fix: the router's IPsec remote access is called IKEv2 instead of road-warrior.

ADR.md

@@ -46,7 +46,7 @@ and as a Tailwind CSS page for a browser, and `/status` is the same status as JS
 much as `web.status_content` says, since the router is reachable from the internet and the
 operator decides how much it tells strangers: `basic`, the default because it tells the least,
 the overall status and the Client IP, `standard` also the package versions and the number of
-active and other services, and `full` also each service and the state of the site-to-site, road-warrior, OpenVPN and
+active and other services, and `full` also each service and the state of the site-to-site, IKEv2, OpenVPN and
 WireGuard features. The Client IP is the address the request came from, through the trusted
 proxies, so a person can see the address the router sees. Nothing comes from the configuration.
 `/status` names its content, so clients such as manage-ui and the Router Manager show what it
@@ -458,7 +458,7 @@ refresh tokens after the operations of `vpnrouter_auth.REVOKING`.
 
 Consequences: A Manager-only account cannot become a VPN user, as LDAP cannot change an entry's
 structural class and its password hash cannot be copied; it is removed and added again instead.
-It has no certificate, so OpenVPN and road-warrior access refuse it. The administrator's password
+It has no certificate, so OpenVPN and IKEv2 access refuse it. The administrator's password
 is on disk only until setup has run.
 
 ## ADR-19: The package has an LDAP schema of its own under a UUID OID
@@ -655,8 +655,8 @@ one, so its name is the one the tunnel always had.
 - **Local settings per connection:** each connection has its own `local_cidrs` and
   `local_id_mode`, as each peer expects its own traffic selectors and identity. `wan.local_fqdn`
   stays the router's one name, used by the `fqdn` mode, resolved once for the `public_ip` mode,
-  and used by HTTPS, road-warrior and OpenVPN. `local.cidrs` stays the subnets the router
+  and used by HTTPS, IKEv2 and OpenVPN. `local.cidrs` stays the subnets the router
-  routes, masquerades and offers to road-warrior and OpenVPN clients.
+  routes, masquerades and offers to IKEv2 and OpenVPN clients.
 - **One file:** `vpn-router-setup` writes every connection that is ready to
   `/etc/swanctl/conf.d/site-to-site.conf`, with the proposals and timers the one tunnel had, and
   removes the file when none is. The NAT exemptions pair each connection's `local_cidrs` with its
@@ -766,9 +766,9 @@ signs the requester's CSR, or makes the key and returns it once in a PKCS#12 fil
 the certificate, so a key it gave away cannot leak from it later. The PKCS#12 file uses 3DES and
 SHA-1 MACs, the encryption the key stores of Windows and macOS import. strongSwan reads only the
 first certificate of a PEM file, so each CA has a file of its own in `/etc/swanctl/x509ca`;
-road-warrior and site-to-site name their CA in `cacerts`, which restricts the trust chain to it.
+IKEv2 access and site-to-site name their CA in `cacerts`, which restricts the trust chain to it.
 
-Consequences: The P2S CA's certificates are accepted by road-warrior and OpenVPN only, the site-to-site CA's by
+Consequences: The P2S CA's certificates are accepted by IKEv2 and OpenVPN only, the site-to-site CA's by
 site-to-site only. With an offline root, new issuing CAs and the root CRL need the offline step,
 and a router whose P2S CA waits has no VPN server certificate and so no P2S access. The router
 keeps the users' keys, as the OpenVPN profile embeds them.
@@ -1198,7 +1198,7 @@ resolver share no address.
 
 Status: Accepted
 
-Context: macOS, iOS and iPadOS connect to the road-warrior access with their built-in IKEv2 client,
+Context: macOS, iOS and iPadOS connect to the IKEv2 access with their built-in IKEv2 client,
 configured by a configuration profile. The router keeps each user's certificate and key. Apple's
 clients read a PKCS#12 only when it is encrypted with 3DES and SHA-1, send one proposal per SA,
 and show an unsigned profile as unverified.
@@ -1213,18 +1213,18 @@ Consequences: The password is never stored; the device asks for it when the prof
 A profile shows as unverified. A changed proposal of `road-warrior.conf` must be changed in the
 profile too. WireGuard is not part of it.
 
-## ADR-45: Road-warrior clients get split DNS domains, p2s.dns_domains
+## ADR-45: IKEv2 clients get split DNS domains, p2s.dns_domains
 
 Status: Accepted
 
-Context: The road-warrior access is a split tunnel. macOS and iOS use the DNS server an IKEv2 VPN
+Context: The IKEv2 access is a split tunnel. macOS and iOS use the DNS server an IKEv2 VPN
 pushes only for queries scoped to the tunnel, so names only the router resolves, such as Azure's
 internal names, fail. RFC 8598 defines INTERNAL_DNS_DOMAIN (attribute 25): the client resolves the
 listed domains and their subdomains with the VPN's servers. strongSwan's pools take numeric
 attributes with string values; Apple profiles name such domains in `SupplementalMatchDomains`.
 
