From dd2dfaaf2b06a58ce0f9cb8bc7b4afa8bec79b0e Mon Sep 17 00:00:00 2001 From: Slawomir Koszewski Date: Tue, 27 Oct 2026 08:46:36 +0100 Subject: [PATCH] fix: the router's IPsec remote access is called IKEv2 instead of road-warrior. --- ADR.md | 20 +++---- README.md | 58 +++++++++---------- debian-package/debian/changelog | 11 ++++ debian-package/debian/control | 4 +- debian-package/debian/templates | 10 ++-- debian-package/src/usr/lib/vpn-router/metrics | 2 +- .../src/usr/lib/vpn-router/vpnrouter.py | 2 +- .../vpnrouter_platforms/__init__.py | 2 +- .../vpn-router/vpnrouter_platforms/azure.py | 2 +- .../lib/vpn-router/vpnrouter_platforms/gcp.py | 2 +- .../src/usr/lib/vpn-router/vpnrouter_users.py | 4 +- debian-package/src/usr/lib/vpn-router/web | 12 ++-- examples/azure/variables.tf | 6 +- examples/gcp/variables.tf | 6 +- 14 files changed, 76 insertions(+), 65 deletions(-) diff --git a/ADR.md b/ADR.md index ef6be1a..8405655 100644 --- a/ADR.md +++ b/ADR.md @@ -46,7 +46,7 @@ and as a Tailwind CSS page for a browser, and `/status` is the same status as JS much as `web.status_content` says, since the router is reachable from the internet and the operator decides how much it tells strangers: `basic`, the default because it tells the least, the overall status and the Client IP, `standard` also the package versions and the number of -active and other services, and `full` also each service and the state of the site-to-site, road-warrior, OpenVPN and +active and other services, and `full` also each service and the state of the site-to-site, IKEv2, OpenVPN and WireGuard features. The Client IP is the address the request came from, through the trusted proxies, so a person can see the address the router sees. Nothing comes from the configuration. `/status` names its content, so clients such as manage-ui and the Router Manager show what it @@ -458,7 +458,7 @@ refresh tokens after the operations of `vpnrouter_auth.REVOKING`. Consequences: A Manager-only account cannot become a VPN user, as LDAP cannot change an entry's structural class and its password hash cannot be copied; it is removed and added again instead. -It has no certificate, so OpenVPN and road-warrior access refuse it. The administrator's password +It has no certificate, so OpenVPN and IKEv2 access refuse it. The administrator's password is on disk only until setup has run. ## ADR-19: The package has an LDAP schema of its own under a UUID OID @@ -655,8 +655,8 @@ one, so its name is the one the tunnel always had. - **Local settings per connection:** each connection has its own `local_cidrs` and `local_id_mode`, as each peer expects its own traffic selectors and identity. `wan.local_fqdn` stays the router's one name, used by the `fqdn` mode, resolved once for the `public_ip` mode, - and used by HTTPS, road-warrior and OpenVPN. `local.cidrs` stays the subnets the router - routes, masquerades and offers to road-warrior and OpenVPN clients. + and used by HTTPS, IKEv2 and OpenVPN. `local.cidrs` stays the subnets the router + routes, masquerades and offers to IKEv2 and OpenVPN clients. - **One file:** `vpn-router-setup` writes every connection that is ready to `/etc/swanctl/conf.d/site-to-site.conf`, with the proposals and timers the one tunnel had, and removes the file when none is. The NAT exemptions pair each connection's `local_cidrs` with its @@ -766,9 +766,9 @@ signs the requester's CSR, or makes the key and returns it once in a PKCS#12 fil the certificate, so a key it gave away cannot leak from it later. The PKCS#12 file uses 3DES and SHA-1 MACs, the encryption the key stores of Windows and macOS import. strongSwan reads only the first certificate of a PEM file, so each CA has a file of its own in `/etc/swanctl/x509ca`; -road-warrior and site-to-site name their CA in `cacerts`, which restricts the trust chain to it. +IKEv2 access and site-to-site name their CA in `cacerts`, which restricts the trust chain to it. -Consequences: The P2S CA's certificates are accepted by road-warrior and OpenVPN only, the site-to-site CA's by +Consequences: The P2S CA's certificates are accepted by IKEv2 and OpenVPN only, the site-to-site CA's by site-to-site only. With an offline root, new issuing CAs and the root CRL need the offline step, and a router whose P2S CA waits has no VPN server certificate and so no P2S access. The router keeps the users' keys, as the OpenVPN profile embeds them. @@ -1198,7 +1198,7 @@ resolver share no address. Status: Accepted -Context: macOS, iOS and iPadOS connect to the road-warrior access with their built-in IKEv2 client, +Context: macOS, iOS and iPadOS connect to the IKEv2 access with