Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 20 May 2011 23:33:48 +0400
From: Solar Designer <>
Subject: IPsec


A user has asked me off-list for advice on what IPsec implementation to
use on Owl.  Since I have no experience with this, I am relaying the
question in here.  I'd appreciate any comments, especially from people
who are actually using IPsec on Owl.

The user is going to have Google Android, iPhone, iPad on the other end.

Linux 2.6 includes IPsec support, but we're currently building our
kernels with the corresponding CONFIG_* options disabled.  This happens
to list the relevant options:

Perhaps the user will need to enable the options (or set them to "=m")
and build a custom kernel using one of the approaches given here:

Perhaps we need to change the options to "=m" in our default kernels to
make this easier going forward.

There are also implementations that pre-date integration into the Linux
kernel, but I guess those should be out of consideration?

For userland tools, there appear to be:

Openswan -

strongSwan -

IPsec-Tools -

OpenBSD's isakmpd ported to Linux - (broken link)

Which of these are most appropriate to use these days?

Last time this topic was brought up in here, Bernhard Fischer wrote:
"we are currently using openswan-2.4.6" and "For a single site-to-site
connection I prefer OpenVPN":

I also recommended OpenVPN (which I am using on Owl):

However, in this case the user specifically needs IPsec (he is already
aware of OpenVPN and is using it on Owl in other cases).

I'd like to provide helpful advice and to make Owl more IPsec-ready
(perhaps not package Openswan or whatever into Owl yet, but make our
kernel builds suitable).



P.S. In general, I prefer users to post their questions in here
directly, without using me as a proxy.  I am making an exception this
time, hopefully without setting a precedent. ;-)

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.