Puffy to puffy
# cat /etc/iked.conf ikev2 “virtualmachine” passive esp from 172.0.16.0/24 to 192.168.10.0/24 \ local egress peer any psk “secret” # cat /etc/iked.conf ikev2 “openbsdgw” active esp from 192.168.10.0/24 to 172.0.16.0/24 \ local egress peer 10.20.30.10 psk “secret” ---------------------------- OpenBSD 6.X ( IPHONE AND STRONGSWAN ) ikev2 "roadwarrior" passive esp from 0.0.0.0/0 to 10.20.30.0/24 \ local egress peer any \ ikesa enc aes-256 auth hmac-sha2-256 group modp2048 \ childsa enc aes-256 auth hmac-sha2-256 group modp2048 \ dstid [email protected] psk "psk_passphrase" config address 10.20.30.32 Iphone = just disable certificates and set psk Interoperability with StrongSwan # cat /etc/ipsec.conf ipsec.conf – strongSwan IPsec configuration file # basic configuration config setup conn %default ikelifetime=60m keylife=20m rekeymargin=3m keyingtries=1 keyexchange=ikev2 authby=secret ike=aes256-sha256-modp2048! esp=aes256-sha256-modp2048! conn strongswan left=%any leftfirewall=yes leftsourceip=%config right=REMOTE_PEER_IP rightid=puffymagic.ikedvpn.com rightsubnet=192.168.0.0/24,172.8.50.0/24 ( networks you want access on other side ) ( behind magic puffer fish ) auto=add # cat /etc/ipsec.secrets # ipsec.secrets – strongSwan IPsec secrets file : PSK “strongopeniked” Hope it helps You welcome ! 2018-05-29 9:42 GMT-03:00 Jan <[email protected]>: > Hi Christophe, > > i think i’ve got it now. I removed the „config“ Options from the Server > config and things started working. > (for what interface should they be applied at all ?) > Since then my home lan (192.168.1.0/24) stoped working for other devices > at home. When this is working again i will post my Setup. > I think now everything from 192.168.1.0/24 gets routed through vpn to my > Notebook and others are not allowed anymore. Maybe putting vpn ips and > local ips in different address ranges is a good idea… > > Jan > >