their built-in IKEv2 client, configured by a configuration profile. The router keeps each user's certificate and key. Apple's clients read a PKCS#12 only when it is encrypted with 3DES and SHA-1, send one proposal per SA, and show an unsigned profile as unverified. @@ -1213,18 +1213,18 @@ Consequences: The password is never stored; the device asks for it when the prof A profile shows as unverified. A changed proposal of `road-warrior.conf` must be changed in the profile too. WireGuard is not part of it. -## ADR-45: Road-warrior clients get split DNS domains, p2s.dns_domains +## ADR-45: IKEv2 clients get split DNS domains, p2s.dns_domains Status: Accepted -Context: The road-warrior access is a split tunnel. macOS and iOS use the DNS server an IKEv2 VPN +Context: The IKEv2 access is a split tunnel. macOS and iOS use the DNS server an IKEv2 VPN pushes only for queries scoped to the tunnel, so names only the router resolves, such as Azure's internal names, fail. RFC 8598 defines INTERNAL_DNS_DOMAIN (attribute 25): the client resolves the listed domains and their subdomains with the VPN's servers. strongSwan's pools take numeric attributes with string values; Apple profiles name such domains in `SupplementalMatchDomains`. Decision: The setting `p2s.dns_domains` lists the domains; setup pushes each as attribute 25 of the -road-warrior pool, and the Apple VPN profile gives them as match domains of the router's resolver, +IKEv2 address pool, and the Apple VPN profile gives them as match domains of the router's resolver, the addresses setup records for the web service. Consequences: Clients resolve the listed domains through the tunnel and everything else with their diff --git a/README.md b/README.md index d292af7..b3bfce7 100644 --- a/README.md +++ b/README.md @@ -3,11 +3,11 @@ A Debian package that configures a Linux host or virtual machine as a VPN router: - site-to-site IKEv2 IPSec with pre-shared key or certificate authentication (strongSwan swanctl) -- road-warrior (P2S) access using IKEv2 EAP-TLS +- IKEv2 access using EAP-TLS - a two-level certificate authority: a root, which may be kept offline, and issuing CAs for the VPN clients, for site-to-site and for general use, with certificate templates, published certificates and CRLs, and an optional ACME server -- OpenVPN (P2S) access with a certificate and a password per user, the users kept in a local +- OpenVPN access with a certificate and a password per user, the users kept in a local LDAP directory and managed with `vpn-router-user` or the web service - optional WireGuard endpoint - routing and NAT for a protected subnet, TCP MSS clamping, and UFW firewall rules @@ -108,15 +108,15 @@ must have the type shown below; an unknown section or setting is an error. | `general` | `mode` | string | `manual` | How much you supply: `manual`, `interfaces` or `auto` | | `interfaces` | `external` | string | | Name of the NIC facing the untrusted network | | `interfaces` | `internal` | string | | Name of the NIC facing the protected network | -| `wan` | `local_fqdn` | string | | This router's name or IP address: its IKE identity in `fqdn` mode, the name resolved in `public_ip` mode, and the name of HTTPS, road-warrior and OpenVPN | -| `local` | `cidrs` | list | | Local subnets routed via the internal side, masqueraded to the external one, and offered to road-warrior and OpenVPN clients | +| `wan` | `local_fqdn` | string | | This router's name or IP address: its IKE identity in `fqdn` mode, the name resolved in `public_ip` mode, and the name of HTTPS, IKEv2 and OpenVPN | +| `local` | `cidrs` | list | | Local subnets routed via the internal side, masqueraded to the external one, and offered to IKEv2 and OpenVPN clients | | `local` | `int_addr` | string | | This host's address on the internal network | | `local` | `int_gateway_ip` | string | | Next hop on the internal side | | `site_to_site` | | object | | The site-to-site connections, each a name and an object of the settings below | -| `p2s` | `enabled` | boolean | `false` | Road-warrior access | -| `p2s` | `address_pool` | string | | CIDR assigned to road-warrior clients | -| `p2s` | `dns_domains` | list | | The domains road-warrior clients resolve with the router's resolver (INTERNAL_DNS_DOMAIN, RFC 8598, and the match domains of the Apple VPN profile), at most 16 | -| `p2s` | `dns_listen` | string | `internal` | The addresses of the resolver the road-warrior, OpenVPN and WireGuard clients are given: `internal`, `external` or `both` | +| `p2s` | `enabled` | boolean | `false` | IKEv2 access | +| `p2s` | `address_pool` | string | | CIDR assigned to IKEv2 clients | +| `p2s` | `dns_domains` | list | | The domains IKEv2 clients resolve with the router's resolver (INTERNAL_DNS_DOMAIN, RFC 8598, and the match domains of the Apple VPN profile), at most 16 | +| `p2s` | `dns_listen` | string | `internal` | The addresses of the resolver the IKEv2, OpenVPN and WireGuard clients are given: `internal`, `external` or `both` | | `wireguard` | `enabled` | boolean | `false` | WireGuard endpoint | | `wireguard` | `address` | string | | The router's own address on `wg0` with the prefix of the peers' network, for example `192.168.200.1/24`; the network and the broadcast address of a network larger than /31 are refused | | `wireguard` | `listen_port` | integer | `51820` | UDP port | @@ -251,9 +251,9 @@ A minimal site-to-site configuration in `auto` mode: The router's IKE identity (`wan.local_fqdn` in `fqdn` mode) and the remote one (`id`) are an FQDN or an IPv4 or IPv6 address. They are written to the strongSwan configuration as given; strongSwan reads an address as an IP identity and a name as an FQDN, so a leading `@` is not needed -and is refused. Road-warrior and OpenVPN access need a name in `wan.local_fqdn`. +and is refused. IKEv2 and OpenVPN access need a name in `wan.local_fqdn`. -WireGuard peers are P2S users' devices: a VPN user of the router's directory may have up to 16 +WireGuard peers are VPN users' devices: a VPN user of the router's directory may have up to 16 peers, each with its public key and its IPs, IPv4 addresses or networks, kept in the user's entry (`vpnRouterWireGuardPeer`) and set with `PUT /users/` (`wireguard_peers`) or on the WireGuard tab of the Router Manager's Remote access management. A key is used by one peer only, @@ -398,7 +398,7 @@ systemctl restart vpn-router-setup The service also runs at boot. With platform `none` it does nothing and says so. Otherwise it regenerates the configuration files, resolves the interfaces and their addresses as `mode` directs, applies routes, generates WireGuard keys and injects -firewall rules. It provisions the user directory in `slapd` while OpenVPN or road-warrior +firewall rules. It provisions the user directory in `slapd` while OpenVPN or IKEv2 access is configured. It then starts `strongswan`, `wg-quick@wg0` and `openvpn-server@vpn-router` if the corresponding feature is configured, reloading or restarting them only when their inputs changed, and @@ -449,7 +449,7 @@ The root signs the issuing CAs only (path length 1), and the issuing CAs sign th (path length 0): - `p2s`, named `pki.p2s_name`, signs the router's VPN server certificate, which IKEv2 and OpenVPN - present, and the users' certificates. Road-warrior and OpenVPN accept client certificates of + present, and the users' certificates. IKEv2 and OpenVPN accept client certificates of this CA only. - `s2s`, named `pki.s2s_name`, signs the router's site-to-site certificate and the certificates of its peers. @@ -652,7 +652,7 @@ certificate names: ### The user directory Once a platform is chosen, `vpn-router-setup` keeps a directory of users in the local slapd, -whether or not OpenVPN or road-warrior access is enabled, so users can be managed before either +whether or not OpenVPN or IKEv2 access is enabled, so users can be managed before either is switched on: - its own database, `dc=vpn-router,dc=local` in `/var/lib/ldap/vpn-router`, next to the one the @@ -773,22 +773,22 @@ When the Router Manager is installed with an administrator (its debconf question Manager-only account, adds it to the group `admins`, which it creates when missing, and removes the file. -The certificate is also accepted by road-warrior (IKEv2 EAP-TLS) access, which checks +The certificate is also accepted by IKEv2 (EAP-TLS) access, which checks certificates only, so `disable` does not affect it; `remove` revokes the certificate for both. ### Apple VPN profile While `p2s.enabled` is `true` and `wan.local_fqdn` is set, `/users//apple-profile` and a user's own `/account/apple-profile` give an unsigned Apple configuration profile (`.mobileconfig`) -that sets up road-warrior access in the built-in VPN client of macOS, iOS and iPadOS. It holds: +that sets up IKEv2 access in the built-in VPN client of macOS, iOS and iPadOS. It holds: - the P2S CA and the root CA, the root installed as a trusted root; - the user's certificate and key as a PKCS#12 encrypted with the password of the request, with 3DES and SHA-1, the only encryption Apple's clients read; the device asks for the password when the profile is installed, and the router does not keep it; - an IKEv2 VPN to `wan.local_fqdn`, with the user name as the local identity, the certificate