Strongswan vpn client mac os

strongSwan

Documentation¶

Resources¶

strongSwan on Mac OS X¶

Since strongSwan 4.3.4 the IKE daemon charon runs on macOS.

With 5.1.0 most limitations of earlier releases have been resolved. For instance, virtual IP addresses are now fully supported.

Please note that releases before 5.0.0 don’t support IKEv1 because the old pluto IKEv1 daemon was not ported to macOS.

Native application¶

We previously maintained a native application for Mac OS X 10.7 and newer. It allowed easy road-warrior access in a similar fashion as the NetworkManager integration does on Linux.

With the availability of the standard IKEv1/IKEv2 client integration in more recent versions of macOS, we have determined that continuing maintenance of a native application build is no longer required. For information on using the integrated VPN client in macOS, see Mac support.

• An easy to deploy unprivileged strongSwan.app, providing a simple graphical user interface to manage and initiate connections
• Automatic installation of a privileged helper tool (IKE daemon)
• Gateway/CA certificates get fetched from the OS X Keychain service
• Currently supported are IKEv2 connections using EAP-MSCHAPv2 or EAP-MD5 client authentication

• The app does not send certificate requests. So unless the gateway’s certificate is installed in the client’s Keychain the server has to be configured with leftsendcert=always, otherwise, the client won’t have the gateway’s certificate available causing the authentication to fail.
• Requires a 64-bit Intel processor and OS X 10.7 or higher

Archived builds of strongSwan for OS X can be found on http://download.strongswan.org/osx.

Homebrew¶

As an alternative to the native app, strongSwan was recently added to Homebrew. The strongswan Formula makes installing and updating the current release very simple. The plugin configuration is most suitable for road-warrior access, that is, plugins specifically designed for use on gateways are disabled (e.g. attr or eap-radius).

sudo is not required to install strongSwan, but is later needed when running ipsec, swanctl, or charon-cmd.

MacPorts, Building from the Git repository¶

It’s also possible to build strongSwan manually from the Git repository or a source tarball. When building from the Git repository it is recommended to use MacPorts to install the build dependencies. That’s because some packages provided by Homebrew are unsuitable to build strongSwan from scratch.

Requirements¶

If you build from the Git repository the tools/packages listed in source:HACKING have to be installed via MacPorts.

Depending on your plugin configuration other packages may be required, such as the GMP library or a newer release of the OpenSSL library.

Building strongSwan¶

The regular installation instructions may be followed to build strongSwan.

The following ./configure options are either required, or recommended:

• —disable-kernel-netlink — Required to disable the Linux-specific kernel interface
• —enable-kernel-pfroute — Required to enable the interface to the Mac OS X network stack
• —enable-kernel-pfkey — Required to enable the interface to the Mac OS X IPsec stack. Alternatively, the —enable-kernel-libipsec option may be used to enable strongSwan’s userland IPsec implementation that provides support for AES-GCM (depending on plugin configuration) in IPsec processing, which the Mac OS X kernel currently does not
• —disable-gmp —enable-openssl — Recommended to avoid additional dependencies by using the system’s OpenSSL library instead of the GMP library for public key cryptography
• —enable-osx-attr — Recommended to enable DNS server installation via SystemConfiguration
• —disable-scripts — Required because these scripts are not fully portable
• —with-lib-prefix=/opt/local — Required because MacPorts installs libraries and header files in /opt/local

Note:

• For releases before 5.0.0 you also need to add —disable-pluto .

Источник

VPN Plus 4+

Tigervpns LTD

• • 4,1 • Оценок: 478

• • Бесплатно
  • Включает встроенные покупки

Снимки экрана

Описание

VPN Plus lets you keep safe on the Internet.

Nowadays, privacy is a luxury!

Whenever we pay our bills, manage our bank accounts, or log in to our favorite social networks, our credentials, account numbers, billing address, and other private data may end up in the crosshairs of identity thieves.

VPN Plus protects all your online activities with just one click.

