IPSec Roadwarrior Improvements

IPSec Roadwarrior Improvements

[Tom Rymes]

[-- Attachment #1: Type: text/plain, Size: 2009 bytes --]

In the past, we have discussed improving the IPSec experience for 
roadwarrior users, especially Windows, Mac, iOS, and Android, which all 
require their own special settings and configurations.

There are really two parts to this process, as I see it:

1.) On IPFire: simplify adding a connection that is properly configured 
for a given client OS
2.) On the Client: simplify installing certificates and creating the 
connection.

#2 will take quite a lot of time and planning, including the development 
of downloadable iOS/MacOS configuration profiles and a script to create 
the connection and install the cert in Windows, while also enabling 
stronger encryption.

However, it seems to me that the first part could actually be a lot 
simpler. There are really only two things that I have found that need to 
be done to work around the current WUI shortcomings when it comes to 
creating connections for modern client OSes:

1.) Encryption settings
2.) Additional parameters in /etc/ipsec.user.conf

Other than that, I think it's pretty straightforward, and I was 
wondering if it would be reasonably easy to have the roadwarrior 
configuration page provide a selection menu with the following options:

1.) Windows
2.) MacOS
3.) iOS
4.) Android
5.) Other

If the user selected 1-4, the system would just build a tunnel with the 
appropriate encryption settings and additional parameters already 
configured, and the user would only need to specify a name. A user that 
chooses "Other" would be presented with the current setup process. Users 
could customize tunnel types 1-4 after the fact if they wished, using 
the existing WUI pages.

As is so often the case, I see what needs to be done, but lack the 
skills to make it happen, so I am just an idea rat on this one. I do 
think that this is an important feature for attracting new users, and I 
think the eventual removal of OpenVPN has been discussed, making this a 
step that will eventually need to be taken.

What does everyone else think?

Tom