I forgot to mention that I revisited my earlier wiki example for creating a MacOS Roadwarrior configuration. I was able to fix bad photos, eliminate some errors and bad information, and generally clean things up a bit.
https://wiki.ipfire.org/configuration/services/ipsec/example_configuration-_...
As you can see, it’s a pretty ugly process, and needlessly complex.
Please chime in if you have suggestions.
Tom
On Dec 9, 2018, at 8:20 PM, Tom Rymes trymes@rymes.com wrote:
Folks, I just revisited the IPSec roadwarrior configuration mess today, and I am hoping that I might be able to help in getting things squared away on that front. Configuring tunnels is a complete PITA for modern clients, and it pushes a lot of people over to OpenVPN because “IPSec is too complicated.”
To summarize the current status, the Roadwarrior configs written by IPFire do not work with modern clients, and include outdated and deprecated IPSec settings. Combine that with the fact that each client seems to need its own unique combination of settings, and you get a big mess.
So, my thought was to modify the vpnmain.cgi script such that it provides multiple options when creating tunnels. Currently, it asks if you want to create:
- Host-to-Net Tunnel (Roadwarrior)
- Net-to-Net Tunnel
To replace this, I am envisioning:
- Host-to-Net Tunnel - Windows Client
- Host-to-Net Tunnel - MacOS Client
- Host-to-Net Tunnel - iOS Client
- Host-to-Net Tunnel - Android Client
- Net-To Net Tunnel
This would be a good start, but I am hoping to eventually be able to have the WUI write out the config such that one tunnel could service all clients (which is not easily achieved just yet). This would eliminate the need to have multiple types of roadwarrior setups. Checkboxes in the configuration page could be used to enable and disable different client OSes, as doing so can improve security (by disabling weaker ciphers, mostly).
Once the WUi is modified to actually write out a config that works with modern clients, then I was thinking that creation of Windows install scripts and Apple Configuration Profiles would be a really nice feature if possible.
Does anyone have any input?
Tom