— Automatically create and manage a network profile in the macOS System Preferences. Zero manual configuration.

— Select the most rapid VPN server at the time of making connection.

— When VPN is dropped on bad network condition, the app can reconnect to VPN automatically.

— Two different VPN technologies bundled in one app. UDP protocol is faster and better for ordinary users. TCP protocol is more secure.

# Your privacy matters

— The app does not require a username/password to login. So users are 100% anonymous to the service provider.

— No log is kept on the server side, except for the IP address during the VPN session, and when the session ends, the information is discarded.

Источник

Strongswan IKEv2 VPN on OS X 10.11 and iOS 10 Clients

After many days of searching on Google, through Serverfault, and even on the StrongSwan website, I have been unsuccessful in attempting to get StrongSwan IPSec/IKEv2 VPN working on OS X 10.11.5 and iOS 10. I have been very successful in getting it to work on Windows 10 Pro Insider Preview and Android — neither of which are relevant to my travel arrangements where I will only have a Mac notebook and iOS 10 devices.

I have two StrongSwan VPN Servers setup — one in London and one in San Francisco, both with nearly identical configurations.

Having followed https://raymii.org/s/tutorials/IPSEC_vpn_with_Ubuntu_16.04.html I was able to quickly setup both servers and issue a single client certificate for Windows 10 Pro Insider Preview and Android. However, when I copy the p12s of the two servers over to OS X and iOS to create the VPNs I am presented with questions I didn’t get what the other two operating systems.

I can seem to find a definitive answer on what is a » Remote ID » and » Local ID » and how does this pertain to me establishing a certificate based authenticated connection to the SwanStrong VPN Server?

From what little I have been able to find I have learned the following:

• Local ID must match the CN or SAN specified in the certificate (i.e. example@example.com )
• Remote ID is required by both OS X and iOS but I have no idea what to put in this input field
• Unlike Windows and Android which connected seamlessly with encryption, OS X and iOS both get stuck at «Connecting» or will quickly cycle to «Disconnecting» perpetually

This is one of the StrongSwan server configurations (the one I have been testing against):

How can I correctly provision the VPN Tunnel on OS X 10.11.5 and iOS 10 with the same certificates used by Windows and Android?

Источник

WireGuard 4+

Official WireGuard VPN client

WireGuard Development Team

Screenshots

Description

WireGuard is a fast, modern, and secure VPN tunnel. This app allows users to manage and use WireGuard tunnels. The app can import new tunnels from archives and files, or you can create one from scratch. It is currently undergoing rapid development, and we are listening to our users in implementing new and exciting features. Please visit wireguard.com for a summary of the WireGuard protocol and how to set up your own WireGuard server for use with this app.

What’s New

Fixes for small bugs, and better on-demand handling.

Ratings and Reviews

A Perfect Implementation

This works more or less flawlessly. The protocol itself is incredibly fast and efficient, and this implementation maintains that.

It is completely integrated with macOS’s networking frameworks, so it can be managed in System Preferences like a normal VPN and run without keeping a separate application open. It seems to have almost no system overhead, either, and it is very easy to set up. It also properly stores credentials in Keychain Access, rather than trying to manage them itself.

There is one oddity, though: the configuration dialog consists of one text box that contains the config file, rather than a series of form fields like the iOS client. I don’t think it is worse, necessarily, but it’d make more sense if the UI was consistent across both platforms.

Great application

This is a fantastic bit of software. The initial setup can be someone of a bear and confusing but once you get the keys set up and single port forwarded its off to the races. Its amazingly fast compared to openvpn and more secure.

Some might be scared off by opening a port but dont be. If you run a port scan you cant even see the port is open. It only reports open when wireguard handshake is complete.

Pair it will a VPN provider and you have a fast and reliablie vpn setup. Highly recommend.