over - EAP-TLS, and AES-256, SHA2-256 and group 14 for IKE and ESP, as the router's road-warrior - connection takes them; + EAP-TLS, and AES-256, SHA2-256 and group 14 for IKE and ESP, as the router's IKEv2 + connection (`road-warrior`) takes them; - with `p2s.dns_domains`, the router's resolver for those domains and their subdomains (`SupplementalMatchDomains`). macOS and iOS use the DNS server of a VPN that does not carry all traffic only for its match domains. @@ -892,7 +892,7 @@ deploying. which is how a deferred install is expressed. `generic` is the module to choose when the router should be configured but the platform adds nothing. -The shipped modules currently add nothing. Road-warrior, OpenVPN and WireGuard clients are given the +The shipped modules currently add nothing. IKEv2, OpenVPN and WireGuard clients are given the router's addresses of `p2s.dns_listen` as their DNS servers, by default the internal address, the WireGuard clients in the configuration the Router Manager makes for a device (`DNS =`), where `vpn-router-resolver.service`, dnsmasq with `/etc/vpn-router/dnsmasq.conf`, answers and @@ -908,7 +908,7 @@ A module may define any of the following, and takes the default for anything it | Name | Type | Effect | |---|---|---| -| `EXTRA_P2S_DNS` | `str` | added to the road-warrior pool `dns` list | +| `EXTRA_P2S_DNS` | `str` | added to the `dns` list of the IKEv2 address pool | | `EXTRA_LOCAL_TS` | `str` | added to `local_ts` on both connections | | `apply(ctx)` | function | called once the system is configured, to apply platform-specific state; must be idempotent | @@ -941,7 +941,7 @@ configuration: no key, identity, subnet, or address but the client's. They show |---|---| | `basic` (default) | The overall status (`ok` or `degraded`), the time and the Client IP | | `standard` | Also the `vpn-router` version, the `vpn-router-manager` version or that it is not installed, and the number of active services and of services in any other state, without their names | -| `full` | Also each service and its state, Docker, how many site-to-site connections are set up and how many of them are established (`site_to_site`: `connections` and `established`, `null` when swanctl cannot be asked), road-warrior, OpenVPN and WireGuard | +| `full` | Also each service and its state, Docker, how many site-to-site connections are set up and how many of them are established (`site_to_site`: `connections` and `established`, `null` when swanctl cannot be asked), IKEv2, OpenVPN and WireGuard | The Client IP is the address the request came from: the last entry of `X-Forwarded-For` for a request from one of `web.trusted_proxies`, by default the address the request came in on, so @@ -976,7 +976,7 @@ curl http://10.0.0.4:17081/ | `/status` | The same status as JSON | | `/auth` | Signing in with a user's password and TOTP code, refreshing and signing out | | `/config` | The configuration without its secret options, and what the router resolved and runs, as JSON; needs a token | -| `/users` | The users of OpenVPN and road-warrior access; needs a token | +| `/users` | The users of OpenVPN and IKEv2 access; needs a token | | `/service-accounts` | The service accounts; needs a token | | `/groups` | The groups of users; needs a token | | `/site-to-site` | The site-to-site connections: list, add, change and remove; needs a token | @@ -989,14 +989,14 @@ curl http://10.0.0.4:17081/ The status holds the state of `vpn-router-setup`, `slapd` and each PostgreSQL cluster unit (`postgresql@-`, or `postgresql` as `no cluster` without one), of `vpn-router-manager` when that package is installed, of `strongswan` when site-to-site or -road-warrior access is configured, of `wg-quick@wg0` when WireGuard is, and of +IKEv2 access is configured, of `wg-quick@wg0` when WireGuard is, and of `openvpn-server@vpn-router` when OpenVPN is; the number of connected OpenVPN clients, from the server's status file, which OpenVPN rewrites every 5 seconds; the package version and, as `manager_version`, the installed version of `vpn-router-manager` (`null`, shown as not installed, without it); whether Docker is installed, and when it is, the state of `docker.service` and of `vpn-router-docker` (the Docker rules), which do not change `status`; as `site_to_site`, the number of site-to-site connections that are set up (`connections`) and of those established (`established`, `null` when -swanctl cannot be asked), without their names; the number of connected road-warrior (IPsec P2S) clients; and +swanctl cannot be asked), without their names; the number of connected IKEv2 clients; and the WireGuard peers