 Decision: The setting `p2s.dns_domains` lists the domains; setup pushes each as attribute 25 of the
-road-warrior pool, and the Apple VPN profile gives them as match domains of the router's resolver,
+IKEv2 address pool, and the Apple VPN profile gives them as match domains of the router's resolver,
 the addresses setup records for the web service.
 
 Consequences: Clients resolve the listed domains through the tunnel and everything else with their

README.md

@@ -3,11 +3,11 @@
 A Debian package that configures a Linux host or virtual machine as a VPN router:
 
 - site-to-site IKEv2 IPSec with pre-shared key or certificate authentication (strongSwan swanctl)
-- road-warrior (P2S) access using IKEv2 EAP-TLS
+- IKEv2 access using EAP-TLS
 - a two-level certificate authority: a root, which may be kept offline, and issuing CAs for the VPN
   clients, for site-to-site and for general use, with certificate templates, published certificates
   and CRLs, and an optional ACME server
-- OpenVPN (P2S) access with a certificate and a password per user, the users kept in a local
+- OpenVPN access with a certificate and a password per user, the users kept in a local
   LDAP directory and managed with `vpn-router-user` or the web service
 - optional WireGuard endpoint
 - routing and NAT for a protected subnet, TCP MSS clamping, and UFW firewall rules
@@ -108,15 +108,15 @@ must have the type shown below; an unknown section or setting is an error.
 | `general` | `mode` | string | `manual` | How much you supply: `manual`, `interfaces` or `auto` |
 | `interfaces` | `external` | string | | Name of the NIC facing the untrusted network |
 | `interfaces` | `internal` | string | | Name of the NIC facing the protected network |
-| `wan` | `local_fqdn` | string | | This router's name or IP address: its IKE identity in `fqdn` mode, the name resolved in `public_ip` mode, and the name of HTTPS, road-warrior and OpenVPN |
+| `wan` | `local_fqdn` | string | | This router's name or IP address: its IKE identity in `fqdn` mode, the name resolved in `public_ip` mode, and the name of HTTPS, IKEv2 and OpenVPN |
-| `local` | `cidrs` | list | | Local subnets routed via the internal side, masqueraded to the external one, and offered to road-warrior and OpenVPN clients |
+| `local` | `cidrs` | list | | Local subnets routed via the internal side, masqueraded to the external one, and offered to IKEv2 and OpenVPN clients |
 | `local` | `int_addr` | string | | This host's address on the internal network |
 | `local` | `int_gateway_ip` | string | | Next hop on the internal side |
 | `site_to_site` | | object | | The site-to-site connections, each a name and an object of the settings below |
-| `p2s` | `enabled` | boolean | `false` | Road-warrior access |
+| `p2s` | `enabled` | boolean | `false` | IKEv2 access |
-| `p2s` | `address_pool` | string | | CIDR assigned to road-warrior clients |
+| `p2s` | `address_pool` | string | | CIDR assigned to IKEv2 clients |
-| `p2s` | `dns_domains` | list | | The domains road-warrior clients resolve with the router's resolver (INTERNAL_DNS_DOMAIN, RFC 8598, and the match domains of the Apple VPN profile), at most 16 |
+| `p2s` | `dns_domains` | list | | The domains IKEv2 clients resolve with the router's resolver (INTERNAL_DNS_DOMAIN, RFC 8598, and the match domains of the Apple VPN profile), at most 16 |
-| `p2s` | `dns_listen` | string | `internal` | The addresses of the resolver the road-warrior, OpenVPN and WireGuard clients are given: `internal`, `external` or `both` |
+| `p2s` | `dns_listen` | string | `internal` | The addresses of the resolver the IKEv2, OpenVPN and WireGuard clients are given: `internal`, `external` or `both` |
 | `wireguard` | `enabled` | boolean | `false` | WireGuard endpoint |
 | `wireguard` | `address` | string | | The router's own address on `wg0` with the prefix of the peers' network, for example `192.168.200.1/24`; the network and the broadcast address of a network larger than /31 are refused |
 | `wireguard` | `listen_port` | integer | `51820` | UDP port |
@@ -251,9 +251,9 @@ A minimal site-to-site configuration in `auto` mode:
 The router's IKE identity (`wan.local_fqdn` in `fqdn` mode) and the remote one (`id`) are
 an FQDN or an IPv4 or IPv6 address. They are written to the strongSwan configuration as given;
 strongSwan reads an address as an IP identity and a name as an FQDN, so a leading `@` is not needed
-and is refused. Road-warrior and OpenVPN access need a name in `wan.local_fqdn`.
+and is refused. IKEv2 and OpenVPN access need a name in `wan.local_fqdn`.
 
-WireGuard peers are P2S users' devices: a VPN user of the router's directory may have up to 16
+WireGuard peers are VPN users' devices: a VPN user of the router's directory may have up to 16
 peers, each with its public key and its IPs, IPv4 addresses or networks, kept in the user's
 entry (`vpnRouterWireGuardPeer`) and set with `PUT /users/<name>` (`wireguard_peers`) or on the
 WireGuard tab of the Router Manager's Remote access management. A key is used by one peer only,
@@ -398,7 +398,7 @@ systemctl restart vpn-router-setup
 The service also runs at boot. With platform `none` it does nothing and says so.
 Otherwise it regenerates the configuration files, resolves the interfaces and their
 addresses as `mode` directs, applies routes, generates WireGuard keys and injects
-firewall rules. It provisions the user directory in `slapd` while OpenVPN or road-warrior
+firewall rules. It provisions the user directory in `slapd` while OpenVPN or IKEv2
 access is configured. It then starts `strongswan`, `wg-quick@wg0` and
 `openvpn-server@vpn-router` if the corresponding feature is configured, reloading or
 restarting them only when their inputs changed, and
@@ -449,7 +449,7 @@ The root signs the issuing CAs only (path length 1), and the issuing CAs sign th
 (path length 0):
 
 - `p2s`, named `pki.p2s_name`, signs the router's VPN server certificate, which IKEv2 and OpenVPN
-  present, and the users' certificates. Road-warrior and OpenVPN accept client certificates of
+  present, and the users' certificates. IKEv2 and OpenVPN accept client certificates of
   this CA only.
 - `s2s`, named `pki.s2s_name`, signs the router's site-to-site certificate and the certificates
   of its peers.
@@ -652,7 +652,7 @@ certificate names:
 ### The user directory
 
 Once a platform is chosen, `vpn-router-setup` keeps a directory of users in the local slapd,
-whether or not OpenVPN or road-warrior access is enabled, so users can be managed before either
+whether or not OpenVPN or IKEv2 access is enabled, so users can be managed before either
 is switched on:
 
 - its own database, `dc=vpn-router,dc=local` in `/var/lib/ldap/vpn-router`, next to the one the
@@ -773,22 +773,22 @@ When the Router Manager is installed with an administrator (its debconf question
 Manager-only account, adds it to the group `admins`, which it creates when missing, and removes
 the file.
 
-The certificate is also accepted by road-warrior (IKEv2 EAP-TLS) access, which checks
+The certificate is also accepted by IKEv2 (EAP-TLS) access, which checks
 certificates only, so `disable` does not affect it; `remove` revokes the certificate for both.
 
 ### Apple VPN profile
 
 While `p2s.enabled` is `true` and `wan.local_fqdn` is set, `/users/<name>/apple-profile` and a
 user's own `/account/apple-profile` give an unsigned Apple configuration profile (`.mobileconfig`)
-that sets up road-warrior access in the built-in VPN client of macOS, iOS and iPadOS. It holds:
+that sets up IKEv2 access in the built-in VPN client of macOS, iOS and iPadOS. It holds:
 
 - the P2S CA and the root CA, the root installed as a trusted root;
 - the user's certificate and key as a PKCS#12 encrypted with the password of the request, with
   3DES and SHA-1, the only encryption Apple's clients read; the device asks for the password when
   the profile is installed, and the router does not keep it;
 - an IKEv2 VPN to `wan.local_fqdn`, with the user name as the local identity, the certificate over
-  EAP-TLS, and AES-256, SHA2-256 and group 14 for IKE and ESP, as the router's road-warrior
+  EAP-TLS, and AES-256, SHA2-256 and group 14 for IKE and ESP, as the router's IKEv2
-  connection takes them;
+  connection (`road-warrior`) takes them;
 - with `p2s.dns_domains`, the router's resolver for those domains and their subdomains
   (`SupplementalMatchDomains`). macOS and iOS use the DNS server of a VPN that does not carry all
   traffic only for its match domains.
@@ -892,7 +892,7 @@ deploying.
 which is how a deferred install is expressed. `generic` is the module to choose when the
 router should be configured but the platform adds nothing.
 
