using_IKEv2
  • https://libreswan.org/wiki/HOWTO:_Using_NSS_with_libreswan
  • https://libreswan.org/man/ipsec.conf.5.html
  • https://docs.strongswan.org/docs/5.9/interop/windowsClients.html
  • https://docs.strongswan.org/docs/5.9/os/androidVpnClient.html
  • https://firefox-source-docs.mozilla.org/security/nss/legacy/tools/nss_tools_certutil/index.html
  • https://firefox-source-docs.mozilla.org/security/nss/legacy/tools/nss_tools_crlutil/index.html

License

Copyright (C) 2016-2023 Lin Song View my profile on LinkedIn

Creative Commons License
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Unported License
Attribution required: please include my name in any derivative and let me know how you have improved it!

Источник

English | 中文

Guide: How to Set Up and Use IKEv2 VPN

  • Introduction
  • Configure IKEv2 VPN clients
  • IKEv2 troubleshooting
  • Manage IKEv2 clients
  • Change IKEv2 server address
  • Update IKEv2 helper script
  • Set up IKEv2 using helper script
  • Manually set up IKEv2
  • Remove IKEv2

Introduction

Modern operating systems support the IKEv2 standard. Internet Key Exchange (IKE or IKEv2) is the protocol used to set up a Security Association (SA) in the IPsec protocol suite. Compared to IKE version 1, IKEv2 contains improvements such as Standard Mobility support through MOBIKE, and improved reliability.

Libreswan can authenticate IKEv2 clients on the basis of X.509 Machine Certificates using RSA signatures. This method does not require an IPsec PSK, username or password. It can be used with Windows, macOS, iOS, Android, Chrome OS, Linux and RouterOS.

By default, IKEv2 is automatically set up when running the VPN setup script. If you want to learn more about setting up IKEv2, see Set up IKEv2 using helper script. Docker users, see Configure and use IKEv2 VPN.

Configure IKEv2 VPN clients

Note: To add or export IKEv2 clients, run sudo ikev2.sh. Use -h to show usage. Client config files can be safely deleted after import.

  • Windows 7, 8, 10 and 11
  • OS X (macOS)
  • iOS (iPhone/iPad)
  • Android
  • Chrome OS (Chromebook)
  • Linux
  • Mikrotik RouterOS

Learn how to change the IKEv2 server address.

In certain circumstances, you may need to change the IKEv2 server address. For example, to switch to use a DNS name, or after server IP changes. Learn more in this section.

Windows 7, 8, 10 and 11

Auto-import configuration

Screencast: IKEv2 Auto Import Configuration on Windows

Windows 8, 10 and 11 users can automatically import IKEv2 configuration:

  1. Securely transfer the generated .p12 file to your computer.
  2. Right-click on ikev2_config_import.cmd and save this helper script to the same folder as the .p12 file.
  3. Right-click on the saved script, select Properties. Click on Unblock at the bottom, then click on OK.
  4. Right-click on the saved script, select Run as administrator and follow the prompts.

To connect to the VPN: Click on the wireless/network icon in your system tray, select the new VPN entry, and click Connect. Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say «Your public IP address is Your VPN Server IP«.

If you get an error when trying to connect, see Troubleshooting.

Manually import configuration

[Supporters] Screencast: IKEv2 Manually Import Configuration on Windows

Alternatively, Windows 7, 8, 10 and 11 users can manually import IKEv2 configuration:

  1. Securely transfer the generated .p12 file to your computer, then import it into the certificate store.

    To import the .p12 file, run the following from an elevated command prompt:

    # Import .p12 file (replace with your own value)
certutil -f -importpfx "pathtoyourfile.p12" NoExport

    Note: If there is no password for client config files, press Enter to continue, or if manually importing the .p12 file, leave the password field blank.

    Alternatively, you can manually import the .p12 file. Make sure that the client cert is placed in «Personal -> Certificates», and the CA cert is placed in «Trusted Root Certification Authorities -> Certificates».

  2. On the Windows computer, add a new IKEv2 VPN connection.

    For Windows 8, 10 and 11, it is recommended to create the VPN connection using the following commands from a command prompt, for improved security and performance.

    # Create VPN connection (replace server address with your own value)
powershell -command ^"Add-VpnConnection -ServerAddress 'Your VPN Server IP (or DNS name)' ^
  -Name 'My IKEv2 VPN' -TunnelType IKEv2 -AuthenticationMethod MachineCertificate ^
  -EncryptionLevel Required -PassThru^"
# Set IPsec configuration
powershell -command ^"Set-VpnConnectionIPsecConfiguration -ConnectionName 'My IKEv2 VPN' ^
  -AuthenticationTransformConstants GCMAES128 -CipherTransformConstants GCMAES128 ^
  -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -PfsGroup None ^
  -DHGroup Group14 -PassThru -Force^"

    Windows 7 does not support these commands, you can manually create the VPN connection.

    Note: The server address you specify must exactly match the server address in the output of the IKEv2 helper script. For example, if you specified the server’s DNS name during IKEv2 setup, you must enter the DNS name in the Internet address field.

  3. This step is required if you manually created the VPN connection.

    Enable stronger ciphers for IKEv2 with a one-time registry change. Download and import the .reg file below, or run the following from an elevated command prompt. Read more here.

    • For Windows 7, 8, 10 and 11 (download .reg file)

      REG ADD HKLMSYSTEMCurrentControlSetServicesRasManParameters /v NegotiateDH2048_AES256 /t REG_DWORD /d 0x1 /f

To connect to the VPN: Click on the wireless/network icon in your system tray, select the new VPN entry, and click Connect. Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say «Your public IP address is Your VPN Server IP«.

If you get an error when trying to connect, see Troubleshooting.

Remove the IKEv2 VPN connection.

Using the following steps, you can remove the VPN connection and optionally restore the computer to the status before IKEv2 configuration import.

  1. Remove the added VPN connection in Windows Settings — Network — VPN. Windows 7 users can remove the VPN connection in Network and Sharing Center — Change adapter settings.

  2. (Optional) Remove IKEv2 certificates.

    1. Press Win+R, or search for mmc in the Start Menu. Open Microsoft Management Console.

    2. Open File - Add/Remove Snap-In. Select to add Certificates and in the window that opens, select Computer account -> Local Computer. Click on Finish -> OK to save the settings.

    3. Go to Certificates - Personal - Certificates and delete the IKEv2 client certificate. The name of the certificate is the same as the IKEv2 client name you specified (default: vpnclient). The certificate was issued by IKEv2 VPN CA.

    4. Go to Certificates - Trusted Root Certification Authorities - Certificates and delete the IKEv2 VPN CA certificate. The certificate was issued to IKEv2 VPN CA by IKEv2 VPN CA. Before deleting, make sure that there are no other certificate(s) issued by IKEv2 VPN CA in Certificates - Personal - Certificates.

  3. (Optional. For users who manually created the VPN connection) Restore registry settings. Note that you should backup the registry before editing.

    1. Press Win+R, or search for regedit in the Start Menu. Open Registry Editor.

    2. Go to HKEY_LOCAL_MACHINESystemCurrentControlSetServicesRasmanParameters and delete the item with name NegotiateDH2048_AES256, if it exists.

OS X (macOS)

[Supporters] Screencast: IKEv2 Import Configuration and Connect on macOS

First, securely transfer the generated .mobileconfig file to your Mac, then double-click and follow the prompts to import as a macOS profile. If your Mac runs macOS Big Sur or newer, open System Preferences and go to the Profiles section to finish importing. When finished, check to make sure «IKEv2 VPN» is listed under System Preferences -> Profiles.

To connect to the VPN:

  1. Open System Preferences and go to the Network section.
  2. Select the VPN connection with Your VPN Server IP (or DNS name).
  3. Check the Show VPN status in menu bar checkbox.
  4. Click Connect.

(Optional feature) Enable VPN On Demand to automatically start a VPN connection when your Mac is on Wi-Fi. To enable, check the Connect on demand checkbox for the VPN connection, and click Apply. You can customize VPN On Demand rules to exclude certain Wi-Fi network(s) such as your home network. See «Guide: Customize IKEv2 VPN On Demand rules for macOS and iOS» in 📖 Book: Set Up Your Own IPsec VPN, OpenVPN and WireGuard Server.

If you manually set up IKEv2 without using the helper script, click here for instructions.

First, securely transfer the generated .p12 file to your Mac, then double-click to import into the login keychain in Keychain Access. Next, double-click on the imported IKEv2 VPN CA certificate, expand Trust and select Always Trust from the IP Security (IPsec) drop-down menu. Close the dialog using the red «X» on the top-left corner. When prompted, use Touch ID or enter your password and click «Update Settings».

When finished, check to make sure both the new client certificate and IKEv2 VPN CA are listed under the Certificates category of login keychain.