with the age of their last handshake and their traffic. `status` is `ok` when all these services are active, and `degraded` otherwise. @@ -1206,7 +1206,7 @@ and answer bodies are JSON; a request body is at most 65536 bytes. | `POST /users//unlock` | | the user | | `DELETE /users/` | | `{"name", "removed": true}` | | `GET /users//profile` | | `{"name", "profile"}`, the OpenVPN client profile | -| `POST /users//apple-profile` | `{"password"}` | `{"name", "profile"}`, the Apple configuration profile of IKEv2 road-warrior access (see Apple VPN profile) | +| `POST /users//apple-profile` | `{"password"}` | `{"name", "profile"}`, the Apple configuration profile of IKEv2 access (see Apple VPN profile) | | `POST /users//otp` | | `{"name", "secret", "uri"}`, a new TOTP secret; nothing is stored | | `PUT /users//otp` | `{"secret", "code"}` | the user, once the code matches the secret | | `DELETE /users//otp` | | the user | @@ -1216,7 +1216,7 @@ and answer bodies are JSON; a request body is at most 65536 bytes. A failure is `{"error": ...}` with 400 for an invalid request, 404 for a user that does not exist or is a service account, 409 for a user that exists and 500 otherwise. `/users` does not list service accounts; `/service-accounts` serves them. `/users` works whether or not OpenVPN or -road-warrior access is enabled; the profile needs OpenVPN. Passwords, private keys and TOTP +IKEv2 access is enabled; the profile needs OpenVPN. Passwords, private keys and TOTP secrets cross the internal network in plain HTTP, like the token. ```bash @@ -1264,7 +1264,7 @@ router manages them, their display name and description included. A failure is o | `PUT /account/passkeys` | `{"id", "credential", "label"?}`, `credential` the browser's answer as its `toJSON()` gives it; `label` at most 64 characters, `Passkey` without one | the user | | `DELETE /account/passkeys/` | | the user | | `POST /account/profile` | `{"current_password", "current_code"}` | `{"name", "profile"}`, the user's OpenVPN client profile | -| `POST /account/apple-profile` | `{"current_password", "current_code", "password"}` | `{"name", "profile"}`, the user's Apple configuration profile of IKEv2 road-warrior access (see Apple VPN profile) | +| `POST /account/apple-profile` | `{"current_password", "current_code", "password"}` | `{"name", "profile"}`, the user's Apple configuration profile of IKEv2 access (see Apple VPN profile) | `current_code` is needed only for a user enrolled for TOTP; removing a passkey needs neither. A wrong current password or code gets 403 and counts as a failed login; slapd accepts each code once, so a code used to sign in is not @@ -1334,7 +1334,7 @@ A change is made, checked and applied as for `/site-to-site`. ### The /remote-access API -`/remote-access` shows and changes the remote access systems, IKEv2 road-warrior (`p2s`), +`/remote-access` shows and changes the remote access systems, IKEv2 (`p2s`), OpenVPN (`openvpn`) and WireGuard (`wireguard`), with the same token as `/users`. | Request | Body | Answer | @@ -1615,7 +1615,7 @@ The domains are added with `/dns` or the Router Manager, each with: A domain inside another domain of the router is delegated from it with NS records. Setup writes the domains at each run, and after each change through `/dns`; the SOA's serial grows only when the -records change. While P2S, OpenVPN or WireGuard is enabled, dnsmasq answers their clients on port 53 +records change. While IKEv2, OpenVPN or WireGuard is enabled, dnsmasq answers their clients on port 53 of the addresses of `p2s.dns_listen`, by default the internal address, so `dns.listen` must not share an interface with it. The parent zone of each domain must delegate it to `dns.nameserver` and the secondaries, with glue records for name servers inside the domain. @@ -1636,7 +1636,7 @@ takes a sample of the router with `psutil`: - the free and the total space of `/`; - the bytes received and sent per second on the external and the internal interface; - the 1, 5 and 15 minute load averages; -- the VPN clients of each enabled VPN system: road-warrior (IPsec P2S) and OpenVPN clients, and +- the VPN clients of each enabled VPN system: IKEv2 and OpenVPN clients, and WireGuard peers with a handshake in the last 3 minutes; - for each site-to-site connection that is set up: whether it is up (1 or 0), the bytes and the packets per second received and sent through its child SAs since the previous sample, and the diff --git a/debian-package/debian/changelog b/debian-package/debian/changelog index 066334c..5c5c42f 100644 --- a/debian-package/debian/changelog +++ b/debian-package/debian/changelog @@ -1,3 +1,14 @@ +vpn-router (0.33.2-1) unstable; urgency=medium + + fix: the router's IPsec remote access is called IKEv2 instead of road-warrior. + + * The README, the package description, the installer's questions, the + status page, the messages of the web service and the examples say + IKEv2 access and IKEv2 clients; the strongSwan connection keeps its + name, road-warrior. + + -- Slawomir Koszewski Tue, 27 Oct 2026 23:00:00 +0100 + vpn-router (0.33.1-1) unstable; urgency=medium fix: the name server is the primary of any number of domains, each with secondary name servers and a switch for the records of the sites. diff --git a/debian-package/debian/control b/debian-package/debian/control index 1a6c87e..7df9cfd 100644 --- a/debian-package/debian/control +++ b/debian-package/debian/control @@ -46,10 +46,10 @@ Suggests: caddy, pdns-server, pdns-backend-pgsql, proxmox-backup-client-static -Description: Linux VPN router with IPSec, road-warrior, OpenVPN and WireGuard support +Description: Linux VPN router with IPSec, IKEv2, OpenVPN and WireGuard support Configures a Linux host or virtual machine as a VPN router: site-to-site IKEv2 IPSec (strongSwan swanctl) with pre-shared keys or certificates, - optional road-warrior access using EAP-TLS, optional OpenVPN with a + optional IKEv2 access using EAP-TLS, optional OpenVPN with a certificate and a password per user, kept in a local LDAP directory, optional WireGuard, and the routing, NAT, MSS clamping and firewall rules a router needs. Its two-level CA, whose root may be kept offline, has issuing CAs for diff --git a/debian-package/debian/templates b/debian-package/debian/templates index 6f23051..3db0fca 100644 --- a/debian-package/debian/templates +++ b/debian-package/debian/templates @@ -4,7 +4,7 @@ Choices: none, generic, azure, gcp Default: none Description: Platform: Which platform this router runs on. The choice loads platform-specific - additions, such as the provider DNS resolver for road-warrior clients. + additions, such as the provider DNS resolver for IKEv2 clients. . none defers configuration entirely: the package installs its files and changes nothing on the machine. Choose it when the router will be configured @@ -58,7 +58,7 @@ Type: string Default: Description: Local router FQDN: Fully-qualified domain name of this router (for example - router.example.com). Used as the road-warrior server identity and + router.example.com). Used as the IKEv2 server identity and certificate common name. Template: vpn-router/local_id_mode @@ -122,15 +122,15 @@ Description: Pre-shared key (PSK): Template: vpn-router/p2s_enabled Type: boolean Default: false -Description: Enable road-warrior (P2S) access? +Description: Enable IKEv2 access? If enabled, this router accepts IKEv2 EAP-TLS connections from individual clients, with certificates of the router's P2S issuing CA. Template: vpn-router/p2s_address_pool Type: string Default: -Description: Road-warrior address pool: - CIDR block assigned to road-warrior clients (for example 172.16.0.0/24). +Description: IKEv2 address pool: + CIDR block assigned to IKEv2 clients (for example 172.16.0.0/24). Template: vpn-router/pki_root_name Type: string diff --git a/debian-package/src/usr/lib/vpn-router/metrics b/debian-package/src/usr/lib/vpn-router/metrics index 667f21e..ac54e69 100755 --- a/debian-package/src/usr/lib/vpn-router/metrics +++ b/debian-package/src/usr/lib/vpn-router/metrics @@ -7,7 +7,7 @@ disables the unit. Every SAMPLE_SECONDS, on the minute, a sample is taken with psutil: the CPU utilization since the previous sample, the memory used and in total, the free and the total space of /, the bytes received and sent per second on the external and the internal interface, and the load averages; -and the VPN clients of each enabled VPN system (vpnrouter_status): road-warrior (p2s) and +and the VPN clients of each enabled VPN system (vpnrouter_status): IKEv2 (p2s) and OpenVPN clients and WireGuard peers with a recent handshake; and of each site-to-site connection that is set up, whether it is up, the bytes and packets per second through its child SAs since the previous sample, and how long its IKE SA has been up. The interfaces, the enabled systems and diff --git a/debian-package/src/usr/lib/vpn-router/vpnrouter.py b/debian-package/src/usr/lib/vpn-router/vpnrouter.py index 3de675a..47d028c 100644 --- a/debian-package/src/usr/lib/vpn-router/vpnrouter.py +++ b/debian-package/src/usr/lib/vpn-router/vpnrouter.py @@ -1063,7 +1063,7 @@ def routing_ready(ctx): def p2s_ready(ctx): - """Road-warrior access needs its settings and the router's VPN server certificate, which the