4

As far as I understand, FreeBSD comes with the native ability to make vpn connections.

Ist strongswan a package, that comes on top of the freebsd ipsec stack or is it a replacement?

1 Answer 1

7

FreeBSD's network stack supports IPsec, but that's just the lower layer of IPsec-based VPN connections.

If you don't want to configure security associations (SAs) manually (with encryption/authentication keys you need to place securely on both ends and have to replace regularly) you'll want to use a keying daemon that implements the Internet Key Exchange (IKE) protocol to automate this. strongSwan implements both versions of that protocol and allows setting up and replacing SAs automatically, the hosts are thereby authenticated securely (e.g. using X.509 certificates) and keys are dynamically generated using e.g. the Diffie-Hellman key exchange.

strongSwan operates as a userland daemon that communicates with the FreeBSD kernel using the PF_KEYv2 protocol in order to configure the negotiated IPsec SAs and policies (which define which traffic is secured by which SA) in the network stack.

racoon is an alternative keying daemon, but it only implements the IKEv1 protocol and it's not actively developed anymore (unless you consider its forks in e.g. iOS/OS X and Android). The ipsec-tools package that provides racoon also comes with setkey, which may be used for manual keying but also allows querying the kernel state. So this utility might be useful even when using other keying daemons like strongSwan to check if the installed SAs and policies are as they should be.

2
  • I got somewhat lost somewhere here. If StrongWan is negotiating IKE, why is racoon used together with strongSwan? Dec 27, 2016 at 18:14
  • 1
    They are not used together. I updated the answer.
    – ecdsa
    Dec 28, 2016 at 8:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy