IPsec#

Protect → IPsec manages the router's site-to-site IPsec: a peer for each router or device at the other end, the networks the tunnel joins, how the two ends prove who they are, and the IKE and ESP groups that say how they encrypt. Beside the configuration, the page shows strongSwan's live security associations, re-read every ten seconds. IPsec is the choice when the far end is not yours — a cloud gateway, a customer's firewall, an appliance that speaks nothing else.

What the page shows#

Four tiles: the number of Peers; Connected, the security associations that are up out of those strongSwan holds; and the IKE groups and ESP groups by name.

The peer table#

Security associations#

strongSwan's own table, under names a person would use: Tunnel, Status, Up for, Traffic in / out, Packets in / out, Remote address, Remote ID and Proposal. A peer in the configuration with no association is a tunnel that has not come up. When strongSwan is not running at all, the page says so rather than drawing an empty table as if it meant "no tunnels".

Adding a peer#

Add peer opens one panel with five sections. A peer is added whole: its groups, its key and its tunnels together.

Peer#

Networks#

Local networks — the networks behind this router — and Remote networks, the ones behind the other end. Each pair becomes one tunnel: two local networks and two remote ones make four. The far end lists the same networks the other way round.

Authentication#

Pre-shared key: both ends use the same key. Certificates: a certificate authority and a certificate from the router's own store, which the Certificates page manages.

Local ID and Remote ID are what each end calls itself. Empty uses the local and remote addresses, which is what most devices expect.

Key exchange (IKE)#

IKE group is a new group for this peer — named IKE-<peer name> — or an existing one, which is how several peers share one policy. A shared group says which other peers use it, because a change to it changes them too.

Traffic encryption (ESP)#

ESP group, new (ESP-<peer name>) or existing, the same way.

The first time a peer uses an interface's address, the router is told to listen for IPsec on that interface.

Changing a peer#

Selecting a peer opens the same panel, filled in, with the peer's security association at the top. Every field can be changed; Save changes adds only what differs.

• Name is fixed once the peer exists.
• Pre-shared key is never shown: empty keeps the current key, and a new one replaces it.
• Networks: when either side changes, the peer's tunnels are rebuilt from the new pairs; otherwise they are left alone.
• A group that leaves a value unset shows the router's default for it, so saving the panel unchanged changes nothing.
• Turned off keeps the peer configured and stops it connecting.

A peer that uses RSA keys keeps them: the panel does not build RSA authentication, and leaves it as it is.

Delete peer asks again — Delete office? — and removes the peer, its pre-shared key when no other peer uses it, and each of its groups that nothing else uses.

What else a tunnel needs#

• The input firewall. The other end reaches this router on UDP 500, UDP 4500 when either end is behind NAT, and ESP. The rules are on the Firewall page.
• The forward firewall. Traffic between the two sets of networks passes the forward chain.
• No source NAT on the tunnel's traffic. A masquerade rule that matches it changes the source address, and the traffic then misses the tunnel it was meant for — the tunnel looks healthy and carries nothing.

Advanced mode#

With Advanced mode on (Account → Preferences) the page adds a CLI view — the IPsec configuration as commands — strongSwan's connection list under the security associations, and a preview of the commands each change adds. A pre-shared key shows as [redacted] below the admin role.

See also#

• An IPsec tunnel to a third-party device — the same panel, start to finish.
• WireGuard — simpler, when both ends are yours.
• Security, VPN and accounts — the rest of this section.