  1. Open System Preferences and go to the Network section.
  2. Click the + button in the lower-left corner of the window.
  3. Select VPN from the Interface drop-down menu.
  4. Select IKEv2 from the VPN Type drop-down menu.
  5. Enter anything you like for the Service Name.
  6. Click Create.
  7. Enter Your VPN Server IP (or DNS name) for the Server Address.
    Note: If you specified the server’s DNS name (instead of its IP address) during IKEv2 setup, you must enter the DNS name in the Server Address and Remote ID fields.
  8. Enter Your VPN Server IP (or DNS name) for the Remote ID.
  9. Enter Your VPN client name in the Local ID field.
    Note: This must match exactly the client name you specified during IKEv2 setup. Same as the first part of your .p12 filename.
  10. Click the Authentication Settings… button.
  11. Select None from the Authentication Settings drop-down menu.
  12. Select the Certificate radio button, then select the new client certificate.
  13. Click OK.
  14. Check the Show VPN status in menu bar checkbox.
  15. Click Apply to save the VPN connection information.
  16. Click Connect.

Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say «Your public IP address is Your VPN Server IP«.

If you get an error when trying to connect, see Troubleshooting.

Remove the IKEv2 VPN connection.

To remove the IKEv2 VPN connection, open System Preferences -> Profiles and remove the IKEv2 VPN profile you added.

iOS

[Supporters] Screencast: IKEv2 Import Configuration and Connect on iOS (iPhone & iPad)

First, securely transfer the generated .mobileconfig file to your iOS device, then import it as an iOS profile. To transfer the file, you may use:

  1. AirDrop, or
  2. Upload to your device (any App folder) using File Sharing, then open the «Files» App on your iOS device, move the uploaded file to the «On My iPhone» folder. After that, tap the file and go to the «Settings» App to import, or
  3. Host the file on a secure website of yours, then download and import it in Mobile Safari.

When finished, check to make sure «IKEv2 VPN» is listed under Settings -> General -> VPN & Device Management or Profile(s).

To connect to the VPN:

  1. Go to Settings -> VPN. Select the VPN connection with Your VPN Server IP (or DNS name).
  2. Slide the VPN switch ON.

(Optional feature) Enable VPN On Demand to automatically start a VPN connection when your iOS device is on Wi-Fi. To enable, tap the «i» icon on the right of the VPN connection, and enable Connect On Demand. You can customize VPN On Demand rules to exclude certain Wi-Fi network(s) such as your home network, or to start the VPN connection both on Wi-Fi and cellular. See «Guide: Customize IKEv2 VPN On Demand rules for macOS and iOS» in 📖 Book: Set Up Your Own IPsec VPN, OpenVPN and WireGuard Server.

If you manually set up IKEv2 without using the helper script, click here for instructions.

First, securely transfer the generated ca.cer and .p12 files to your iOS device, then import them one by one as iOS profiles. To transfer the files, you may use:

  1. AirDrop, or
  2. Upload to your device (any App folder) using File Sharing, then open the «Files» App on your iOS device, move the uploaded files to the «On My iPhone» folder. After that, tap each file and go to the «Settings» App to import, or
  3. Host the files on a secure website of yours, then download and import them in Mobile Safari.

When finished, check to make sure both the new client certificate and IKEv2 VPN CA are listed under Settings -> General -> VPN & Device Management or Profile(s).

  1. Go to Settings -> General -> VPN & Device Management -> VPN.
  2. Tap Add VPN Configuration….
  3. Tap Type. Select IKEv2 and go back.
  4. Tap Description and enter anything you like.
  5. Tap Server and enter Your VPN Server IP (or DNS name).
    Note: If you specified the server’s DNS name (instead of its IP address) during IKEv2 setup, you must enter the DNS name in the Server and Remote ID fields.
  6. Tap Remote ID and enter Your VPN Server IP (or DNS name).
  7. Enter Your VPN client name in the Local ID field.
    Note: This must match exactly the client name you specified during IKEv2 setup. Same as the first part of your .p12 filename.
  8. Tap User Authentication. Select None and go back.
  9. Make sure the Use Certificate switch is ON.
  10. Tap Certificate. Select the new client certificate and go back.
  11. Tap Done.
  12. Slide the VPN switch ON.

Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say «Your public IP address is Your VPN Server IP«.

If you get an error when trying to connect, see Troubleshooting.

Remove the IKEv2 VPN connection.

To remove the IKEv2 VPN connection, open Settings -> General -> VPN & Device Management or Profile(s) and remove the IKEv2 VPN profile you added.

Android

[Supporters] Screencast: Connect using Android strongSwan VPN Client

  1. Securely transfer the generated .sswan file to your Android device.
  2. Install strongSwan VPN Client from Google Play, F-Droid or strongSwan download server.
  3. Launch the strongSwan VPN client.
  4. Tap the «more options» menu on top right, then tap Import VPN profile.
  5. Choose the .sswan file you transferred from the VPN server.
    Note: To find the .sswan file, tap the three-line menu button, then browse to the location you saved the file.
  6. On the «Import VPN profile» screen, tap IMPORT CERTIFICATE FROM VPN PROFILE, and follow the prompts.
  7. On the «Choose certificate» screen, select the new client certificate, then tap Select.
  8. Tap IMPORT.
  9. Tap the new VPN profile to connect.

Alternatively, Android 11+ users can also connect using the native IKEv2 client.

[Supporters] Screencast: Connect using Native VPN Client on Android 11+

  1. Securely transfer the generated .p12 file to your Android device.
  2. Launch the Settings application.
  3. Go to Security -> Advanced -> Encryption & credentials.
  4. Tap Install a certificate.
  5. Tap VPN & app user certificate.
  6. Choose the .p12 file you transferred from the VPN server.
    Note: To find the .p12 file, tap the three-line menu button, then browse to the location you saved the file.
  7. Enter a name for the certificate, then tap OK.
  8. Go to Settings -> Network & internet -> VPN, then tap the «+» button.
  9. Enter a name for the VPN profile.
  10. Select IKEv2/IPSec RSA from the Type drop-down menu.
  11. Enter Your VPN Server IP (or DNS name) in the Server address field.
    Note: This must exactly match the server address in the output of the IKEv2 helper script.
  12. Enter anything (e.g. empty) in the IPSec identifier field.
    Note: This field should not be required. It is a bug in Android.
  13. Select the certificate you imported from the IPSec user certificate drop-down menu.
  14. Select the certificate you imported from the IPSec CA certificate drop-down menu.
  15. Select (receive from server) from the IPSec server certificate drop-down menu.
  16. Tap Save. Then tap the new VPN connection and tap Connect.

If your device runs Android 6.0 or older, click here for additional instructions.

If your device runs Android 6.0 (Marshmallow) or older, in order to connect using the strongSwan VPN client, you must make the following change on the VPN server: Edit /etc/ipsec.d/ikev2.conf on the server. Append authby=rsa-sha1 to the end of the conn ikev2-cp section, indented by two spaces. Save the file and run service ipsec restart.

(Optional feature) You can choose to enable the «Always-on VPN» feature on Android. Launch the Settings app, go to Network & internet -> Advanced -> VPN, click the gear icon on the right of «strongSwan VPN Client», then enable the Always-on VPN and Block connections without VPN options.

If you manually set up IKEv2 without using the helper script, click here for instructions.

Android 10 and newer:

  1. Securely transfer the generated .p12 file to your Android device.
  2. Install strongSwan VPN Client from Google Play, F-Droid or strongSwan download server.
  3. Launch the Settings application.
  4. Go to Security -> Advanced -> Encryption & credentials.
  5. Tap Install a certificate.
  6. Tap VPN & app user certificate.
  7. Choose the .p12 file you transferred from the VPN server, and follow the prompts.
    Note: To find the .p12 file, tap the three-line menu button, then browse to the location you saved the file.
  8. Launch the strongSwan VPN client and tap Add VPN Profile.
  9. Enter Your VPN Server IP (or DNS name) in the Server field.
    Note: If you specified the server’s DNS name (instead of its IP address) during IKEv2 setup, you must enter the DNS name in the Server field.
  10. Select IKEv2 Certificate from the VPN Type drop-down menu.
  11. Tap Select user certificate, select the new client certificate and confirm.
  12. (Important) Tap Show advanced settings. Scroll down, find and enable the Use RSA/PSS signatures option.
  13. Save the new VPN connection, then tap to connect.