Pretty Interesting

I am not a tech guy but I use a lot of VPNs to deal with privacy and some work in areas where VOIP is blocked for economic interests. This software connects fast, seems to reconnect well when moving from network to network (10x better than anything else) and gets good to downright amazing speeds. This is the unevenly distrubuted future of private connections.

App Privacy

The developer, WireGuard Development Team , indicated that the app’s privacy practices may include handling of data as described below. For more information, see the developer’s privacy policy.

Data Not Collected

The developer does not collect any data from this app.

Privacy practices may vary, for example, based on the features you use or your age. Learn More

Information

English, Catalan, Finnish, French, German, Indonesian, Italian, Japanese, Korean, Persian, Polish, Punjabi, Romanian, Russian, Simplified Chinese, Slovenian, Spanish, Traditional Chinese, Turkish

Supports

• 

Family Sharing

With Family Sharing set up, up to six family members can use this app.

Источник

Обзор IPSEC демона StrongSwan

Введение

Обзор демона StrongSwan

StrongSwan является демоном IPSEC, который поддерживает IKEv1 и IKEv2. На данный момент это развивающий продукт. Установка StrongSwan может быть выполнена из исходников или репазитория. Установка из исходников описана на сайте StrongSwan.
Установка из репазитория происходит без проблем командой:
Файлы конфигурирования по умолчанию хранятся в директории /etc/ и имеют следующие названия:

• ipsec.conf – определяет параметры IPSEC-соединений и параметры подключений в целом;
• ipsec.secrets – служит для хранения ссылок на сертификаты и ключи аутентификации;
• strongswan.conf – для подключения криптографических алгоритмов и дополнительных функций.

Помимо этого во время установки программного обеспечения для хранения сертификатов и CRL-файлов используемых демонами pluto и charon создается директория /etc/ipsec.d, в которой находятся следующие каталоги:

• private – содержит закрытые ключи RSA и ECDSA;
• certs – содержит сертификаты X.509 и PGP;
• crls – хранит список отозванных сертиифкатов;
• cacerts – хранит доверенные сертификаты CA;
• ocspcerts – содержит подписанные OCSP сертификаты;
• reqs – содержит запросы на сертификаты в формате PKCS#10.

Файл /etc/ipsec.secrets содержит неограниченное количество следующих типов ключей (паролей):

• RSA для определения пароля к сертификату открытого ключа;
• ECDS для определения пароля к сертификату открытого ключа;
• PSK для определения Pre-shared ключа;
• EAP для учетных записей EAP;
• NTLM для учетных записей NTLM;
• XAUTH для учетных записей XAUTH;
• PIN для пин-кода смарт-карт.

Соответственно поддерживаются все типы аутентификации.
Основные параметры команды ipsec, которая управляет подключениями StrongSwan:

• start|restart|stop;
• ipsec status|statusall — для просмотра состояния IPSEC-соединений;
• up|down|route|unroute — для управления IPSEC-соединений.

Логи хранятся в /var/log/auth.log и /var/log/daemon.log.

Настройка Remote Access VPN на сертификатах

Генерация сертификатов

Генерация сертификатов является самой ответственной частью и самой трудной, именно от нее будет зависеть работоспособность нашего IPSEC=тунеля.
Сертификаты генерировались с помощью OPENSSL.
Сначала настраиваем OPENSSL:

Создаем директорию для новых сертификатов и файл с серийником для OPENSSL

Генерируем сертификат для сервера:

При генерации сертификата обязательно нужно задать для серверного сертификата в openssl.cnf параметр subjectAltName=IP:
Генерируем сертификат для клиента:

Настройка StrongSwan

Основными файлами для настройки являются etc/ipsec.conf и ipsec.secrets.
Начнем с ipsec.conf

Более подробно ознакомиться с директивами данного файла можно по ссылке.

Настройка IPSEC подключения для Win7 и импорт сертификатов .

Дальше можно подключиться клиентом и проверить статус соединения командой ipsec statusall и просмотром логов, ну и в Windows должно быть успешно подключено VPN-соединение и пинги будут бегать.

Источник