-The shipped modules currently add nothing. Road-warrior, OpenVPN and WireGuard clients are given the
+The shipped modules currently add nothing. IKEv2, OpenVPN and WireGuard clients are given the
 router's addresses of `p2s.dns_listen` as their DNS servers, by default the internal address,
 the WireGuard clients in the configuration the Router Manager makes for a device (`DNS =`),
 where `vpn-router-resolver.service`, dnsmasq with `/etc/vpn-router/dnsmasq.conf`, answers and
@@ -908,7 +908,7 @@ A module may define any of the following, and takes the default for anything it
 
 | Name | Type | Effect |
 |---|---|---|
-| `EXTRA_P2S_DNS` | `str` | added to the road-warrior pool `dns` list |
+| `EXTRA_P2S_DNS` | `str` | added to the `dns` list of the IKEv2 address pool |
 | `EXTRA_LOCAL_TS` | `str` | added to `local_ts` on both connections |
 | `apply(ctx)` | function | called once the system is configured, to apply platform-specific state; must be idempotent |
 
@@ -941,7 +941,7 @@ configuration: no key, identity, subnet, or address but the client's. They show
 |---|---|
 | `basic` (default) | The overall status (`ok` or `degraded`), the time and the Client IP |
 | `standard` | Also the `vpn-router` version, the `vpn-router-manager` version or that it is not installed, and the number of active services and of services in any other state, without their names |
-| `full` | Also each service and its state, Docker, how many site-to-site connections are set up and how many of them are established (`site_to_site`: `connections` and `established`, `null` when swanctl cannot be asked), road-warrior, OpenVPN and WireGuard |
+| `full` | Also each service and its state, Docker, how many site-to-site connections are set up and how many of them are established (`site_to_site`: `connections` and `established`, `null` when swanctl cannot be asked), IKEv2, OpenVPN and WireGuard |
 
 The Client IP is the address the request came from: the last entry of `X-Forwarded-For` for a
 request from one of `web.trusted_proxies`, by default the address the request came in on, so
@@ -976,7 +976,7 @@ curl http://10.0.0.4:17081/
 | `/status` | The same status as JSON |
 | `/auth` | Signing in with a user's password and TOTP code, refreshing and signing out |
 | `/config` | The configuration without its secret options, and what the router resolved and runs, as JSON; needs a token |
-| `/users` | The users of OpenVPN and road-warrior access; needs a token |
+| `/users` | The users of OpenVPN and IKEv2 access; needs a token |
 | `/service-accounts` | The service accounts; needs a token |
 | `/groups` | The groups of users; needs a token |
 | `/site-to-site` | The site-to-site connections: list, add, change and remove; needs a token |
@@ -989,14 +989,14 @@ curl http://10.0.0.4:17081/
 The status holds the state of `vpn-router-setup`, `slapd` and each PostgreSQL cluster unit
 (`postgresql@<version>-<cluster>`, or `postgresql` as `no cluster` without one), of
 `vpn-router-manager` when that package is installed, of `strongswan` when site-to-site or
-road-warrior access is configured, of `wg-quick@wg0` when WireGuard is, and of
+IKEv2 access is configured, of `wg-quick@wg0` when WireGuard is, and of
 `openvpn-server@vpn-router` when OpenVPN is; the number of connected
 OpenVPN clients, from the server's status file, which OpenVPN rewrites every 5 seconds; the package version and,
 as `manager_version`, the installed version of `vpn-router-manager` (`null`, shown as not installed, without it); whether
 Docker is installed, and when it is, the state of `docker.service` and of `vpn-router-docker`
 (the Docker rules), which do not change `status`; as `site_to_site`, the number of site-to-site
 connections that are set up (`connections`) and of those established (`established`, `null` when
-swanctl cannot be asked), without their names; the number of connected road-warrior (IPsec P2S) clients; and
+swanctl cannot be asked), without their names; the number of connected IKEv2 clients; and
 the WireGuard peers with the age of their last handshake and their traffic. `status` is `ok` when
 all these services are active, and `degraded` otherwise.
 