Android 4 to 9:

  1. Securely transfer the generated .p12 file to your Android device.
  2. Install strongSwan VPN Client from Google Play, F-Droid or strongSwan download server.
  3. Launch the strongSwan VPN client and tap Add VPN Profile.
  4. Enter Your VPN Server IP (or DNS name) in the Server field.
    Note: If you specified the server’s DNS name (instead of its IP address) during IKEv2 setup, you must enter the DNS name in the Server field.
  5. Select IKEv2 Certificate from the VPN Type drop-down menu.
  6. Tap Select user certificate, then tap Install certificate.
  7. Choose the .p12 file you transferred from the VPN server, and follow the prompts.
    Note: To find the .p12 file, tap the three-line menu button, then browse to the location you saved the file.
  8. (Important) Tap Show advanced settings. Scroll down, find and enable the Use RSA/PSS signatures option.
  9. Save the new VPN connection, then tap to connect.

Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say «Your public IP address is Your VPN Server IP«.

If you get an error when trying to connect, see Troubleshooting.

Chrome OS

First, on your VPN server, export the CA certificate as ca.cer:

sudo certutil -L -d sql:/etc/ipsec.d -n "IKEv2 VPN CA" -a -o ca.cer

Securely transfer the generated .p12 and ca.cer files to your Chrome OS device.

Install user and CA certificates:

  1. Open a new tab in Google Chrome.
  2. In the address bar, enter chrome://settings/certificates
  3. (Important) Click Import and Bind, not Import.
  4. In the box that opens, choose the .p12 file you transferred from the VPN server and select Open.
  5. Click OK if the certificate does not have a password. Otherwise, enter the certificate’s password.
  6. Click the Authorities tab. Then click Import.
  7. In the box that opens, select All files in the drop-down menu at the bottom left.
  8. Choose the ca.cer file you transferred from the VPN server and select Open.
  9. Keep the default options and click OK.

Add a new VPN connection:

  1. Go to Settings -> Network.
  2. Click Add connection, then click Add built-in VPN.
  3. Enter anything you like for the Service name.
  4. Select IPsec (IKEv2) in the Provider type drop-down menu.
  5. Enter Your VPN Server IP (or DNS name) for the Server hostname.
  6. Select User certificate in the Authentication type drop-down menu.
  7. Select IKEv2 VPN CA [IKEv2 VPN CA] in the Server CA certificate drop-down menu.
  8. Select IKEv2 VPN CA [client name] in the User certificate drop-down menu.
  9. Leave other fields blank.
  10. Enable Save identity and password.
  11. Click Connect.

Once connected, you will see a VPN icon overlay on the network status icon. You can verify that your traffic is being routed properly by looking up your IP address on Google. It should say «Your public IP address is Your VPN Server IP«.

(Optional feature) You can choose to enable the «Always-on VPN» feature on Chrome OS. To manage this setting, go to Settings -> Network, then click VPN.

If you get an error when trying to connect, see Troubleshooting.

Linux

Before configuring Linux VPN clients, you must make the following change on the VPN server: Edit /etc/ipsec.d/ikev2.conf on the server. Append authby=rsa-sha1 to the end of the conn ikev2-cp section, indented by two spaces. Save the file and run service ipsec restart.

To configure your Linux computer to connect to IKEv2 as a VPN client, first install the strongSwan plugin for NetworkManager:

# Ubuntu and Debian
sudo apt-get update
sudo apt-get install network-manager-strongswan

# Arch Linux
sudo pacman -Syu  # upgrade all packages
sudo pacman -S networkmanager-strongswan

# Fedora
sudo yum install NetworkManager-strongswan-gnome

# CentOS
sudo yum install epel-release
sudo yum --enablerepo=epel install NetworkManager-strongswan-gnome

Next, securely transfer the generated .p12 file from the VPN server to your Linux computer. After that, extract the CA certificate, client certificate and private key. Replace vpnclient.p12 in the example below with the name of your .p12 file.

# Example: Extract CA certificate, client certificate and private key.
#          You may delete the .p12 file when finished.
# Note: You may need to enter the import password, which can be found
#       in the output of the IKEv2 helper script. If the output does not
#       contain an import password, press Enter to continue.
# Note: If using OpenSSL 3.x (run "openssl version" to check),
#       append "-legacy" to the 3 commands below.
openssl pkcs12 -in vpnclient.p12 -cacerts -nokeys -out ca.cer
openssl pkcs12 -in vpnclient.p12 -clcerts -nokeys -out client.cer
openssl pkcs12 -in vpnclient.p12 -nocerts -nodes  -out client.key
rm vpnclient.p12

# (Important) Protect certificate and private key files
# Note: This step is optional, but strongly recommended.
sudo chown root.root ca.cer client.cer client.key
sudo chmod 600 ca.cer client.cer client.key

You can then set up and enable the VPN connection:

  1. Go to Settings -> Network -> VPN. Click the + button.
  2. Select IPsec/IKEv2 (strongswan).
  3. Enter anything you like in the Name field.
  4. In the Gateway (Server) section, enter Your VPN Server IP (or DNS name) for the Address.
  5. Select the ca.cer file for the Certificate.
  6. In the Client section, select Certificate(/private key) in the Authentication drop-down menu.
  7. Select Certificate/private key in the Certificate drop-down menu (if exists).
  8. Select the client.cer file for the Certificate (file).
  9. Select the client.key file for the Private key.
  10. In the Options section, check the Request an inner IP address checkbox.
  11. In the Cipher proposals (Algorithms) section, check the Enable custom proposals checkbox.
  12. Leave the IKE field blank.
  13. Enter aes128gcm16 in the ESP field.
  14. Click Add to save the VPN connection information.
  15. Turn the VPN switch ON.

Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say «Your public IP address is Your VPN Server IP«.

If you get an error when trying to connect, see Troubleshooting.

RouterOS

Note: These steps were contributed by @Unix-User. It is recommended to run terminal commands via an SSH connection, e.g. via Putty.

  1. Securely transfer the generated .p12 file to your computer.

    Click to see screencast.

    routeros get certificate

  2. In WinBox, go to System > certificates > import. Import the .p12 certificate file twice (yes, import the same file two times!). Verify in your certificates panel. You will see 2 files, the one that is marked KT is the key.

    Click to see screencast.

    routeros import certificate

    Or you can use terminal instead (empty passphrase):

    [admin@MikroTik] > /certificate/import file-name=mikrotik.p12
passphrase:

  certificates-imported: 2
  private-keys-imported: 0
         files-imported: 1
    decryption-failures: 0
  keys-with-no-certificate: 0

[admin@MikroTik] > /certificate/import file-name=mikrotik.p12
passphrase:

     certificates-imported: 0
     private-keys-imported: 1
            files-imported: 1
       decryption-failures: 0
  keys-with-no-certificate: 0

  3. Run these commands in terminal. Replace the following with your own values.
    YOUR_VPN_SERVER_IP_OR_DNS_NAME is your VPN server IP or DNS name.
    IMPORTED_CERTIFICATE is the name of the certificate from step 2 above, e.g. vpnclient.p12_0
    (the one flagged with KT — Priv. Key Trusted — if not flagged as KT, import certificate again).
    THESE_ADDRESSES_GO_THROUGH_VPN are the local network addresses that you want to browse through the VPN.
    Assuming that your local network behind RouterOS is 192.168.0.0/24, you can use 192.168.0.0/24
    for the entire network, or use 192.168.0.10 for just one device, and so on.

    /ip firewall address-list add address=THESE_ADDRESSES_GO_THROUGH_VPN list=local
/ip ipsec mode-config add name=ike2-rw responder=no src-address-list=local
/ip ipsec policy group add name=ike2-rw
/ip ipsec profile add name=ike2-rw
/ip ipsec peer add address=YOUR_VPN_SERVER_IP_OR_DNS_NAME exchange-mode=ike2 
    name=ike2-rw-client profile=ike2-rw
/ip ipsec proposal add name=ike2-rw pfs-group=none
/ip ipsec identity add auth-method=digital-signature certificate=IMPORTED_CERTIFICATE 
    generate-policy=port-strict mode-config=ike2-rw 
    peer=ike2-rw-client policy-template-group=ike2-rw
/ip ipsec policy add group=ike2-rw proposal=ike2-rw template=yes

  4. For more information, see #1112.

tested on
mar/02/2022 12:52:57 by RouterOS 6.48
RouterBOARD 941-2nD

IKEv2 troubleshooting

Read this in other languages: English, 中文.

See also: Check logs and VPN status, IKEv1 troubleshooting and Advanced usage.

  • Cannot connect to the VPN server
  • Unable to connect multiple IKEv2 clients
  • IKE authentication credentials are unacceptable
  • Policy match error
  • Parameter is incorrect
  • Cannot open websites after connecting to IKEv2
  • Windows 10 connecting
  • Other known issues

Cannot connect to the VPN server

First, make sure that the VPN server address specified on your VPN client device exactly matches the server address in the output of the IKEv2 helper script. Refer to the sections below and Check logs and VPN status.

For servers with an external firewall (e.g. EC2/GCE), open UDP ports 500 and 4500 for the VPN. Aliyun users, see #433.

