UNDERCODE COMMUNITY

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑🖧 Installing and configuring StrongSwan VPN on Ubuntu 20.04:

1) VPN is used to create a private network from a public internet connection to protect your data.

2) strongSwan is one of the most famous VPN software that supports various operating systems including Linux, OS X, FreeBSD, Windows, Android and iOS.

It uses the IKEv1 and IKEv2 protocols to securely establish a connection.

3) You can extend its functionality with built-in plugins.

4) You can install it with other required components using the following command:

apt-get install install strongswan strongswan-pki libcharon-extra-plugins libcharon-extauth-plugins libstrongswan-extra-plugins -y

Once all packages have been installed, you can proceed to create a CA certificate.

🦑How to create a certificate for a VPN server

1) Then you will need to generate a certificate and key for the VPN server to authenticate the server on the client side.

First, create a private key for the root CA with the following command:

ipsec pki --gen --size 4096 --type rsa --outform pem> /etc/ipsec.d/private/ca.key.pem

2) Then create a root CA and sign it using the above key:

ipsec pki --self --in /etc/ipsec.d/private/ca.key.pem --type rsa --dn "CN = My VPN Server CA" --ca --lifetime 3650 --outform pem> / etc / ipsec.d / cacerts / ca.cert.pem

3) Then create a private key for the VPN server using the following command:

ipsec pki --gen --size 4096 --type rsa --outform pem> /etc/ipsec.d/private/server.key.pem

4) Finally, generate a server certificate using the following command:

ipsec pki --pub --in /etc/ipsec.d/private/server.key.pem --type rsa | ipsec pki --issue --lifetime 2750 --cacert /etc/ipsec.d/cacerts/ca.cert.pem --cakey /etc/ipsec.d/private/ca.key.pem --dn "CN = vpn .domain.com "--san =" vpn.domain.com "--flag serverAuth --flag ikeIntermediate --outform pem> /etc/ipsec.d/certs/server.cert.pem

5) At this point, all certificates are ready for your VPN server.

StrongSwan VPN setup
The default strongswan configuration file is /etc/ipsec.conf.

We can back up the main config file and create a new file:

mv /etc/ipsec.conf /etc/ipsec.conf-bak
Then create a new config file:

nano /etc/ipsec.conf
Add the following config and conn settings:

config setup
charondebug = "ike 2, knl 2, cfg 2, net 2, esp 2, dmn 2, mgr 2"
strictcrlpolicy = no
uniqueids = yes
cachecrls = no

conn ipsec-ikev2-vpn
auto = add
compress = no
type = tunnel
keyexchange = ikev2
fragmentation = yes
forceencaps = yes
dpdaction = clear
dpddelay = 300s
rekey = no
left =% any
leftid=@vpn.domain.com
leftcert = server.cert.pem
leftsendcert = always
leftsubnet = 0.0.0.0 / 0
right =% any
rightid =% any
rightauth = eap-mschapv2
rightsourceip = 10.10.10.0 / 24
rightdns = 8.8.8.8
rightsendcert = never
eap_identity =% identity
Save and close the /etc/ipsec.conf file.

Next, you will need to define the EAP user credentials and RSA private keys for authentication.

You can customize it by editing the /etc/ipsec.secrets file:

nano /etc/ipsec.secrets
Add the following line:

: RSA "server.key.pem"
vpnsecure: EAP "password"
Then restart the StrongSwan service as follows:

systemctl restart strongswan-starter
To enable StrongSwan to start at system boot, enter:

systemctl enable strongswan-starter
Check the status of the VPN server, enter:

systemctl status strongswan-starter

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

358 views09:02