Setting up an IPSEC Site-to-Site VPN with StrongSwan on Debian 12
In this article, we will cover the steps required to set up an IPSEC Site-to-Site VPN using StrongSwan on Debian 12, specifically for a network with three nodes: EdgeRouter #1 (10.41.1.0/24), EdgeRouter #2 (10.48.2.0/24), and a VM running Debian 12 with Docker and FirewallD.
Prerequisites
- Three nodes: EdgeRouter #1, EdgeRouter #2, and a VM running Debian 12 with Docker and FirewallD
- A basic understanding of networking and VPN concepts
- Root access to all nodes
Installing StrongSwan on Debian 12
To install StrongSwan on Debian 12, run the following command:
# apt-get update && apt-get install strongswan
Configuring EdgeRouter #1
On EdgeRouter #1, create a new phase 1 and phase 2 configuration as follows:
ipsec {
ike {
remote {
subnet
authby sha1;
encryption aes256;
group modp2048;
}
local {
subnet
}
}
esp {
{
encryption aes256;
hash sha1;
group modp2048;
}
}
} Configuring EdgeRouter #2
On EdgeRouter #2, create a new phase 1 and phase 2 configuration as follows:
ipsec {
ike {
remote {
subnet
authby sha1;
encryption aes256;
group modp2048;
}
local {
subnet
}
}
esp {
{
encryption aes256;
hash sha1;
group modp2048;
}
}
} Configuring FirewallD on Debian 12 VM
On the Debian 12 VM, configure FirewallD to allow traffic from the VPN as follows:
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p udp --dport 500 -j ACCEPT
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p udp --dport 4500 -j ACCEPT
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p esp -j ACCEPT
firewall-cmd --reload
Testing the VPN
To test the VPN, try pinging a host on the other side of the VPN:
ping
- Installed StrongSwan on Debian 12
- Configured EdgeRouter #1 and EdgeRouter #2 for IPSEC Site-to-Site VPN
- Configured FirewallD on Debian 12 VM to allow traffic from the VPN
- Tested the VPN by pinging a host on the other side
References
- StrongSwan documentation: https://wiki.strongswan.org/projects/strongswan/wiki/ConnSection
- FirewallD documentation: https://firewalld.org/documentation/
This article is part of a larger series on IPSEC Site-to-Site VPNs with StrongSwan. Other articles in the series cover topics such as configuring different types of VPNs, troubleshooting common issues, and best practices for security and performance.