Unable to connect multiple IKEv2 clients

To connect multiple IKEv2 clients from behind the same NAT (e.g. home router) at the same time, you will need to generate a unique certificate for each client. Otherwise, you could encounter the issue where a later connected client affects the VPN connection of an existing client, which may lose Internet access.

To generate certificates for additional IKEv2 clients, run the helper script with the --addclient option. To customize client options, run the script without arguments.

sudo ikev2.sh --addclient [client name]

IKE authentication credentials are unacceptable

If you encounter this error, make sure that the VPN server address specified on your VPN client device exactly matches the server address in the output of the IKEv2 helper script. For example, you cannot use a DNS name to connect if it was not specified when setting up IKEv2. To change the IKEv2 server address, read this section.

Policy match error

To fix this error, you will need to enable stronger ciphers for IKEv2 with a one-time registry change. Download and import the .reg file below, or run the following from an elevated command prompt.

  • For Windows 7, 8, 10 and 11 (download .reg file)
REG ADD HKLMSYSTEMCurrentControlSetServicesRasManParameters /v NegotiateDH2048_AES256 /t REG_DWORD /d 0x1 /f

Parameter is incorrect

If you encounter «Error 87: The parameter is incorrect» when trying to connect using IKEv2 mode, try the solutions in this issue, more specifically, step 2 «reset device manager adapters».

Cannot open websites after connecting to IKEv2

If your VPN client device cannot open websites after successfully connecting to IKEv2, try the following fixes:

  1. Some cloud providers, such as Google Cloud, set a lower MTU by default. This could cause network issues with IKEv2 VPN clients. To fix, try setting the MTU to 1500 on the VPN server:

    # Replace ens4 with the network interface name on your server
sudo ifconfig ens4 mtu 1500

    This setting does not persist after a reboot. To change the MTU size permanently, refer to relevant articles on the web.

  2. If changing the MTU size does not fix the issue, try the fix in Android MTU/MSS issues.

  3. In certain circumstances, Windows does not use the DNS servers specified by IKEv2 after connecting. This can be fixed by manually entering DNS servers such as Google Public DNS (8.8.8.8, 8.8.4.4) in network interface properties -> TCP/IPv4.

Windows 10 connecting

If using Windows 10 and the VPN is stuck on «connecting» for more than a few minutes, try these steps:

  1. Right-click on the wireless/network icon in your system tray.
  2. Select Open Network & Internet settings, then on the page that opens, click VPN on the left.
  3. Select the new VPN entry, then click Connect.

Other known issues

The built-in VPN client in Windows may not support IKEv2 fragmentation (this feature requires Windows 10 v1803 or newer). On some networks, this can cause the connection to fail or have other issues. You may instead try the IPsec/L2TP or IPsec/XAuth mode.

Manage IKEv2 clients

  • List existing clients
  • Add a client certificate
  • Export configuration for an existing client
  • Delete a client certificate
  • Revoke a client certificate

List existing clients

To list the names of existing IKEv2 clients, run the helper script with the --listclients option. Use option -h to show usage.

sudo ikev2.sh --listclients

Add a client certificate

To generate certificates for additional IKEv2 clients, run the helper script with the --addclient option. To customize client options, run the script without arguments.

sudo ikev2.sh --addclient [client name]

Alternatively, you may manually add a client certificate. Refer to step 4 in this section.

Export configuration for an existing client

By default, the IKEv2 helper script exports client configuration after running. If later you want to export an existing client, you may use:

sudo ikev2.sh --exportclient [client name]

Delete a client certificate

Important: Deleting a client certificate from the IPsec database WILL NOT prevent VPN client(s) from connecting using that certificate! For this use case, you MUST revoke the client certificate instead of deleting it.

First, read the important note above. Then click here for instructions.

Warning: The client certificate and private key will be permanently deleted. This cannot be undone!

To delete an existing client:

sudo ikev2.sh --deleteclient [client name]

Alternatively, you can manually delete a client certificate.

  1. List certificates in the IPsec database:

    certutil -L -d sql:/etc/ipsec.d

    Example output:

    Certificate Nickname                               Trust Attributes
                                                   SSL,S/MIME,JAR/XPI

IKEv2 VPN CA                                       CTu,u,u
($PUBLIC_IP)                                       u,u,u
vpnclient                                          u,u,u

  2. Delete the client certificate and private key. Replace «Nickname» below with the nickname of the client certificate you want to delete, e.g. vpnclient.

    certutil -F -d sql:/etc/ipsec.d -n "Nickname"
certutil -D -d sql:/etc/ipsec.d -n "Nickname" 2>/dev/null

  3. (Optional) Delete the previously generated client configuration files (.p12, .mobileconfig and .sswan files) for this VPN client, if any.

Revoke a client certificate

In certain circumstances, you may need to revoke a previously generated VPN client certificate.

To revoke an existing client:

sudo ikev2.sh --revokeclient [client name]

Alternatively, you can manually revoke a client certificate.

Alternatively, you can manually revoke a client certificate. This can be done using crlutil. See example steps below, commands must be run as root.

  1. Check the database, and identify the nickname of the client certificate you want to revoke.

    certutil -L -d sql:/etc/ipsec.d
    Certificate Nickname                               Trust Attributes
                                                   SSL,S/MIME,JAR/XPI

IKEv2 VPN CA                                       CTu,u,u
($PUBLIC_IP)                                       u,u,u
vpnclient-to-revoke                                u,u,u

    In this example, we will revoke the certificate with nickname vpnclient-to-revoke, issued by IKEv2 VPN CA.

  2. Find the serial number of this client certificate.

    certutil -L -d sql:/etc/ipsec.d -n "vpnclient-to-revoke"
    Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            00:cd:69:ff:74
... ...

    From the output, we see that the serial number is CD69FF74 in hexadecimal, which is 3446275956 in decimal. It will be used in the next steps.

  3. Create a new Certificate Revocation List (CRL). You only need to do this once for each CA.

    if ! crlutil -L -d sql:/etc/ipsec.d -n "IKEv2 VPN CA" 2>/dev/null; then
  crlutil -G -d sql:/etc/ipsec.d -n "IKEv2 VPN CA" -c /dev/null
fi
    CRL Info:
:
    Version: 2 (0x1)
    Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
    Issuer: "O=IKEv2 VPN,CN=IKEv2 VPN CA"
    This Update: Sat Jun 06 22:00:00 2020
    CRL Extensions:

  4. Add the client certificate you want to revoke to the CRL. Here we specify the certificate’s serial number in decimal, and the revocation time in GeneralizedTime format (YYYYMMDDhhmmssZ) in UTC.

    crlutil -M -d sql:/etc/ipsec.d -n "IKEv2 VPN CA" <<EOF
addcert 3446275956 20200606220100Z
EOF
    CRL Info:
:
    Version: 2 (0x1)
    Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption
    Issuer: "O=IKEv2 VPN,CN=IKEv2 VPN CA"
    This Update: Sat Jun 06 22:02:00 2020
    Entry 1 (0x1):
        Serial Number:
            00:cd:69:ff:74
        Revocation Date: Sat Jun 06 22:01:00 2020
    CRL Extensions:

    Note: If you want to remove a certificate from the CRL, replace addcert 3446275956 20200606220100Z above with rmcert 3446275956. For other crlutil usage, read here.

  5. Finally, let Libreswan re-read the updated CRL.

Change IKEv2 server address

In certain circumstances, you may need to change the IKEv2 server address after setup. For example, to switch to use a DNS name, or after server IP changes. Note that the server address you specify on VPN client devices must exactly match the server address in the output of the IKEv2 helper script. Otherwise, devices may be unable to connect.

To change the server address, run the helper script and follow the prompts.

wget https://get.vpnsetup.net/ikev2addr -O ikev2addr.sh
sudo bash ikev2addr.sh

Important: After running this script, you must manually update the server address (and remote ID, if applicable) on any existing IKEv2 client devices. For iOS clients, you’ll need to export and re-import client configuration using the IKEv2 helper script.

Update IKEv2 helper script

The IKEv2 helper script is updated from time to time for bug fixes and improvements (commit log). When a newer version is available, you may optionally update the IKEv2 helper script on your server. Note that these commands will overwrite any existing ikev2.sh.

wget https://get.vpnsetup.net/ikev2 -O /opt/src/ikev2.sh
chmod +x /opt/src/ikev2.sh && ln -s /opt/src/ikev2.sh /usr/bin 2>/dev/null

Set up IKEv2 using helper script

Note: By default, IKEv2 is automatically set up when running the VPN setup script. You may skip this section and continue to configure IKEv2 VPN clients.

Important: Before continuing, you should have successfully set up your own VPN server. Docker users, see here.

Use this helper script to automatically set up IKEv2 on the VPN server:

# Set up IKEv2 using default options
sudo ikev2.sh --auto
# Alternatively, you may customize IKEv2 options
sudo ikev2.sh

Note: If IKEv2 is already set up, but you want to customize IKEv2 options, first remove IKEv2, then set it up again using sudo ikev2.sh.

