3 ms·

IPSec takes around 30 lines of config to setup using strongSwan and can be setup in minutes. But there are lots of footguns which makes it a bad protocol for no

IPSec takes around 30 lines of config to setup using strongSwan and can be setup in minutes. But there are lots of footguns which makes it a bad protocol for non-experts to secure. Wireguard on the other hand is secure or off.

marcan_42 5y ago
IPSec can be set up in minutes if you have a working config to copy and paste off of that matches what you're trying to do. Otherwise, expect hours of scratching your head trying to figure out why it's not doing what you want. Source: I'm an infosec professional and general systems guy and I use IPSec at home with StrongSwan. It took me several hours to set it up and I still run into issues from time to time.
- puzzlingcaptcha 5y ago
  I also use IPSec at home (with Windows, Android, Linux and MacOS peers) with StrongSwan and it definitely didn't take me hours to set up. Fortunately, StrongSwan maintains an extensive database of virtually any supported configuration that can be used as a starting point https://www.strongswan.org/testresults.html https://www.strongswan.org/testresults.html People in this thread point out that is not compatible between networking hardware vendor implementations, but if you just run a Strongswan responder on your own server a lot of this disappears. And yes, Windows/Linux/Mac are natively supported. Setting up a Windows peer is importing a certificate and two lines of PowerShell.
  - marcan_42 5y ago
    > Fortunately, StrongSwan maintains an extensive database of virtually any supported configuration that can be used as a starting point You are confirming what I said: that it's only easy if you have something to copy and paste off of. It took me hours because I was trying to do something less common, namely peer to peer transport mode between LAN hosts with rules to exclude SSH access and multicasts. That this was a less common config is no excuse for the amount of prodding and debugging I had to do until I figured out what magical set of policies did what I want.

marcan_42 5y ago

IPSec can be set up in minutes if you have a working config to copy and paste off of that matches what you're trying to do. Otherwise, expect hours of scratching your head trying to figure out why it's not doing what you want. Source: I'm an infosec professional and general systems guy and I use IPSec at home with StrongSwan. It took me several hours to set it up and I still run into issues from time to time.

puzzlingcaptcha 5y ago
I also use IPSec at home (with Windows, Android, Linux and MacOS peers) with StrongSwan and it definitely didn't take me hours to set up. Fortunately, StrongSwan maintains an extensive database of virtually any supported configuration that can be used as a starting point https://www.strongswan.org/testresults.html https://www.strongswan.org/testresults.html People in this thread point out that is not compatible between networking hardware vendor implementations, but if you just run a Strongswan responder on your own server a lot of this disappears. And yes, Windows/Linux/Mac are natively supported. Setting up a Windows peer is importing a certificate and two lines of PowerShell.
- marcan_42 5y ago
  > Fortunately, StrongSwan maintains an extensive database of virtually any supported configuration that can be used as a starting point You are confirming what I said: that it's only easy if you have something to copy and paste off of. It took me hours because I was trying to do something less common, namely peer to peer transport mode between LAN hosts with rules to exclude SSH access and multicasts. That this was a less common config is no excuse for the amount of prodding and debugging I had to do until I figured out what magical set of policies did what I want.