strongSwan

Current Release: 4.6.3
Download - Changelog

the OpenSource IPsec-based VPN Solution

runs on Linux 2.6 and 3.x kernels, Android, Maemo, FreeBSD, and Mac OS X
implements both the IKEv1 and IKEv2 (RFC 5996) key exchange protocols
Fully tested support of IPv6 IPsec tunnel and transport connections
Dynamical IP address and interface update with IKEv2 MOBIKE (RFC 4555)
Automatic insertion and deletion of IPsec-policy-based firewall rules
Strong 128/192/256 bit AES or Camellia encryption, 3DES support
NAT-Traversal via UDP encapsulation and port floating (RFC 3947)
Dead Peer Detection (DPD, RFC 3706) takes care of dangling tunnels
Static virtual IPs and IKEv1 ModeConfig pull and push modes
XAUTH server and client functionality on top of IKEv1 Main Mode authentication
Virtual IP address pool managed by IKE daemon or SQL database
Secure IKEv2 EAP user authentication (EAP-SIM, EAP-AKA, EAP-TLS, EAP-MSCHAPv2, etc.)
Optional relaying of EAP messages to AAA server via EAP-RADIUS plugin
Support of IKEv2 Multiple Authentication Exchanges (RFC 4739)
Authentication based on X.509 certificates or preshared keys
Generation of a default self-signed certificate during first strongSwan startup
Retrieval and local caching of Certificate Revocation Lists via HTTP or LDAP
Full support of the Online Certificate Status Protocol (OCSP, RCF 2560).
CA management (OCSP and CRL URIs, default LDAP server)
Powerful IPsec policies based on wildcards or intermediate CAs
Group policies based on X.509 attribute certificates (RFC 3281)
Storage of RSA private keys and certificates on a smartcard (PKCS #11 interface)
Modular plugins for crypto algorithms and relational database interfaces
Support of elliptic curve DH groups and ECDSA certificates (Suite B, RFC 4869)
Optional built-in integrity and crypto tests for plugins and libraries
Smooth Linux desktop integration via the strongSwan NetworkManager applet
Trusted Network Connect compliant to PB-TNC (RFC 5793) and PA-TNC (RFC 5792)

strongSwan builds on Android 2.2

The following HOWTO explains step-by-step how to build the strongSwan IKEv2 daemon on the Android 2.2 emulator.

strongSwan 4.6 with IKEv1 and IKEv2 for Linux 2.6 and 3.0 kernels

The strongSwan 4.6 branch supports both the IKEv1 and IKEv2 key exchange protocols in conjunction with the native NETKEY IPsec stack of the Linux kernel. The IKEv1 keying daemon pluto has been inherited from the strongSwan 2.8 branch whereas the IKEv2 keying daemon charon is based on a totally new object-oriented and multi-threaded concept, with 100% of the code being written in C. strongSwan's IKEv2 functionality has been successfully tested against 15 IKEv2 vendors during the third and fourth IKEv2 Interoperability Workshops in 2007 and 2008, respectively.
strongSwan 4.6 is the official strongSwan distribution that will be actively maintained and continually enriched with new features.

2012-05-01 info@strongswan.org