When finished, continue to configure IKEv2 VPN clients. Advanced users can optionally enable IKEv2-only mode.

Error: «sudo: ikev2.sh: command not found».

This is normal if you used an older version of the VPN setup script. First, download the IKEv2 helper script:

wget https://get.vpnsetup.net/ikev2 -O /opt/src/ikev2.sh
chmod +x /opt/src/ikev2.sh && ln -s /opt/src/ikev2.sh /usr/bin

Then run the script using the instructions above.

You may optionally specify a DNS name, client name and/or custom DNS servers.

When running IKEv2 setup in auto mode, advanced users can optionally specify a DNS name for the IKEv2 server address. The DNS name must be a fully qualified domain name (FQDN). Example:

sudo VPN_DNS_NAME='vpn.example.com' ikev2.sh --auto

Similarly, you may specify a name for the first IKEv2 client. The default is vpnclient if not specified.

sudo VPN_CLIENT_NAME='your_client_name' ikev2.sh --auto

By default, IKEv2 clients are set to use Google Public DNS when the VPN is active. You may specify custom DNS server(s) for IKEv2. Example:

sudo VPN_DNS_SRV1=1.1.1.1 VPN_DNS_SRV2=1.0.0.1 ikev2.sh --auto

By default, no password is required when importing IKEv2 client configuration. You can choose to protect client config files using a random password.

sudo VPN_PROTECT_CONFIG=yes ikev2.sh --auto

View usage information for the IKEv2 script.

Usage: bash ikev2.sh [options]

Options:
  --auto                        run IKEv2 setup in auto mode using default options (for initial setup only)
  --addclient [client name]     add a new client using default options
  --exportclient [client name]  export configuration for an existing client
  --listclients                 list the names of existing clients
  --revokeclient [client name]  revoke an existing client
  --deleteclient [client name]  delete an existing client
  --removeikev2                 remove IKEv2 and delete all certificates and keys from the IPsec database
  -h, --help                    show this help message and exit

To customize IKEv2 or client options, run this script without arguments.

Manually set up IKEv2

As an alternative to using the helper script, advanced users can manually set up IKEv2 on the VPN server. Before continuing, it is recommended to update Libreswan to the latest version.

The following example shows how to manually configure IKEv2 with Libreswan. Commands below must be run as root.

View example steps for manually configuring IKEv2 with Libreswan.

  1. Find the VPN server’s public IP, save it to a variable and check.

    PUBLIC_IP=$(dig @resolver1.opendns.com -t A -4 myip.opendns.com +short)
[ -z "$PUBLIC_IP" ] && PUBLIC_IP=$(wget -t 2 -T 10 -qO- http://ipv4.icanhazip.com)
printf '%sn' "$PUBLIC_IP"

    Check to make sure the output matches the server’s public IP. This variable is required in the steps below.

    Note: Alternatively, you may specify the server’s DNS name here. e.g. PUBLIC_IP=myvpn.example.com.

  2. Add a new IKEv2 connection:

    if ! grep -qs '^include /etc/ipsec.d/*.conf$' /etc/ipsec.conf; then
  echo >> /etc/ipsec.conf
  echo 'include /etc/ipsec.d/*.conf' >> /etc/ipsec.conf
fi

    Note: If you specified the server’s DNS name (instead of its IP address) in step 1 above, you must replace leftid=$PUBLIC_IP in the command below with leftid=@$PUBLIC_IP.

    cat > /etc/ipsec.d/ikev2.conf <<EOF

conn ikev2-cp
  left=%defaultroute
  leftcert=$PUBLIC_IP
  leftid=$PUBLIC_IP
  leftsendcert=always
  leftsubnet=0.0.0.0/0
  leftrsasigkey=%cert
  right=%any
  rightid=%fromcert
  rightaddresspool=192.168.43.10-192.168.43.250
  rightca=%same
  rightrsasigkey=%cert
  narrowing=yes
  dpddelay=30
  retransmit-timeout=300s
  dpdaction=clear
  auto=add
  ikev2=insist
  rekey=no
  pfs=no
  ike=aes256-sha2,aes128-sha2,aes256-sha1,aes128-sha1
  phase2alg=aes_gcm-null,aes128-sha1,aes256-sha1,aes128-sha2,aes256-sha2
  ikelifetime=24h
  salifetime=24h
EOF

    We need to add a few more lines to that file. First check your Libreswan version, then run one of the following commands:

    For Libreswan 3.23 and newer:

    cat >> /etc/ipsec.d/ikev2.conf <<EOF
  modecfgdns="8.8.8.8 8.8.4.4"
  encapsulation=yes
  mobike=no
EOF

    Note: The MOBIKE IKEv2 extension allows VPN clients to change network attachment points, e.g. switch between mobile data and Wi-Fi and keep the IPsec tunnel up on the new IP. If your server (or Docker host) is NOT running Ubuntu Linux, and you wish to enable MOBIKE support, replace mobike=no with mobike=yes in the command above. DO NOT enable this option on Ubuntu systems or Raspberry Pis.

    For Libreswan 3.19-3.22:

    cat >> /etc/ipsec.d/ikev2.conf <<EOF
  modecfgdns1=8.8.8.8
  modecfgdns2=8.8.4.4
  encapsulation=yes
EOF

    For Libreswan 3.18 and older:

    cat >> /etc/ipsec.d/ikev2.conf <<EOF
  modecfgdns1=8.8.8.8
  modecfgdns2=8.8.4.4
  forceencaps=yes
EOF

  3. Generate Certificate Authority (CA) and VPN server certificates.

    Note: Specify the certificate validity period (in months) with «-v». e.g. «-v 120».

    Generate CA certificate:

    certutil -z <(head -c 1024 /dev/urandom) 
  -S -x -n "IKEv2 VPN CA" 
  -s "O=IKEv2 VPN,CN=IKEv2 VPN CA" 
  -k rsa -g 3072 -v 120 
  -d sql:/etc/ipsec.d -t "CT,," -2
    Generating key.  This may take a few moments...

Is this a CA certificate [y/N]?
y
Enter the path length constraint, enter to skip [<0 for unlimited path]: >
Is this a critical extension [y/N]?
N

    Generate VPN server certificate:

    Note: If you specified the server’s DNS name (instead of its IP address) in step 1 above, you must replace --extSAN "ip:$PUBLIC_IP,dns:$PUBLIC_IP" in the command below with --extSAN "dns:$PUBLIC_IP".

    certutil -z <(head -c 1024 /dev/urandom) 
  -S -c "IKEv2 VPN CA" -n "$PUBLIC_IP" 
  -s "O=IKEv2 VPN,CN=$PUBLIC_IP" 
  -k rsa -g 3072 -v 120 
  -d sql:/etc/ipsec.d -t ",," 
  --keyUsage digitalSignature,keyEncipherment 
  --extKeyUsage serverAuth 
  --extSAN "ip:$PUBLIC_IP,dns:$PUBLIC_IP"
    Generating key.  This may take a few moments...

  4. Generate client certificate(s), then export the .p12 file that contains the client certificate, private key, and CA certificate.

    Note: You may repeat this step to generate certificates for additional VPN clients, but make sure to replace every vpnclient with vpnclient2, etc. To connect multiple IKEv2 clients from behind the same NAT (e.g. home router) at the same time, you will need to generate a unique certificate for each client.

    Generate client certificate:

    certutil -z <(head -c 1024 /dev/urandom) 
  -S -c "IKEv2 VPN CA" -n "vpnclient" 
  -s "O=IKEv2 VPN,CN=vpnclient" 
  -k rsa -g 3072 -v 120 
  -d sql:/etc/ipsec.d -t ",," 
  --keyUsage digitalSignature,keyEncipherment 
  --extKeyUsage serverAuth,clientAuth -8 "vpnclient"
    Generating key.  This may take a few moments...

    Export .p12 file:

    pk12util -d sql:/etc/ipsec.d -n "vpnclient" -o vpnclient.p12
    Enter password for PKCS12 file:
Re-enter password:
pk12util: PKCS12 EXPORT SUCCESSFUL

    Enter a secure password to protect the exported .p12 file (when importing into an iOS or macOS device, this password cannot be empty).

  5. (For iOS clients) Export the CA certificate as ca.cer:

    certutil -L -d sql:/etc/ipsec.d -n "IKEv2 VPN CA" -a -o ca.cer

  6. The database should now contain:

    certutil -L -d sql:/etc/ipsec.d
    Certificate Nickname                               Trust Attributes
                                                   SSL,S/MIME,JAR/XPI

IKEv2 VPN CA                                       CTu,u,u
($PUBLIC_IP)                                       u,u,u
vpnclient                                          u,u,u

    Note: To display a certificate, use certutil -L -d sql:/etc/ipsec.d -n "Nickname". To revoke a client certificate, follow these steps. For other certutil usage, read here.

