5 ms·

IKEv2 in iOS 9 and OS X El Capitan

57 points by tomputer 11y ago

internet2000 11y ago
Very interesting. Related: What's the recommended way to set up an IKEv2 server on Linux? I haven't kept up with the StrongSwan fork situation for a while now.
- sigjuice 11y ago
  In the past, I have used the instructions here https://raymii.org/s/tags/vpn.html https://raymii.org/s/tags/vpn.html to set up a Linux server for iOS and OS X clients.
- discreditable 11y ago
  I have been using a StrongSwan server in conjunction with Windows certificate autoenrollment to allow my Windows clients to connect to StrongSwan via IKEv2 for a while. StrongSwan has a rough guide available on their wiki[1]. The only hangup I ran into was that Windows 7 is very particular about what OIDs need to be present in the certificates both on the server and client side[2]. [1]https://wiki.strongswan.org/projects/strongswan/wiki/Windows7 https://wiki.strongswan.org/projects/strongswan/wiki/Windows... [2] https://wiki.strongswan.org/projects/strongswan/wiki/Win7CertReq https://wiki.strongswan.org/projects/strongswan/wiki/Win7Cer...
- 542458 11y ago
  For somebody with no context - what makes this very interesting?
  - deleted 11y ago
    [deleted]
  - tomputer 11y ago
    It is interesting because currently the built-in Apple VPN client in both, OS X and iOS, does not support IKEv2. Well, iOS 8 has support for it but not through the GUI. OS X only supports L2TP/IPsec and Cisco IPsec (both IKEv1). Cisco IPsec is just plain IPsec, using IKE(v1) to establish the tunnel.
- sandstrom 11y ago
  We used StrongSwan (looked into it recently). Worked well, easy to setup. It's a myriad of forks (LibreSwan, FreeSwan, OpenSwan) -- but it seemed like StrongSwan had most frequent updates and good backing.
  - zhovner 11y ago
    Latest strongSwan from brew repository works good on OS X. But most painful thing is connection restart after changing WiFi network. I need to reset it manually in most cases. Even low Dead Peer Detection (dpd) timeouts didn't help. Here is this part from my ipsec.conf: # Always up dpdaction = restart dpddelay = 5s inactivity = 10s keyingtries=%forever auto=start Any suggestions?
    - tomputer 11y ago
      I think MOBIKE [1][2] should solve this, roaming between different networks. [1] https://wiki.strongswan.org/projects/strongswan/wiki/MobIke https://wiki.strongswan.org/projects/strongswan/wiki/MobIke [2] https://tools.ietf.org/html/rfc4555 https://tools.ietf.org/html/rfc4555
- tomputer 11y ago
  If you have the possibility to use a dedicated (virtual) server to setup a IPsec/IKEv2 VPN server, have a look at pfSense[1]. It is easy to manage through the webinterface, especially when using IPsec with certificate authentication for road warriors. The current pfSense stable release uses strongSwan 5.3.2 for IPsec VPN's. Documentation for installing and setting up strongSwan from source is available on their own wiki[2]. There are also packages available for some Linux distributions. This site/blog[3] explains very well how to install and setup strongSwan with certificate authentication. But most of the examples are probably also on the strongSwan wiki. [1] https://www.pfsense.org/ https://www.pfsense.org/ [2] https://wiki.strongswan.org/projects/strongswan/wiki https://wiki.strongswan.org/projects/strongswan/wiki [3] https://www.zeitgeist.se/2013/11/22/strongswan-howto-create-your-own-vpn/ https://www.zeitgeist.se/2013/11/22/strongswan-howto-create-...
orand 11y ago
Very cool. The last I researched this, OpenVPN was the "best" and "most secure" VPN solution, but it was a bit of a hassle to set up for iOS and OS X. But it appears IKEv2 compares quite nicely [1] and will now be built in, so I no longer have to jump through hoops getting it working on iOS and OS X. I can't wait to try it. [1] https://www.bestvpn.com/blog/4147/pptp-vs-l2tp-vs-openvpn-vs-sstp-vs-ikev2/ https://www.bestvpn.com/blog/4147/pptp-vs-l2tp-vs-openvpn-vs...

