fix: removed unnecressary peer ID handling that is no longer required for >=5.0 StrongSwan.

debian-package/debian/changelog

@@ -1,3 +1,15 @@
+vpn-router (0.3.2-1) unstable; urgency=medium
+
+  * Accept an IPv4 or IPv6 address as remote.id and as wan.local_fqdn. The
+    identities are written to the strongSwan configuration as given, without
+    an @ added, and strongSwan reads an address as an IP identity and a name
+    as an FQDN. A value that starts with @ is refused with an error, since
+    strongSwan 5.0 and later need no @ to avoid resolving a name.
+    Road-warrior access still needs a name in wan.local_fqdn.
+  * Depend on strongswan-swanctl and charon-systemd 5.0 or later.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 23 Oct 2026 18:00:00 +0200
+
 vpn-router (0.3.1-1) unstable; urgency=medium
 
   * Ignore virtual interfaces when mode auto looks for the internal

debian-package/debian/control

@@ -9,8 +9,8 @@ Rules-Requires-Root: no
 Package: vpn-router
 Architecture: all
 Depends: ${misc:Depends},
-         strongswan-swanctl,
-         charon-systemd,
+         strongswan-swanctl (>= 5.0),
+         charon-systemd (>= 5.0),
          libstrongswan-extra-plugins,
          libcharon-extra-plugins,
          wireguard-tools,

debian-package/src/usr/lib/vpn-router/vpnrouter.py

@@ -190,6 +190,12 @@ def validate(cfg):
                 raise ConfigError(
                     f'{section}.{option} is required in mode {mode or "manual"}')
 
+    for section, option in (('wan', 'local_fqdn'), ('remote', 'id')):
+        if str(_get(cfg, section, option)).startswith('@'):
+            raise ConfigError(
+                f'{section}.{option}: remove the leading @; strongSwan reads an '
+                'address as an IP identity and a name as an FQDN')
+
     id_mode = _get(cfg, 'wan', 'local_id_mode')
     if id_mode and id_mode not in ID_MODES:
         raise ConfigError(
@@ -424,7 +430,7 @@ def build_context(cfg, local_id_override=None):
     if local_id_override:
         local_id = local_id_override
     elif id_mode == 'fqdn':
-        local_id = f'@{local_fqdn}' if local_fqdn else ''
+        local_id = local_fqdn
     elif id_mode == 'internal_ip':
         local_id = int_addr
     else:

debian-package/src/usr/share/vpn-router/templates/remote-site.conf.j2

@@ -14,7 +14,7 @@ connections {
     }
 
     remote {
-      id = @{{ remote_id }}
+      id = {{ remote_id }}
       auth = psk
     }
 
@@ -40,7 +40,7 @@ connections {
 secrets {
   ike-psk {
     id-1 = {{ local_id }}
-    id-2 = @{{ remote_id }}
+    id-2 = {{ remote_id }}
     secret = "{{ psk }}"
   }
 }