  7. (Important) Restart the IPsec service:

Before continuing, you must restart the IPsec service. The IKEv2 setup on the VPN server is now complete. Follow instructions to configure VPN clients.

Remove IKEv2

If you want to remove IKEv2 from the VPN server, but keep the IPsec/L2TP and IPsec/XAuth («Cisco IPsec») modes (if installed), run the helper script. Warning: All IKEv2 configuration including certificates and keys will be permanently deleted. This cannot be undone!

sudo ikev2.sh --removeikev2

After removing IKEv2, if you want to set it up again, refer to this section.

Alternatively, you can manually remove IKEv2.

To manually remove IKEv2 from the VPN server, but keep the IPsec/L2TP and IPsec/XAuth («Cisco IPsec») modes, follow these steps. Commands must be run as root.

Warning: All IKEv2 configuration including certificates and keys will be permanently deleted. This cannot be undone!

  1. Rename (or delete) the IKEv2 config file:

    mv /etc/ipsec.d/ikev2.conf /etc/ipsec.d/ikev2.conf.bak

    Note: If you used an older version (before 2020-05-31) of the IKEv2 helper script or instructions, file /etc/ipsec.d/ikev2.conf may not exist. In this case, please instead remove the conn ikev2-cp section from file /etc/ipsec.conf.

  2. (Important) Restart the IPsec service:

  3. List certificates in the IPsec database:

    certutil -L -d sql:/etc/ipsec.d

    Example output:

    Certificate Nickname                               Trust Attributes
                                                   SSL,S/MIME,JAR/XPI

IKEv2 VPN CA                                       CTu,u,u
($PUBLIC_IP)                                       u,u,u
vpnclient                                          u,u,u

  4. Delete the Certificate Revocation List (CRL), if any:

    crlutil -D -d sql:/etc/ipsec.d -n "IKEv2 VPN CA" 2>/dev/null

  5. Delete certificates and keys. Replace «Nickname» below with each certificate’s nickname. Repeat these commands for each certificate. When finished, list certificates in the IPsec database again, and confirm that the list is empty.

    certutil -F -d sql:/etc/ipsec.d -n "Nickname"
certutil -D -d sql:/etc/ipsec.d -n "Nickname" 2>/dev/null

References

  • https://libreswan.org/wiki/VPN_server_for_remote_clients_using_IKEv2
  • https://libreswan.org/wiki/HOWTO:_Using_NSS_with_libreswan
  • https://libreswan.org/man/ipsec.conf.5.html
  • https://docs.strongswan.org/docs/5.9/interop/windowsClients.html
  • https://docs.strongswan.org/docs/5.9/os/androidVpnClient.html
  • https://firefox-source-docs.mozilla.org/security/nss/legacy/tools/nss_tools_certutil/index.html
  • https://firefox-source-docs.mozilla.org/security/nss/legacy/tools/nss_tools_crlutil/index.html

License

Copyright (C) 2016-2023 Lin Song View my profile on LinkedIn

Creative Commons License
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Unported License
Attribution required: please include my name in any derivative and let me know how you have improved it!

Источник

Как настроить IPsec VPN-соединение в Windows 10 (поддержка прошивки доступна для 3.0.0.4.386_4xxxx)

IKEv2 — это функция, доступная только в версиях прошивки 3004.386.4xxxx и выше. Найдите маршрутизатор, поддерживающий такие версии прошивки. Вы можете скачать последнюю версию прошивки в ASUS Центре загрузок

[Примечание] Поддержка прошивки доступна для 3.0.0.4.386_4xxxx

RT-AC3100
RT-AC5300
RT-AC86U
RT-AC88U
RT-AX88U
RT-AX92U
GT-AC2900
GT-AC5300
GT-AX11000
ZenWiFi XT8

Настройте роутер ASUS

  1. Включите VPN Сервер
  2. Настройте логин и пароль для VPN клиента
  3. Экспорт сертификации

Настройте ПК с Windows 10

  1. Добавьте параметр в реестр
  2. Установите сертификат в Windows
  3. Создайте VPN соединение

Настройте роутер ASUS

Шаг 1. Включите VPN сервер

       1. Откройте веб-браузер и введите http://router.asus.com. Войдите в веб-интерфейс вашего маршрутизатора.

           

             Для получения дополнительных сведений см. [Беспроводной маршрутизатор] Как войти в графический интерфейс маршрутизатора (ASUSWRT).

       2. Нажмите [VPN] слева в дополнительных настройках > [VPN Сервер].

       3. Включите IPsec VPN Сервер

             Примечание: убедитесь, что WAN IP это публичный IP адрес и рекомендуется также настроить DDNS.

       4. Введите учетные данные в поле Pre-shared Key.

          

Шаг 2. Настройте логин и пароль для VPN клиента

  1. Введите имя пользователя и пароль для доступа к серверу VPN.
  2. Выберите “V2” для Поддерживаемая версия IKE.
  3. Щелкните значок [+], затем щелкните Применить для сохранения.

        

Шаг 3. Экспортируйте сертификат

       1. Кнопка экспорта будет доступна после нажатия кнопки Применить.

       2. Выберите [для Windows].

        

       3. Нажмите кнопку Экспорт, после чего вы загрузите файл сертификации с именем cert ikev2_cert_windows.der.

Настройте ПК с Windows 10

Шаг 4. Добавьте параметр в реестр

       1. Нажмите клавишу Windows +  одновременно.

       2. Укажите: [regedit] и нажмите OK.

           Примечание: нажмите да, если вас спросят, хотите ли вы разрешить приложению вносить изменения в ваш компьютер.

          

       3. На левой панели найдите и щелкните папку: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesRasManParameters

          

       4. Щелкните меню Правка и наведите курсор на Создать. Щелкните Значение DWORD.

          

             На правой панели появится новый реестр с именем DisableIKENameEkuCheck.

         

            и установите значение 1.

         

       5. Перезагрузите компьютер.

Шаг 5. Установите сертификат в Windows

       1. Дважды кликните на сертификат.

         

       2. Нажмите на “Установить сертификат”

          

       3. Выберите “Данное устройство” и нажмите Далее.

         

       4. Выберите “Поместить все сертификаты в следующее хранилище” и нажмите “Обзор”.

         

       5. Выберите “Доверенные корневые центры сертификации” нажмите ОК.

         

       6. Затем нажмите “Далее”

         

       7. Нажмите Готово.

         

         

       8. Дважды щелкните файл сертификации, чтобы проверить. Вы можете проверить, как показано ниже, если сертификация успешно установлена.

         

Шаг 6. установите подключение VPN

       1. Откройте Параметры сети и Интернета

         

       2. Перейдите на страницу настроек VPN. Нажмите кнопку [+], чтобы добавить VPN-соединение.

        

       3. В поле Имя или адрес сервера на экране конфигурации VPN введите имя домена или IP-адрес, отображаемый в поле IP-адрес сервера на странице Сервер VPN. Нажмите Сохранить, чтобы завершить настройку.

        

       4. Нажмите кнопку Подключиться над созданным профилем VPN.

        

       5. Введите имя пользователя и пароль, затем нажмите OK, чтобы подключиться к VPN-серверу. Готово!

        

Примечание: 

1. Если вы подключаетесь к маршрутизатору из Интернета через IPSec VPN и не можете получить доступ к серверу внутри локальной сети, отключите или проверьте настройки брандмауэра сервера локальной сети.

2. Если вы одновременно настроили соединение IPSec VPN с мобильным устройством или ПК, подключенным к маршрутизатору, после его завершения вы можете подключиться к другим устройствам в локальной сети через IPSec VPN без доступа в Интернет. В этом случае отключите Wi-Fi на своем мобильном устройстве или ПК, а затем подключитесь к Интернету через мобильную сеть 3G / 4G. Теперь вы в другой сети. Попробуйте снова подключиться к VPN.

3. Может быть максимум 8 клиентов с соединениями IPSec.

4. Одна учетная запись / пароль IPsec может позволить подключаться только одному клиенту (максимум до 8 правил учетной записи / пароля).

5. IPsec требует учетной записи / пароля для подключения, а не поддержки бесплатного входа.

Как скачать (Утилиты / ПО)?

Вы можете загрузить последние версии драйверов, программного обеспечения, микропрограмм и руководств пользователя из ASUS Центраз агрузок.

Узнать больше о Центре загрузок ASUS можно по ссылке.

Источник

Для L2TP/IPSec с общим ключом

Важно: L2TP IPsec клиенты, находящиеся за одним NAT’ом, могут испытывать проблемы подключения если их более одного. Решить проблему может помочь

инструкция

. Рекомендуем вместо L2TP IPsec использовать IKEv2 IPSec.

