IPSec IKEv2

[cpu]

Suggested by @chenhouwu in StreisandEffect/streisand#110

Would like to have support of IPSec without l2tp.
l2tp is blocked often by GFW,
I hear that IKEv2 is never blocked.

There is some substantial follow-up discussion from @jlund and others in StreisandEffect/streisand#110 that should be referenced by anyone wishing to restart this discussion here.

[cpu]

Also came up in StreisandEffect/streisand#85

[lgg]

@cpu what we need to do to add ikev2 support? Any ideas how to release this?

[alimakki]

@lgg, I'm working on a PR to do this.

[nopdotcom]

Rolling it out isn't really the problem. We've got infrastructure to build client certs, and the server sitting there. Mostly what it will take is a pointer to a good, somewhat-commented configuration file. Uh, plus a lot of instructions. I can write the instructions, although it takes time.

[lgg]

@alimakki is there anything i could help you with?

@nopdotcom i think we can take a lot of information from https://github.com/trailofbits/algo/ and StrongSwan Wiki

[alimakki]

@lgg for now no, although I do appreciate the offer. I'll try to get a skeleton implementation by the end of this upcoming weekend, perhaps then some testing and feedback would be useful.

[no-usernames-left]

+1 to this idea. This link might help whoever is implementing IKEv2 for Streisand (which I think is a fabulous idea, even just for the mobility support).

[faeton]

Has there been any progress towards IKEv2 implementation? It is pretty important and seems like ez to integrate using libre/strongswan

[cpu]

@faeton This should be closed, there's no work going on in this direction. Streisand decided to remove all of the existing IPSec based VPN code. I recommend you look into Algo VPN if you are interested in IPSec/IKEv2.