\r\n\r\nconfig setup\r\n nat_traversal=yes\r\n # virtual_private=%v4:10.0.0.0\/8,%v4:192.168.0.0\/16,%v4:172.16.0.0\/12\r\n \r\nconn IPSec-IKEv2\r\n keyexchange=ikev2\r\n auto=add\r\n left=%defaultroute\r\n leftauth=pubkey \r\n leftcert=\/usr\/local\/strongswan\/etc\/duo-cert.pem \r\n right=%any\r\n rightauth=eap-radius\r\n rightsendcert=never \r\n eap_identity=%any\r\n ike=aes256-sha1-modp1024!\r\n esp=aes256-sha1! \r\n dpdaction=clear\r\n dpddelay=300s\r\n rightsourceip=192.168.76.0\/22\r\n # rightsourceip=%dhcp\r\n leftsubnet=192.168.0.0\/16 \r\n # leftsourceip=%config\r\n<\/pre>\nWindow will narrow down the traffic thru VPN as the IP range defined in the leftsubnet. To let your gateway route all traffic for Windows, you could use 0.0.0.0\/0<\/strong><\/p>\n\/usr\/local\/strongswan\/etc\/strongswan.conf<\/h3>\n
In plugin session,<\/p>\n
\r\ncharon {\r\n dns1 = 192.168.1.1\r\n nbns1 = 192.168.1.1\r\n\r\n threads = 16\r\n\r\n plugins {\r\n\r\n sql {\r\n # loglevel to log into sql database\r\n loglevel = -1\r\n\r\n # URI to the database\r\n # database = sqlite:\/\/\/path\/to\/file.db\r\n # database = mysql:\/\/user:password@localhost\/database\r\n }\r\n \r\n# dhcp {\r\n# server = 192.168.1.1\r\n# }\r\n \r\n eap-radius {\r\n servers {\r\n vpnserver {\r\n secret = xxxxxxxx\r\n address = 127.0.0.1\r\n }\r\n }\r\n }\r\n }\r\n}\r\n\r\npluto { \r\n \r\n}\r\n \r\nlibstrongswan {\r\n \r\n # set to no, the DH exponent size is optimized\r\n # dh_exponent_ansi_x9_42 = no\r\n}\r\n<\/pre>\nWindows client<\/h1>\n
Install & trust the gateway cert issuer in Windows.
\n