strongSwan 5.x IKEv2 Daemon with VICI interface
50K+
The following setup creates a vpn-server and a vpn-client container as well as the two local networks strongswan_internet and strongswan_intranet:
+------------+ +------------+
10.3.0.1 --- | VPN Client | === 192.168.0.0/24 === | VPN Server | --- 10.1.0.0/16
Virtual IP +------------+ .3 Internet .2 +------------+ .2 Intranet
version: "3"
services:
vpn-server:
image: strongx509/strongswan:5.8.4
container_name: vpn-server
cap_add:
- NET_ADMIN
- SYS_ADMIN
- SYS_MODULE
stdin_open: true
tty: true
volumes:
- ./server:/etc/swanctl
- ./strongswan.conf:/etc/strongswan.conf
networks:
internet:
ipv4_address: 192.168.0.2
intranet:
ipv4_address: 10.1.0.2
vpn-client:
image: strongx509/strongswan:5.8.4
container_name: vpn-client
depends_on:
- vpn-server
cap_add:
- NET_ADMIN
- SYS_ADMIN
- SYS_MODULE
stdin_open: true
tty: true
volumes:
- ./client:/etc/swanctl
- ./strongswan.conf:/etc/strongswan.conf
networks:
internet:
ipv4_address: 192.168.0.3
networks:
internet:
ipam:
driver: default
config:
- subnet: 192.168.0.0/24
intranet:
ipam:
driver: default
config:
- subnet: 10.1.0.0/16
Check out the sources, change into the strongswan directory and build the docker containers and networks
$ git clone https://github.com/strongX509/docker.git
$ cd docker/strongswan
$ docker-compose up
Creating vpn-server ... done
Creating vpn-client ... done
Attaching to vpn-server, vpn-client
In an additional console window we open a bash shell to start and manage the strongSwan charon daemon in the vpn-server container
server$ docker exec -ti vpn-server /bin/bash
server# ./charon &
00[DMN] Starting IKE charon daemon (strongSwan 5.8.4, Linux 5.4.0-kali3-amd64, x86_64)
00[LIB] loaded plugins: charon random nonce x509 constraints pubkey pkcs1 pkcs8 pkcs12 pem openssl drbg kernel-netlink socket-default vici updown eap-identity eap-md5 eap-dynamic eap-tls
00[JOB] spawning 16 worker threads
00[DMN] executing start script 'creds' (swanctl --load-creds)
15[CFG] loaded certificate 'C=CH, O=Cyber, CN=server.strongswan.org'
07[CFG] loaded certificate 'C=CH, O=Cyber, CN=Cyber Root CA'
12[CFG] loaded ECDSA private key
08[CFG] loaded IKE shared key with id 'ike-jane' for: '[email protected]'
13[CFG] loaded IKE shared key with id 'ike-hacker' for: '[email protected]'
08[CFG] loaded EAP shared key with id 'eap-jane' for: 'jane'
11[CFG] loaded EAP shared key with id 'eap-hacker' for: 'hacker'
00[DMN] creds: loaded certificate from '/etc/swanctl/x509/serverCert.pem'
00[DMN] creds: loaded certificate from '/etc/swanctl/x509ca/caCert.pem'
00[DMN] creds: loaded ecdsa key from '/etc/swanctl/ecdsa/serverKey.pem'
00[DMN] creds: loaded ike secret 'ike-jane'
00[DMN] creds: loaded ike secret 'ike-hacker'
00[DMN] creds: loaded eap secret 'eap-jane'
00[DMN] creds: loaded eap secret 'eap-hacker'
00[DMN] executing start script 'conns' (swanctl --load-conns)
13[CFG] added vici connection: rw
16[CFG] added vici connection: psk
09[CFG] added vici connection: eap
00[DMN] conns: loaded connection 'rw'
00[DMN] conns: loaded connection 'psk'
00[DMN] conns: loaded connection 'eap'
00[DMN] conns: successfully loaded 3 connections, 0 unloaded
00[DMN] executing start script 'pools' (swanctl --load-pools)
07[CFG] added vici pool rw_pool: 10.3.0.0, 254 entries
00[DMN] pools: loaded pool 'rw_pool'
00[DMN] pools: successfully loaded 1 pools, 0 unloaded