Имя подключения — название создаваемого подключения;

  • Имя или адрес сервера — адрес VPN-сервера;

  • Тип VPN — Протокол L2TP/IPSec с общим ключом;

  • Общий ключ — значение строки PSK в разделе Пользователи -> VPN-подключение -> Основное -> Подключение по L2TP/IPSec;

  • Тип данных для входа — Имя пользователя и пароль;

  • Имя пользователя — имя пользователя, которому разрешено подключение по VPN;

  • Пароль — пароль пользователя.

​

​

При настройке подключения по VPN из сети Интернет, в свойствах VPN-подключения нужно указать следующие параметры:

  • Перейдите в Настройки параметров адаптера;

  • Нажмите на созданное подключение правой кнопкой мыши и выберите Свойства;

  • Перейдите во вкладку Безопасность и установите:

    • Шифрование данных — обязательное (отключиться, если нет шифрования)

    • Протокол расширенной проверки подлинности (EAP) — Microsoft защищенный пароль (EAP MSCHAPV2)

Если вы создаете VPN-подключение к UTM через проброс портов, рекомендуем выполнить следующие действия:

  1. 1.

    Откройте Редактор реестра;

  2. 2.

    Перейдите в HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesPolicyAgent и создайте DWORD-параметр с именем AssumeUDPEncapsulationContextOnSendRule и значением 2;

  1. 1.

    Неправильно указан логин или пароль пользователя. Часто при повторном соединении предлагается указать домен. Старайтесь создавать цифро-буквенные пароли, желательно на латинице для ваших учетных записей. Если есть сомнения в этом пункте, то временно установите логин и пароль пользователю «user» и «123456».

  2. 2.

    Для того, чтобы пакеты пошли через VPN-туннель, надо убедиться, что в настройках этого подключения стоит чекбокс Использовать основной шлюз в удалённой сети в разделе Настройка параметров адаптера -> Правой кнопкой мыши по подключению -> Свойства -> Сеть -> Свойства опции «Протокол Интернета версии 4 (TCP/IPv4)» ->Дополнительно. Если же маршрутизировать все пакеты в этот интерфейс не обязательно, то маршрут надо писать вручную.

  3. 3.

    Подключение происходит через DNAT, т.е. внешний интерфейс Ideco UTM не имеет «белого» IP-адреса, а необходимые для работы порты (500 и 4500) «проброшены» на внешний интерфейс устройства, расположенного перед Ideco UTM и имеющего «белый» IP-адрес. В данном случае VPN-подключение либо вообще не будет устанавливаться, либо будут периодические обрывы. Решение — исключить устройство перед Ideco UTM и указать на внешнем интерфейсе Ideco UTM «белый» IP-адрес, к которому в итоге и будут осуществляться L2TP/IPsec-подключения. Либо используйте протокол SSTP, потому что его проще опубликовать с помощью проброса портов.

  4. 4.

    Если в OC Windows 10 повторно подключиться по L2TP, но при этом использовать невалидный ключ PSK (введя его в дополнительных параметрах (скриншот ниже)), подключение все равно будет установлено успешно. Это связано с особенностями работы ОС.

Убедитесь, что локальная сеть (или адрес на сетевой карте) на удалённой машине не пересекается с локальной сетью организации. Если пересекается, то доступа к сети организации не будет (трафик по таблице маршрутизации пойдёт в физический интерфейс, а не в VPN). Адресацию необходимо менять.

Источник

Блог компании RUVDS.com, Сетевые технологии, Лайфхаки для гиков

Рекомендация: подборка платных и бесплатных курсов PR-менеджеров — https://katalog-kursov.ru/

Сейчас все вокруг настраивают VPN для удаленных сотрудников. Мне больно смотреть, как люди устанавливают монструозные глючные программы, настраивают какие-то сертификаты, устанавливают драйвера TUN/TAP и делают множество сложных операций, в то время как лучшее решение уже встроено в операционную систему.

IKEv2 — это современный протокол VPN, разработанный Microsoft и Cisco. Он используется по умолчанию для новых VPN-подключений в Windows, macOS, iOS. Он быстрее и безопаснее большинства VPN-протоколов и может легко настраиваться на стороне клиента в два клика без использования сторонних программ.

Я считаю, что IPsec IKEv2 отлично подходит не только для соединения серверов, но и для обычных VPN-подключений конечных пользователей. В этом посте я постараюсь убедить вас использовать IPsec IKEv2 для обычных домашних пользователей вместо OpenVPN.

IKEv2 быстрее

При прочих равных условиях, IKEv2 будет всегда быстрее OpenVPN. Это особенно заметно на маломощных системах с медленной памятью, например на роутерах или одноплатных компьютерах.

Дело в том, что IPsec работает в контексте ядра операционной системы, а OpenVPN в контексте пользователя (userspace), и на обработку каждого пакета происходит переключение контекста между процессами ядра и процессами пользователя. Это влияет как на пропускную способность, так и на задержки.

Сравнение задержек для разных протоколов VPN.

Скриншот выше показывает разницу в задержке в два раза между IPsec и OpenVPN. Разумеется, разницу в 1мс невозможно заметить на глаз, но при нагрузке на систему эти значения могут значительно изменяться. Кроме того, реальные показатели сильно зависят от характеристик конкретной системы, поэтому я не буду приводить абсолютные цифры для сравнения двух протоколов. Задержки очень важны при использовании голосовой и видеосвязи через VPN.

По моим субъективным ощущениям IKEv2 на Windows 10 работает заметно отзывчивее чем OpenVPN. Ведь реальное использование десктопного компьютера сильно отличается от синтетических тестов VPN-протоколов. Нагрузка на процессор и память непостоянная, пользователь может запускать ресурсоемкие программы, все это будет влиять на показатели.

IKEv2 проще в настройке

Все современные операционные системы (кроме Android) поддерживают IPsec IKEv2 прямо из коробки. Не нужно устанавливать никакие программы, драйвера виртуальных адаптеров TUN/TAP и прочее. Всё управление VPN происходит из системного меню.

При этом настройку на клиенте можно упростить до трех строчек:

  • Домен — для IPsec домен обязателен, так как для него выпускается SSL-сертификат
  • логин
  • пароль

Не нужно больше передавать клиенту файлы с сертификатами и ключами, заставлять его импортировать корневые сертификаты в системное хранилище. Достаточно логина и пароля, при этом соединение будет так же надежно защищено, как и в OpenVPN при использовании сертификатов, ведь для установки соединения используется такой же x.509 сертификат, как и для веб-сайтов с HTTPS.

Настройка на Windows 10

Мастер настройки VPN вызывается из меню подключения к WiFi. С настройкой одного окна справится пользователь любой квалификации. Созданное подключение активируется из меню со списком WiFi-сетей.

Интерфейс настройки нового IKEv2 подключения в Windows 10

Настройка macOS

В macOS поддерживается IKEv2 начиная с версии 10.11 (El Capitan). Создание подключения происходит через меню настроек сети.

image

Добавляем новое подключение. В качестве имени подключения задаем любое произвольное имя.

image

Для проверки подлинности сертификата, нужно указать доменное имя. При этом в поле «Server Address» можно указать IP-адрес сервера, а домен только в «Remote ID», тогда для подключения не будет выполняться DNS-резолв, и оно будет происходить чуть быстрее.

image

Логин и пароль пользователя указываем из файла /etc/ipsec.secrets

image

Настройка iOS

Настройку iOS можно выполнить вручную через мастер, но намного удобнее использовать профиль автоконфигурации mobileconfig.

Ручная настройка по смыслу аналогична десктопной macOS:

Настройки -> VPN -> Добавить конфигурацию VPN

IKEv2 это безопасно

На предыдущем шаге мы выяснили, что для настройки подключения достаточно логина и пароля. Но как клиенту проверить, что подключение не прослушивается, не подменяются данные и сервер действительно тот, за кого себя выдает? Для этого используются обычные SSL-сертификаты, которые мы привыкли использовать для веб-сайтов и HTTPS.

Клиент устанавливает защищенный SSL-тоннель с сервером, и уже внутри него передается логин-пароль. По умолчанию в Windows и macOS для передачи пароля используется алгоритм mschapv2. Таким образом с помощью SSL-сертификата клиент проверяет подлинность сервера, а по логину-паролю сервер проверяет подлинность клиента.

Сервер IKEv2 может использовать один и тот же сертификат вместе с веб-сервером, например от популярного Let’s Encrypt. Это сильно упрощает управлением сертификатами.

Такая же модель используется в OpenVPN, и при желании в нем можно использовать сертификат от Lets Encrypt, однако администратору в любом случае потребуется передать пользователю файл для настройки VPN.

