In this article, we will discuss how to configure a StrongSwan VPN server with two subnets, one private and one public. We will also cover the concept of having a single host (acting as a proxy) with two network interfaces connected to these subnets.
Prerequisites
Before starting the setup process, ensure that you have the following prerequisites in place:
- A Linux-based server (Ubuntu 20.04 LTS or any other suitable distribution)
- Two network interfaces on the server, one connected to the public network and the other connected to the private network
- Root or sudo access to the server
Setting Up the Network Interfaces
First, you need to configure the network interfaces on your server. Assuming that your public network interface is named ens1 and your private network interface is named ens2, you can edit the network interfaces configuration file using your preferred text editor, for example, nano:
sudo nano /etc/netplan/01-netcfg.yaml
Now, add the following configuration to the file:
network:
ethernets:
ens1:
dhcp4: yes
ens2:
addresses: [10.0.0.1/24] # Replace this with the IP address and subnet mask of your private network
routes:
- to: 0.0.0.0/0
via: 10.0.0.2 # Replace this with the gateway IP address of your private network
nameservers:
addresses: [8.8.8.8,8.8.4.4]
version: 2
Save and exit the file. Then, apply the new configuration:
sudo netplan apply
Installing StrongSwan
Next, install StrongSwan using the package manager of your Linux distribution:
sudo apt-get update
sudo apt-get install strongswan
Configuring the StrongSwan VPN Server
Create a new StrongSwan connection configuration file under /etc/ipsec.d/vpn.conf:
sudo nano /etc/ipsec.d/vpn.conf
Add the following content to the file:
config setup
strictcrlpolicy=no
uniqueids=no
conn %default
keyexchange=ikev2
ike=aes256gcm16-prfsha384-ecp521!
esp=aes256gcm16-ecp521!
rekey=no
fragmentation=yes
dpdaction=clear
dpddelay=300s
dpdtimeout=1h
conn ikev2-vpn
left=<Public IP Address of your server> # Replace this with the public IP address of your server
leftid=@server
leftcert=server-cert.pem
leftsendcert=always
leftsubnet=0.0.0.0/0
right=%any
rightsourceip=192.168.0.0/24,10.0.0.0/24 # Replace this with the private IP ranges of your VPN clients
rightauth=eap-radius
rightdns=8.8.8.8,8.8.4.4
rightsubnet=0.0.0.0/0
eap_identity=%identity
auto=add
Save and exit the file. You'll also need to create a CA, server, and server key for your VPN server. You can generate these using the ipsec command:
sudo ipsec pki --genpub \
--type rsa \
--size 4096 \
--outform pem \
> server-key.pem
sudo ipsec pki --self \
--ca \
--dn "CN=server" \
--key server-key.pem \
--outform pem \
> server-cert.pem
sudo ipsec pki --genreq \
--type rsa \
--size 4096 \
--outform pem \
> server-req.pem
Where <ca> is the CA certificate you are using for your VPN server.
Configuring the FreeRADIUS Server
To authenticate clients, you'll need to set up a FreeRADIUS server. You can install it on the same server as your StrongSwan setup, or on a separate server