P2S CA issues.""" + """IKEv2 access needs its settings and the router's VPN server certificate, which the P2S CA issues.""" return bool(ctx['p2s_enabled'] and ctx['p2s_address_pool'] and ctx['local_fqdn'] and ctx['server_certificate']) diff --git a/debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/__init__.py b/debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/__init__.py index 6f927ad..7fe6243 100644 --- a/debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/__init__.py +++ b/debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/__init__.py @@ -10,7 +10,7 @@ adding one file here. Nothing in the core has to be edited. A module may define any of: - EXTRA_P2S_DNS str, added to the road-warrior pool 'dns' list + EXTRA_P2S_DNS str, added to the 'dns' list of the IKEv2 address pool EXTRA_LOCAL_TS str, added to 'local_ts' on both connections apply(ctx) called once the system has been configured, to apply platform-specific state. Must be idempotent. ctx is the diff --git a/debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/azure.py b/debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/azure.py index 755b360..39952a9 100644 --- a/debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/azure.py +++ b/debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/azure.py @@ -3,7 +3,7 @@ No platform-specific configuration is currently required. The Azure platform resolver 168.63.129.16 is deliberately *not* advertised to -road-warrior clients and *not* added to the traffic selectors. Clients are +IKEv2 clients and *not* added to the traffic selectors. Clients are given the router's addresses of p2s.dns_listen as their DNS servers, where dnsmasq forwards to the router's own systemd-resolved. That resolves Azure-internal names without routing the wireserver address through the tunnel diff --git a/debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/gcp.py b/debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/gcp.py index 112b312..513b139 100644 --- a/debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/gcp.py +++ b/debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/gcp.py @@ -2,7 +2,7 @@ No platform-specific configuration is currently required. -As on Azure, road-warrior clients are given the router itself as their DNS +As on Azure, IKEv2 clients are given the router itself as their DNS server and the router forwards through its own systemd-resolved, so the metadata resolver does not belong in the pool or in the traffic selectors. """ diff --git a/debian-package/src/usr/lib/vpn-router/vpnrouter_users.py b/debian-package/src/usr/lib/vpn-router/vpnrouter_users.py index dae05d3..09de200 100644 --- a/debian-package/src/usr/lib/vpn-router/vpnrouter_users.py +++ b/debian-package/src/usr/lib/vpn-router/vpnrouter_users.py @@ -814,7 +814,7 @@ def profile(connection, name): def apple_profile(connection, name, password): - """The Apple configuration profile (.mobileconfig, unsigned) of the user's IKEv2 road-warrior access: the root CA and + """The Apple configuration profile (.mobileconfig, unsigned) of the user's IKEv2 access: the root CA and the P2S CA, the user's certificate and key as a PKCS#12 encrypted with the password, and the VPN. The connection matches road-warrior.conf: the router's wan.local_fqdn as address and identity, the user name, a @@ -828,7 +828,7 @@ def apple_profile(connection, name, password): cfg = vpnrouter.load_config() fqdn = cfg['wan']['local_fqdn'].strip() if not cfg['p2s']['enabled'] or not fqdn: - raise Failure('IKEv2 road-warrior access is not enabled', 2) + raise Failure('IKEv2 access is not enabled', 2) credentials = vpnrouter_pki.user_credentials(name) if credentials is None: raise Failure(f'user {name} has no certificate') diff --git a/debian-package/src/usr/lib/vpn-router/web b/debian-package/src/usr/lib/vpn-router/web index 8e96898..e8bc4c2 100644 --- a/debian-package/src/usr/lib/vpn-router/web +++ b/debian-package/src/usr/lib/vpn-router/web @@ -29,7 +29,7 @@ Pages: /backup the backup settings, the last run and the local archives: show, change and run now (see backup()) /remote-access - the settings of IKEv2 road-warrior, OpenVPN and WireGuard access and whether each + the settings of IKEv2, OpenVPN and WireGuard access and whether each runs: show and change, applied by vpn-router-setup (see remote_access()) /ca the PKI: its settings, the root and issuing CAs, the certificates issued; change the settings, issue and revoke certificates, and take the certificate of an issuing CA @@ -79,7 +79,7 @@ default, the overall status, the time and the client's address (its address as f below); standard