Ubuntu22.04でStrongSwanを使用してIKEv2VPNサーバーをセットアップする方法

PowerShellを使用してルートCA証明書をインポートするには、最初に管理者権限でPowerShellプロンプトを開きます。これを行うには、[スタート]メニューアイコンを右クリックして、[ Windows PowerShell（管理者）]を選択します。 。管理者としてコマンドプロンプトを開き、 powershellと入力することもできます。 。

次に、 Import-Certificateを使用して証明書をインポートします PowerShellコマンドレット。次のコマンドでは、最初の -CertStoreLocation 引数を指定すると、証明書がコンピュータの信頼されたルート証明機関に確実にインポートされます。 すべてのプログラムとユーザーがVPNサーバーの証明書を確認できるように保存します。 -FilePath 引数は、証明書をコピーした場所を指している必要があります。次の例では、パスは C：\ Users \ sammy \ Documents \ ca-cert.pemです。 。使用した場所に一致するようにコマンドを編集してください。

Import-Certificate `
    -CertStoreLocation cert:\LocalMachine\Root\ `
    -FilePath C:\users\sammy\Documents\ca-cert.pem

コマンドは次のようなものを出力します：

Output   PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\Root

Thumbprint                                Subject
----------                                -------
DB00813B4087E9367861E8463A60CEA0ADC5F002  CN=VPN root CA

ここで、PowerShellを使用してVPNを構成するには、次のコマンドを実行します。 -ServerAddressでサーバーのDNS名またはIPアドレスを置き換えます ライン。さまざまなフラグにより​​、 /etc/ipsec.confで設定したオプションと一致する適切なセキュリティパラメータを使用してWindowsが正しく構成されていることが保証されます。 。

Add-VpnConnection -Name "VPN Connection" `
    -ServerAddress "server_domain_or_IP" `
    -TunnelType "IKEv2" `
    -AuthenticationMethod "EAP" `
    -EncryptionLevel "Maximum" `
    -RememberCredential `

コマンドが成功した場合、出力はありません。 VPNが正しく構成されていることを確認するには、 Get-VPNConnectionを使用します コマンドレット：

Get-VpnConnection -Name "VPN Connection"

次のような出力が表示されます：

OutputName                  : VPN Connection
ServerAddress         : your_server_ip
AllUserConnection     : False
Guid                  : {B055A1AB-175C-4028-B4A8-D34309A2B20E}
TunnelType            : Ikev2
AuthenticationMethod  : {Eap}
EncryptionLevel       : Maximum
L2tpIPsecAuth         :
UseWinlogonCredential : False
EapConfigXmlStream    : #document
ConnectionStatus      : Disconnected
RememberCredential    : True
SplitTunneling        : False
DnsSuffix             :
IdleDisconnectSeconds : 0

デフォルトでは、Windowsは古くて遅いアルゴリズムを選択します。 Set-VpnConnectionIPsecConfigurationを実行します cmdlet to upgrade the encryption parameters that Windows will use for the IKEv2 key exchange, and to encrypt packets:

Set-VpnConnectionIPsecConfiguration -Name "VPN Connection" `
    -AuthenticationTransformConstants GCMAES256 `
    -CipherTransformConstants GCMAES256 `
    -DHGroup ECP384 `
    -IntegrityCheckMethod SHA384 `
    -PfsGroup ECP384 `
    -EncryptionMethod GCMAES256

注 :If you would like to delete the VPN connection and reconfigure it with different options, you can run the Remove-VpnConnection cmdlet.

Remove-VpnConnection -Name "VPN Connection" -Force

The -Force flag will skip prompting you to confirm the removal. You must be disconnected from the VPN if you attempt to remove it using this command.

Connecting to the VPN

Once you have the certificate imported and the VPN configured using either method, your new VPN connection will be visible under the list of networks. Select the VPN and click Connect 。 You’ll be prompted for your username and password. Type them in, click OK , and you’ll be connected.

Connecting from macOS

Follow these steps to import the certificate:

1. Double-click the certificate file. Keychain Access will pop up with a dialog that says “Keychain Access is trying to modify the system keychain. Enter your password to allow this.”
2. Enter your password, then click on Modify Keychain
3. Double-click the newly imported VPN certificate. This brings up a small properties window where you can specify the trust levels. Set IP Security (IPSec) to Always Trust and you’ll be prompted for your password again. This setting saves automatically after entering the password.

Now that the certificate is imported and trusted, configure the VPN connection with these steps:

1. Go to System Preferences and choose Network 。
2. Click on the small “plus” button on the lower-left of the list of networks.
3. In the popup that appears, set Interface to VPN , set the VPN Type to IKEv2 , and give the connection a name.
4. In the Server and Remote ID field, enter the server’s domain name or IP address. Leave the Local ID blank.
5. Click on Authentication Settings , select Username , and enter your username and password you configured for your VPN user.次に、[ OK]をクリックします 。

Finally, click on Connect to connect to the VPN. You should now be connected to the VPN.

Connecting from Ubuntu

To connect from an Ubuntu machine, you can set up and manage StrongSwan as a service or use a one-off command every time you wish to connect. Instructions are provided for both.

Managing StrongSwan as a Service

To manage StrongSwan as a service, you will need to perform the following configuration steps.