Настраиваем IKEv2 сервер

Развернуть свой IKEv2 сервер можно за пару минут с помощью скриптов автоматической установки или используя готовые контейнеры. Использовать docker не рекомендуется, так как его сетевая подсистема снижает производительность IPsec на дешевых тарифах VPS. Вы также можете настроить IKEv2-сервер вручную, на Хабре есть статьи с примерами настройки сервера Strongswan.

Мы будем использовать один из наиболее удачных вариантов скриптов автонастройки github.com/jawj/IKEv2-setup
Этот скрипт хорош тем, что использует сертификаты от Lets Encrypt и автоматически генерирует валидный сертификат.

Шаг 1: Выбор сервера

Для запуска VPN сервера нам потребуется VDS. Подойдет самая простая конфигурация с одним ядром процессора. Скрипт из нашего примера лучше всего протестирован на Ubuntu 18.04, поэтому при создании сервера выбираем этот образ ОС.

Ждем окончания установки сервера и копируем реквизиты для подключения. Пароль root придет на почту, либо его можно задать вручную через веб-интервейс. Далее все команды мы вводим

Шаг 2: Установка Strongswan

Подключаемся SSH-клиентом и запускаем скрипт установки:

# запуск автоматической установки сервера IKEv2 
wget https://raw.githubusercontent.com/jawj/IKEv2-setup/master/setup.sh
chmod u+x setup.sh
./setup.sh
....
# Введите имя домена направленного на IP-адрес сервера
# используйте сервис sslip.io если у вас нет домена
Hostname for VPN: 123-45-67-89.sslip.io
# Имя пользователя VPN
VPN username: coolguy
# пароль 
VPN password (no quotes, please):
....
# скрипт запрос создать нового SSH-пользователя, этот шаг нельзя пропускать.

Шаг 3: Настройка клиента

Введенные реквизиты пользователя VPN теперь нужно использовать для настройки на клиенте. Важно использовать именно то доменное имя, которое вы вводили в Hostname for VPN.

Шаг 4: Добавление новых пользователей

Чтобы добавить нового пользователя в уже созданный сервер, отредактируйте файл /etc/ipsec.sectes.

# nano /etc/ipsec.secrets
123-45-67-89.sslip.io : RSA "privkey.pem"
coolguy : EAP "C00lPassword"
badguy : EAP "bAdP$$word"

После добавления пользователя выполните команду ipsec secrets чтобы Strongswan перечитал конфиг.

Заключение

Мы рассмотрели удобство IKEv2 со стороны пользователя. Администрирование такого сервера не сложнее, а иногда даже проще чем OpenVPN. Если вы только планируете организовать удаленный доступ для своих сотрудников, обязательно посмотрите в сторону IKEv2. Не заставляйте своих пользователей устанавливать лишние программы, если все необходимое уже есть на их компьютере. Это удобнее, безопаснее и намного прогрессивнее.

Источник

DoVD.ru
з а щ и щ ё н н а я
совместная работа


176.194.84.241

22:45 4.02.2023

Ручная настройка IPsec VPN в Windows

Для начала убедитесь, что у Вас есть файл с сертификатом (vpn-key.p12).

Если Вы получали установочную программу, то просто распакуйте её как архив (это можно сделать с помощью WinRAR или 7-Zip).

Либо, если у Вас есть доступ к Вашей странице, то Вы можете скачать сертификат по этой ссылке.

Все руководства:

  • Подключение к VPN
  • Настройка почты и книги в Thunderbird
  • Подключение к SFTP через WinSCP
  • Подключение к SFTP через SFTP Net Drive
  • Установка клиентского сертификата

Импорт сертификата

Откройте инструмент управления сертификатами. Для этого:

  1. Нажмите WinKey+X, выберите Командная строка (администратор), введите mmc и нажмите Enter.
  2. В открывшейся консоли нажмите Ctrl+M.
  3. В левом списке диалога выберите Сертификаты и нажмите Добавить.
  4. В новом диалоге выберите учётной записи компьютера, затем нажмите Далее и Готово.
  5. В результате диалог приобретёт вид, как на изображении справа. Нажмите OK.

WinKey — клавиша со значком Windows.

Диалог добавления новой оснастки (mmc.exe)

В основном окне теперь появится раздел Сертификаты (локальный компьютер).

Раскройте его, а затем нажмите правой кнопкой мыши на папке Личное, выберите меню Все задачи, а в нём — команду Импорт.

Команда импорта нового сертификата

В диалоге импорта не требуется менять значение полей, за исключением указания пути к файлу сертификата..

Внимание: в диалоге выбора файла нужно изменить тип (расширение) с Сертификат X.509 на Файлы обмена личной информации, иначе файл ключа (vpn-key.p12) не будет в нём виден.

На последнем шаге импорта Вы должны увидеть страницу с параметрами, как на изображении справа.

Диалог открытия файла при импорте нового сертификата Последний шаг &mdash; подтверждение импорта

Теперь в разделе Личное (подраздел Сертификаты) будет 2 записи: одна для Центра сертификации (ЦС), другая для клиентского сертификата.

Состояние консоли сертификатов после импорта

Перетащите запись ЦС в раздел Доверенные корневые центры сертификации.

В результате в Личное останется только клиентский сертификат.

Убедитесь, что всё сделано верно, сделав двойной клик на записи клиентского сертификата — в окне с информации не должно быть предупреждения о том, что сертификат не удалось проверить, проследив его до доверенного центра сертификации.

Теперь консоль и все другие окна можно закрыть.

Правильное окно информации о клиентском сертификате Сообщение указывает на то, что сертификат ЦС не был перемещён в доверенные

Создание VPN-соединения

Откройте Панель управления, и в ней — раздел Центр управления сетями и общим доступом.

Создайте новое подключение:

  1. Нажмите на ссылку Создание и настройка общего нового подключения или сети.
  2. Выберите Подключение к рабочему месту и нажмите Далее.
  3. Нажмите Использовать моё подключение к Интернету (VPN).
  4. В поле Адрес в Интернете введите v.dovd.ru, а в поле Имя объекта назначения — любое имя, которые Вы хотите видеть в различных диалогах (например, dovd.ru).
  5. Закройте мастер кнопкой Создать.

Откройте параметры подключения (всё из того же Центра управления сетями):

  1. Нажмите ссылку Изменение параметров адаптера в левой части.
  2. Откройте свойства только что созданного подключения.
  3. Перейдите на вкладку Безопасность и измените следующие свойства:

    Тип VPN
    IKEv2
    Шифрование данных
    самое стойкое
    Проверка подлинности
    Использовать сертификаты компьютеров
  4. Перейдите на вкладку Сеть, сделайте двойной щелчок по IP версии 4 (TCP/IPv4), в открывшемся диалоге нажмите Дополнительно и снимите флажок с Использовать основной шлюз в удаленной сети. Нажмите ОК, и еще раз ОК.
  5. Закройте свойства нажатием на кнопку OK.

На этом настройка завершена.

Свойства нового VPN-соединения Свойства IPv4 нового VPN-соединения

Подключение к VPN

Этот шаг нужно выполнять при каждом подключении к Интернету (то есть при выключении компьютера, смене пользователя и в других случаях).

Чтобы это происходило автоматически, можно создать задание в системном Планировщике (событие: Microsoft-Windows-NetworkProfile/Выполняется, код события: 10000).

Подключиться к VPN можно двумя способами:

  1. Нажав на значок сети рядом с часами в панели задач и нажав на имя подключения.
  2. Открыв параметры Windows (меню «Пуск», кнопка-иконка с шестерёнкой, раздел Сеть и Интернет, подраздел VPN).
Внешний вид при активном VPN-подключении

Доступ к сетевому диску

При активном VPN-подключении открывается доступ к общим файлам (сетевому диску).

Для проверки работоспособности откройте Проводник и перейдите по адресу \s.dovd.ru — должен появиться диалог с запросом имени пользователя и пароля для входа.

Удобнее всего работать с общими документами посредством сетевого диска. Для этого откройте в Проводнике Мой компьютер и выберите команду Подключить сетевой диск из меню Компьютер. Укажите следующие параметры:

Диск
Буква диска может быть любой. По этой букве будут доступны общие файлы.
Папка
Сетевой путь вида \s.dovd.ruпапка (папка обязательна). Этот путь можно скопировать из адресной строки Проводника.
Диалог подключения сетевого диска

Настройка брандмауэра (firewall)

По умолчанию, исходящие соединения в Windows не блокируются.

Если у Вас это не так, то создайте исходящее правило, разрешающее подключения по любому протоколу любых программ на эти удалённые IP-адреса: 

77.246.157.70
172.16.0.0/24
Настройки исходящего подключения в брандмауэре
Источник

Понравилась статья? Поделить с друзьями:
  • Vpn hub скачать на windows торрент
  • Vpn hub скачать на windows бесплатно
  • Vpn hide me скачать для windows
  • Vpn gate client download for windows freeware
  • Vpn free pro скачать бесплатно на пк для windows