also the package version, the installed version of vpn-router-manager (manager_version, null when it is not installed) and the number of active and other services; full whether each service runs, whether Docker is installed, how many of the site-to-site connections are established -(site_to_site: connections and established, null when swanctl cannot be asked), and road-warrior (IPsec P2S), OpenVPN +(site_to_site: connections and established, null when swanctl cannot be asked), and IKEv2, OpenVPN and WireGuard. No configuration data, key or connection name is shown, and no address but the client's. The service first initializes, without listening: it makes the signing key, the OpenID Provider's key @@ -184,7 +184,7 @@ BODY_LIMIT = 65536 #: The settings of a site_to_site connection that /site-to-site adds and changes. CONNECTION_SETTINGS = ('addrs', 'id', 'cidrs', 'local_cidrs', 'local_id_mode', 'auth', 'psk', 'remote_ca') -#: The sections of the remote access systems /remote-access changes: IKEv2 road-warrior, OpenVPN and WireGuard. +#: The sections of the remote access systems /remote-access changes: IKEv2, OpenVPN and WireGuard. REMOTE_ACCESS = ('p2s', 'openvpn', 'wireguard') #: The HTTP status for each status of a vpnrouter_users.Failure; any other is 500. @@ -490,7 +490,7 @@ def text_of(status): lines.append(f'Site to site: {"unknown" if established is None else established} of {connections} established') if 'p2s' in status: clients = status['p2s']['clients'] - lines.append(f'Road-warrior (IPsec P2S): {"unknown" if clients is None else f"{clients} connected"}') + lines.append(f'IKEv2: {"unknown" if clients is None else f"{clients} connected"}') if 'openvpn' in status: clients = status['openvpn']['clients'] lines.append(f'OpenVPN: {"unknown" if clients is None else f"{clients} connected"}') @@ -566,7 +566,7 @@ def users(state, method, path, body): DELETE /users/ remove the user and revoke the certificate GET /users//profile the OpenVPN client profile POST /users//apple-profile - the Apple configuration profile of IKEv2 road-warrior access: {"password"}, which + the Apple configuration profile of IKEv2 access: {"password"}, which encrypts the user's key in it; {"name", "profile"} POST /users//otp a new TOTP secret and its otpauth URI; nothing is stored PUT /users//otp store a TOTP secret: {"secret", "code"}, code a code of the secret @@ -1051,7 +1051,7 @@ def account(name, method, path, body): POST /account/profile the user's OpenVPN client profile: {"current_password", "current_code"?}; {"name", "profile"} POST /account/apple-profile - the user's Apple configuration profile of IKEv2 road-warrior access: + the user's Apple configuration profile of IKEv2 access: {"current_password", "current_code"?, "password"}, password encrypting the user's key in it; {"name", "profile"} diff --git a/examples/azure/variables.tf b/examples/azure/variables.tf index 162a95c..5195342 100644 --- a/examples/azure/variables.tf +++ b/examples/azure/variables.tf @@ -45,7 +45,7 @@ variable "vm_size" { } variable "local_fqdn" { - description = "FQDN of the router, used as the road-warrior/IKE identity and, when dns_zone_id is set, as the name of the A record created for it." + description = "FQDN of the router, used as the IKE identity and, when dns_zone_id is set, as the name of the A record created for it." type = string } @@ -89,13 +89,13 @@ variable "psk" { } variable "p2s_enabled" { - description = "Enable road-warrior (P2S) access." + description = "Enable IKEv2 access." type = bool default = false } variable "p2s_address_pool" { - description = "CIDR block assigned to road-warrior clients." + description = "CIDR block assigned to IKEv2 clients." type = string default = "" } diff --git a/examples/gcp/variables.tf b/examples/gcp/variables.tf index b17c19c..7ce5499 100644 --- a/examples/gcp/variables.tf +++ b/examples/gcp/variables.tf @@ -37,7 +37,7 @@ variable "machine_type" { } variable "local_fqdn" { - description = "FQDN of the router, used as the road-warrior/IKE identity and, when dns_managed_zone is set, as the name of the A record created for it." + description = "FQDN of the router, used as the IKE identity and, when dns_managed_zone is set, as the name of the A record created for it." type = string } @@ -86,13 +86,13 @@ variable "psk" { } variable "p2s_enabled" { - description = "Enable road-warrior (P2S) access." + description = "Enable IKEv2 access." type = bool default = false } variable "p2s_address_pool" { - description = "CIDR block assigned to road-warrior clients." + description = "CIDR block assigned to IKEv2 clients." type = string default = "" }