fix: removed unnecressary peer ID handling that is no longer required for >=5.0 StrongSwan.

README.md

@@ -97,13 +97,13 @@ must have the type shown below; an unknown section or setting is an error.
 | `general` | `mode` | string | `manual` | How much you supply: `manual`, `interfaces` or `auto` |
 | `interfaces` | `external` | string | | Name of the NIC facing the untrusted network |
 | `interfaces` | `internal` | string | | Name of the NIC facing the protected network |
-| `wan` | `local_fqdn` | string | | This router's FQDN |
+| `wan` | `local_fqdn` | string | | This router's name or IP address, used as its IKE identity in `fqdn` mode |
 | `wan` | `local_id_mode` | string | `fqdn` | IKE identity source: `fqdn`, `public_ip` or `internal_ip` |
 | `local` | `cidrs` | list | | Local subnets advertised into the tunnel |
 | `local` | `int_addr` | string | | This host's address on the internal network |
 | `local` | `int_gateway_ip` | string | | Next hop on the internal side |
 | `remote` | `addrs` | list | | Remote gateway addresses or FQDNs |
-| `remote` | `id` | string | | Remote IKE identity, without a leading `@` |
+| `remote` | `id` | string | | Remote IKE identity, an FQDN or an IPv4 or IPv6 address |
 | `remote` | `cidrs` | list | | Remote subnets reachable through the tunnel |
 | `remote` | `psk` | string | | Pre-shared key |
 | `remote` | `psk_file` | string | | Path to a file holding the key; wins over `psk` |
@@ -132,6 +132,11 @@ A minimal site-to-site configuration in `auto` mode:
 }
 ```
 
+The router's IKE identity (`wan.local_fqdn` in `fqdn` mode) and the remote one (`remote.id`) are
+an FQDN or an IPv4 or IPv6 address. They are written to the strongSwan configuration as given;
+strongSwan reads an address as an IP identity and a name as an FQDN, so a leading `@` is not needed
+and is refused. Road-warrior access needs a name in `wan.local_fqdn`.
+
 WireGuard peers are added by hand in `/etc/wireguard/wg0.conf`. The package owns the
 `[Interface]` section of that file and rewrites it when the settings above change, but it
 carries every `[Peer]` section across untouched.

debian-package/debian/changelog

@@ -1,3 +1,15 @@
+vpn-router (0.3.2-1) unstable; urgency=medium
+
+  * Accept an IPv4 or IPv6 address as remote.id and as wan.local_fqdn. The
+    identities are written to the strongSwan configuration as given, without
+    an @ added, and strongSwan reads an address as an IP identity and a name
+    as an FQDN. A value that starts with @ is refused with an error, since
+    strongSwan 5.0 and later need no @ to avoid resolving a name.
+    Road-warrior access still needs a name in wan.local_fqdn.
+  * Depend on strongswan-swanctl and charon-systemd 5.0 or later.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 23 Oct 2026 18:00:00 +0200
+
 vpn-router (0.3.1-1) unstable; urgency=medium
 
   * Ignore virtual interfaces when mode auto looks for the internal

debian-package/debian/control

@@ -9,8 +9,8 @@ Rules-Requires-Root: no
 Package: vpn-router
 Architecture: all
 Depends: ${misc:Depends},
-         strongswan-swanctl,
+         strongswan-swanctl (>= 5.0),
-         charon-systemd,
+         charon-systemd (>= 5.0),
          libstrongswan-extra-plugins,
          libcharon-extra-plugins,
          wireguard-tools,

debian-package/src/usr/lib/vpn-router/vpnrouter.py

@@ -190,6 +190,12 @@ def validate(cfg):
                 raise ConfigError(
                     f'{section}.{option} is required in mode {mode or "manual"}')
 
+    for section, option in (('wan', 'local_fqdn'), ('remote', 'id')):
+        if str(_get(cfg, section, option)).startswith('@'):
+            raise ConfigError(
+                f'{section}.{option}: remove the leading @; strongSwan reads an '
+                'address as an IP identity and a name as an FQDN')
+
     id_mode = _get(cfg, 'wan', 'local_id_mode')
     if id_mode and id_mode not in ID_MODES:
         raise ConfigError(
@@ -424,7 +430,7 @@ def build_context(cfg, local_id_override=None):
     if local_id_override:
         local_id = local_id_override
     elif id_mode == 'fqdn':
-        local_id = f'@{local_fqdn}' if local_fqdn else ''
+        local_id = local_fqdn
     elif id_mode == 'internal_ip':
         local_id = int_addr
     else:

debian-package/src/usr/share/vpn-router/templates/remote-site.conf.j2

@@ -14,7 +14,7 @@ connections {
     }
 
     remote {
-      id = @{{ remote_id }}
+      id = {{ remote_id }}
       auth = psk
     }
 
@@ -40,7 +40,7 @@ connections {
 secrets {
   ike-psk {
     id-1 = {{ local_id }}
-    id-2 = @{{ remote_id }}
+    id-2 = {{ remote_id }}
     secret = "{{ psk }}"
   }
 }