4 ms·
IPsec is indeed an odd protocol in that it's almost too flexible, but I think that was probably inevitable - it's part of the TCP/IP suite after all. The variou
by noinsight 10y ago
IPsec is indeed an odd protocol in that it's almost too flexible, but I think that was probably inevitable - it's part of the TCP/IP suite after all. The various vendors probably wanted support for all kinds of weird scenarios built-in.
That doesn't make it particularly good, however. I've looked at it a few times in hopes of implementing my VPN's with it, and there doesn't seem to be any simple intelligible documentation on how to implement it with the basic Linux / FreeBSD tools. It feels like getting into birdwatching with all the different Swans and the weird jargon. Until now, OpenVPN has prevailed.
I'm hoping WireGuard [1] will get widescale support soon enough.
[1] https://www.wireguard.io/ https://www.wireguard.io/
- jdc 10y agoSoftEther is pretty easy to setup and supports IPsec. http://www.softether.org/ http://www.softether.org/
- JoachimSchipper 10y agoFWIW, the OpenBSD IPsec stack is excellent and very user-friendly. (In the "read the sensible, well-written man pages" way of OpenBSD.)
- dozzie 10y agoAdd to IPsec the fact that it was cryptography developed under US export restrictions. This is probably the reason why it has AH for data integrity and ESP for data protection and/or, well, integrity, rendering AH actually excessive. > Until now, OpenVPN has prevailed. Which is somewhat funny, as FreeS/WAN derivatives are much more convenient to configure than OpenVPN with its tons of options that you need to put either on server side or client side (and those differ greatly) and routing that is very, very easy to screw up. Also, I always say that OpenVPN is a weird case of a program open source from the ground up that has a closed communication protocol. No specification and extracting the protocol from the source is difficult in this case.