Openwrt 设备上的 strongswan 配置 IKEv2 分享

V2EX = way to explore

V2EX 是一个关于分享和探索的地方

现在注册

已注册用户请登录

这是一个创建于 64 天前的主题，其中的信息可能已经有所发展或是发生改变。

root@Openwrt:/etc/config# cat /etc/swanctl/conf.d/20.acme.conf 
connections {
  acme {
    local_addrs = %any
    remote_addrs = %any
    vips = 0.0.0.0,::
    fragmentation = yes
    pools = ipv4addr
    send_cert = always
    unique = never
    local {
      auth = pubkey
      id = "xyz.wuruxu.cn"
      certs = xyz.wuruxu.cn.cer
    }
    remote {
      auth = eap-mschapv2
      eap_id=%any
    }
    children {
      sstun {
        local_ts = 0.0.0.0/0,::/0
        remote_ts = dynamic,224.0.0.1,224.0.0.22,224.0.0.251,224.0.0.252,239.255.255.250
        if_id_in = 666
        if_id_out = 666
        esp_proposals = chacha20poly1305-x25519,aes256gcm-modp2048,aes256-sha256,aes256-modp2048,aes256-sha1
        mode = tunnel
        life_time = 2h
        rekey_time = 6h
        dpd_action = clear
        start_action = trap|start
        updown = sh /etc/config/updown.sh

      }
    }
    version = 2
    mobike = yes
    rekey_time = 6h
    over_time = 36m
    proposals = chacha20poly1305-prfsha512-curve25519,aes256gcm16-prfsha512-curve25519,aes256gcm16-prfsha256-ecp256,aes256-sha256-prfsha256-modp2048,aes256gcm16-prfsha256-modp1024
    keyingtries = 3
  }
}

pools {
  ipv4addr {
    addrs = 192.168.166.50-192.168.166.200
    dns = 192.168.228.1
  }
}
root@Openwrt:/etc/config# cat /etc/swanctl/conf.d/10.EAP_MSCHAPv2.users.conf 
secrets {
    eap-user1 {
        id = username
        secret = "password"
    }
}

Strongswan

IKEv2

OpenWrt

9 条回复 • 2025-07-21 19:07:08 +08:00