And in a third console window we open a bashshell to start and manage the strongSwan charon daemon in the vpn-client container
client$ docker exec -ti vpn-client /bin/bash
client# ./charon &
00[DMN] Starting IKE charon daemon (strongSwan 5.8.4, Linux 5.4.0-kali3-amd64, x86_64)
00[LIB] loaded plugins: charon random nonce x509 constraints pubkey pkcs1 pkcs8 pkcs12 pem openssl drbg kernel-netlink socket-default vici updown eap-identity eap-md5 eap-dynamic eap-tls
00[JOB] spawning 16 worker threads
00[DMN] executing start script 'creds' (swanctl --load-creds)
01[CFG] loaded certificate 'C=CH, O=Cyber, CN=client.strongswan.org'
08[CFG] loaded certificate 'C=CH, O=Cyber, CN=Cyber Root CA'
11[CFG] loaded ECDSA private key
01[CFG] loaded IKE shared key with id 'ike-hacker' for: '[email protected]'
07[CFG] loaded EAP shared key with id 'eap-hacker' for: 'hacker'
00[DMN] creds: loaded certificate from '/etc/swanctl/x509/clientCert.pem'
00[DMN] creds: loaded certificate from '/etc/swanctl/x509ca/caCert.pem'
00[DMN] creds: loaded ecdsa key from '/etc/swanctl/ecdsa/clientKey.pem'
00[DMN] creds: loaded ike secret 'ike-hacker'
00[DMN] creds: loaded eap secret 'eap-hacker'
00[DMN] executing start script 'conns' (swanctl --load-conns)
07[CFG] added vici connection: home
12[CFG] added vici connection: psk
05[CFG] added vici connection: eap
00[DMN] conns: loaded connection 'home'
00[DMN] conns: loaded connection 'psk'
00[DMN] conns: loaded connection 'eap'
00[DMN] conns: loaded connection 'eap-tls'
00[DMN] conns: successfully loaded 4 connections, 0 unloaded
00[DMN] executing start script 'pools' (swanctl --load-pools)
no pools found, 0 unloaded
The setup defines four VPN configurations home, psk, eap and eap-tls based on X.509 certificates, pre-shared keys, EAP MD5 and EAP TLS, respectively.
client# swanctl --list-conns
home: IKEv2, no reauthentication, rekeying every 14400s, dpd delay 60s
local: %any
remote: 192.168.0.2
local public key authentication:
id: client.strongswan.org
certs: C=CH, O=Cyber, CN=client.strongswan.org
remote public key authentication:
id: server.strongswan.org
net: TUNNEL, rekeying every 3600s, dpd action is hold
local: dynamic
remote: 10.1.0.0/16
host: TUNNEL, rekeying every 3600s, dpd action is hold
local: dynamic
remote: dynamic
psk: IKEv2, no reauthentication, rekeying every 14400s, dpd delay 60s
local: %any
remote: 192.168.0.2
local pre-shared key authentication:
id: [email protected]
remote pre-shared key authentication:
id: server.strongswan.org
psk: TUNNEL, rekeying every 3600s, dpd action is hold
local: dynamic
remote: 10.1.0.0/16
eap: IKEv2, no reauthentication, rekeying every 14400s, dpd delay 60s
local: %any
remote: 192.168.0.2
local EAP_MD5 authentication:
eap_id: hacker
remote public key authentication:
id: server.strongswan.org
eap: TUNNEL, rekeying every 3600s, dpd action is hold
local: dynamic
remote: 10.1.0.0/16 192.168.0.2/32
eap-tls: IKEv2, no reauthentication, rekeying every 14400s, dpd delay 60s
local: %any
remote: 192.168.0.2
local EAP_TLS authentication:
eap_id: client.strongswan.org
remote public key authentication:
id: server.strongswan.org
eap-tls: TUNNEL, rekeying every 3600s, dpd action is hold
local: dynamic
remote: 10.1.0.0/16 192.168.0.2/32
Content type
Image
Digest
sha256:b82d9013a…
Size
51.3 MB
Last updated
about 2 hours ago
docker pull strongx509/strongswan