57 points by tomputer 11y ago

internet2000 11y ago

Very interesting. Related: What's the recommended way to set up an IKEv2 server on Linux? I haven't kept up with the StrongSwan fork situation for a while now.

sigjuice 11y ago
In the past, I have used the instructions here https://raymii.org/s/tags/vpn.html https://raymii.org/s/tags/vpn.html to set up a Linux server for iOS and OS X clients.
discreditable 11y ago
I have been using a StrongSwan server in conjunction with Windows certificate autoenrollment to allow my Windows clients to connect to StrongSwan via IKEv2 for a while. StrongSwan has a rough guide available on their wiki[1]. The only hangup I ran into was that Windows 7 is very particular about what OIDs need to be present in the certificates both on the server and client side[2]. [1]https://wiki.strongswan.org/projects/strongswan/wiki/Windows7 https://wiki.strongswan.org/projects/strongswan/wiki/Windows... [2] https://wiki.strongswan.org/projects/strongswan/wiki/Win7CertReq https://wiki.strongswan.org/projects/strongswan/wiki/Win7Cer...
542458 11y ago
For somebody with no context - what makes this very interesting?
- deleted 11y ago
  [deleted]
- tomputer 11y ago
  It is interesting because currently the built-in Apple VPN client in both, OS X and iOS, does not support IKEv2. Well, iOS 8 has support for it but not through the GUI. OS X only supports L2TP/IPsec and Cisco IPsec (both IKEv1). Cisco IPsec is just plain IPsec, using IKE(v1) to establish the tunnel.
sandstrom 11y ago
We used StrongSwan (looked into it recently). Worked well, easy to setup. It's a myriad of forks (LibreSwan, FreeSwan, OpenSwan) -- but it seemed like StrongSwan had most frequent updates and good backing.
- zhovner 11y ago
  Latest strongSwan from brew repository works good on OS X. But most painful thing is connection restart after changing WiFi network. I need to reset it manually in most cases. Even low Dead Peer Detection (dpd) timeouts didn't help. Here is this part from my ipsec.conf: # Always up dpdaction = restart dpddelay = 5s inactivity = 10s keyingtries=%forever auto=start Any suggestions?
  - tomputer 11y ago
    I think MOBIKE [1][2] should solve this, roaming between different networks. [1] https://wiki.strongswan.org/projects/strongswan/wiki/MobIke https://wiki.strongswan.org/projects/strongswan/wiki/MobIke [2] https://tools.ietf.org/html/rfc4555 https://tools.ietf.org/html/rfc4555
tomputer 11y ago
If you have the possibility to use a dedicated (virtual) server to setup a IPsec/IKEv2 VPN server, have a look at pfSense[1]. It is easy to manage through the webinterface, especially when using IPsec with certificate authentication for road warriors. The current pfSense stable release uses strongSwan 5.3.2 for IPsec VPN's. Documentation for installing and setting up strongSwan from source is available on their own wiki[2]. There are also packages available for some Linux distributions. This site/blog[3] explains very well how to install and setup strongSwan with certificate authentication. But most of the examples are probably also on the strongSwan wiki. [1] https://www.pfsense.org/ https://www.pfsense.org/ [2] https://wiki.strongswan.org/projects/strongswan/wiki https://wiki.strongswan.org/projects/strongswan/wiki [3] https://www.zeitgeist.se/2013/11/22/strongswan-howto-create-your-own-vpn/ https://www.zeitgeist.se/2013/11/22/strongswan-howto-create-...

orand 11y ago

Very cool. The last I researched this, OpenVPN was the "best" and "most secure" VPN solution, but it was a bit of a hassle to set up for iOS and OS X. But it appears IKEv2 compares quite nicely [1] and will now be built in, so I no longer have to jump through hoops getting it working on iOS and OS X. I can't wait to try it. [1] https://www.bestvpn.com/blog/4147/pptp-vs-l2tp-vs-openvpn-vs-sstp-vs-ikev2/ https://www.bestvpn.com/blog/4147/pptp-vs-l2tp-vs-openvpn-vs...