First, update your local package cache using apt

 sudo apt update

Next, install StrongSwan and the required plugins for authentication:

sudo apt install strongswan libcharon-extra-plugins

Now you’ll need a copy of the CA certificate in the /etc/ipsec.d/cacerts directory so that your client can verify the server’s identity. Run the following command to copy the ca-cert.pem file into place:

sudo cp /tmp/ca-cert.pem /etc/ipsec.d/cacerts

To ensure the VPN only runs on demand, use systemctl to disable StrongSwan from running automatically:

sudo systemctl disable --now strongswan-starter

Next configure the username and password that you will use to authenticate to the VPN server. Edit /etc/ipsec.secrets using nano or your preferred editor:

sudo nano /etc/ipsec.secrets

Add the following line, editing the highlighted username and password values to match the ones that you configured on the server:

your_username : EAP "your_password"

Finally, edit the /etc/ipsec.conf file to configure your client to match the server’s configuration:

config setup

conn ikev2-rw
    right=server_domain_or_IP
    # This should match the `leftid` value on your server's configuration
    rightid=server_domain_or_IP
    rightsubnet=0.0.0.0/0
    rightauth=pubkey
    leftsourceip=%config
    leftid=username
    leftauth=eap-mschapv2
    eap_identity=%identity
    auto=start

To connect to the VPN, type:

sudo systemctl start strongswan-starter

To disconnect again, type:

sudo systemctl stop strongswan-starter

Using the charon-cmd Client for One-Off Connections

To manage StrongSwan as a service, you will need to perform the following configuration steps.

First, update your local package cache using apt

sudo apt update

Next, install StrongSwan and the required plugins for authentication:

sudo apt install strongswan libcharon-extra-plugins

Now you’ll need a copy of the CA certificate in the /etc/ipsec.d/cacerts directory so that your client can verify the server’s identity. Run the following command to copy the ca-cert.pem file into place:

sudo cp /tmp/ca-cert.pem /etc/ipsec.d/cacerts

At this point you can connect to the VPN server with charon-cmd using the server’s CA certificate, the VPN server’s IP address, and the username you configured.

Run the following command whenever you want to connect to the VPN:

sudo charon-cmd --cert ca-cert.pem --host vpn_domain_or_IP --identity your_username

When prompted, provide the VPN user’s password and you will be connected to the VPN. To disconnect, press CTRL+C in the terminal and wait for the connection to close.

Connecting from iOS

To configure the VPN connection on an iOS device, follow these steps:

1. Send yourself an email with the root certificate attached.
2. Open the email on your iOS device and tap on the attached certificate file, then tap Install and enter your passcode. Once it installs, tap Done 。
3. Go to Settings , General , VPN and tap Add VPN Configuration 。 This will bring up the VPN connection configuration screen.
4. Tap on Type and select IKEv2 。
5. In the Description field, enter a short name for the VPN connection. This could be anything you like.
6. In the Server and Remote ID field, enter the server’s domain name or IP address. The Local ID field can be left blank.
7. Enter your username and password in the Authentication section, then tap Done 。
8. Select the VPN connection that you just created, tap the switch on the top of the page, and you’ll be connected.

Connecting from Android

Follow these steps to import the certificate:

1. Send yourself an email with the CA certificate attached. Save the CA certificate to your downloads folder.
2. Download the StrongSwan VPN client from the Play Store.
3. Open the app. Tap the “more” icon (. . . ) in the upper-right corner and select CA certificates 。
4. Tap the “more” icon (. . . ) in the upper-right corner again. Select Import certificate 。
5. Browse to the CA certificate file in your downloads folder and select it to import it into the app.

Now that the certificate is imported into the StrongSwan app, you can configure the VPN connection with these steps:

1. In the app, tap ADD VPN PROFILE at the top.
2. Fill out the Server with your VPN server’s domain name or public IP address.
3. Make sure IKEv2 EAP (Username/Password) is selected as the VPN Type.
4. Fill out the Username and Password with the credentials you defined on the server.
5. Deselect Select automatically in the CA certificate section and click Select CA certificate 。
6. Tap the IMPORTED tab at the top of the screen and choose the CA you imported (it will be named “VPN root CA” if you didn’t change the “DN” earlier).
7. If you’d like, fill out Profile name (optional) with a more descriptive name.

When you wish to connect to the VPN, click on the profile you just created in the StrongSwan application.

Troubleshooting Connections

If you are unable to import the certificate, ensure the file has the .pem extension, and not .pem.txt 。

If you’re unable to connect to the VPN, check the server name or IP address you used. The server’s domain name or IP address must match what you’ve configured as the common name (CN) while creating the certificate. If they don’t match, the VPN connection won’t work. For example, if you set up a certificate with the CN of vpn.example.com , you must use vpn.example.com when you enter the VPN server details. Double-check the command you used to generate the certificate, and the values you used when creating your VPN connection.

Finally, double-check the VPN configuration to ensure the leftid value is configured with the @ symbol if you’re using a domain name:

    leftid=@vpn.example.com

If you’re using an IP address, ensure that the @ symbol is omitted. Also make sure that when you generated the server-cert.pem file that you included both --san @IP_address and --san IP_address フラグ。