@@ -1206,7 +1206,7 @@ and answer bodies are JSON; a request body is at most 65536 bytes.
 | `POST /users/<name>/unlock` | | the user |
 | `DELETE /users/<name>` | | `{"name", "removed": true}` |
 | `GET /users/<name>/profile` | | `{"name", "profile"}`, the OpenVPN client profile |
-| `POST /users/<name>/apple-profile` | `{"password"}` | `{"name", "profile"}`, the Apple configuration profile of IKEv2 road-warrior access (see Apple VPN profile) |
+| `POST /users/<name>/apple-profile` | `{"password"}` | `{"name", "profile"}`, the Apple configuration profile of IKEv2 access (see Apple VPN profile) |
 | `POST /users/<name>/otp` | | `{"name", "secret", "uri"}`, a new TOTP secret; nothing is stored |
 | `PUT /users/<name>/otp` | `{"secret", "code"}` | the user, once the code matches the secret |
 | `DELETE /users/<name>/otp` | | the user |
@@ -1216,7 +1216,7 @@ and answer bodies are JSON; a request body is at most 65536 bytes.
 A failure is `{"error": ...}` with 400 for an invalid request, 404 for a user that does not
 exist or is a service account, 409 for a user that exists and 500 otherwise. `/users` does not
 list service accounts; `/service-accounts` serves them. `/users` works whether or not OpenVPN or
-road-warrior access is enabled; the profile needs OpenVPN. Passwords, private keys and TOTP
+IKEv2 access is enabled; the profile needs OpenVPN. Passwords, private keys and TOTP
 secrets cross the internal network in plain HTTP, like the token.
 
 ```bash
@@ -1264,7 +1264,7 @@ router manages them, their display name and description included. A failure is o
 | `PUT /account/passkeys` | `{"id", "credential", "label"?}`, `credential` the browser's answer as its `toJSON()` gives it; `label` at most 64 characters, `Passkey` without one | the user |
 | `DELETE /account/passkeys/<id>` | | the user |
 | `POST /account/profile` | `{"current_password", "current_code"}` | `{"name", "profile"}`, the user's OpenVPN client profile |
-| `POST /account/apple-profile` | `{"current_password", "current_code", "password"}` | `{"name", "profile"}`, the user's Apple configuration profile of IKEv2 road-warrior access (see Apple VPN profile) |
+| `POST /account/apple-profile` | `{"current_password", "current_code", "password"}` | `{"name", "profile"}`, the user's Apple configuration profile of IKEv2 access (see Apple VPN profile) |
 
 `current_code` is needed only for a user enrolled for TOTP; removing a passkey needs neither. A wrong current password or code gets
 403 and counts as a failed login; slapd accepts each code once, so a code used to sign in is not
@@ -1334,7 +1334,7 @@ A change is made, checked and applied as for `/site-to-site`.
 
 ### The /remote-access API
 
-`/remote-access` shows and changes the remote access systems, IKEv2 road-warrior (`p2s`),
+`/remote-access` shows and changes the remote access systems, IKEv2 (`p2s`),
 OpenVPN (`openvpn`) and WireGuard (`wireguard`), with the same token as `/users`.
 
 | Request | Body | Answer |
@@ -1615,7 +1615,7 @@ The domains are added with `/dns` or the Router Manager, each with:
 
 A domain inside another domain of the router is delegated from it with NS records. Setup writes the
 domains at each run, and after each change through `/dns`; the SOA's serial grows only when the
-records change. While P2S, OpenVPN or WireGuard is enabled, dnsmasq answers their clients on port 53
+records change. While IKEv2, OpenVPN or WireGuard is enabled, dnsmasq answers their clients on port 53
 of the addresses of `p2s.dns_listen`, by default the internal address, so `dns.listen` must not
 share an interface with it. The parent zone of each domain must delegate it to `dns.nameserver` and
 the secondaries, with glue records for name servers inside the domain.
@@ -1636,7 +1636,7 @@ takes a sample of the router with `psutil`:
 - the free and the total space of `/`;
 - the bytes received and sent per second on the external and the internal interface;
 - the 1, 5 and 15 minute load averages;
-- the VPN clients of each enabled VPN system: road-warrior (IPsec P2S) and OpenVPN clients, and
+- the VPN clients of each enabled VPN system: IKEv2 and OpenVPN clients, and
   WireGuard peers with a handshake in the last 3 minutes;
 - for each site-to-site connection that is set up: whether it is up (1 or 0), the bytes and the
   packets per second received and sent through its child SAs since the previous sample, and the

debian-package/debian/changelog

@@ -1,3 +1,14 @@
+vpn-router (0.33.2-1) unstable; urgency=medium
+
+  fix: the router's IPsec remote access is called IKEv2 instead of road-warrior.
+
+  * The README, the package description, the installer's questions, the
+    status page, the messages of the web service and the examples say
+    IKEv2 access and IKEv2 clients; the strongSwan connection keeps its
+    name, road-warrior.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 27 Oct 2026 23:00:00 +0100
+
 vpn-router (0.33.1-1) unstable; urgency=medium
 
   fix: the name server is the primary of any number of domains, each with secondary name servers and a switch for the records of the sites.

debian-package/debian/control

@@ -46,10 +46,10 @@ Suggests: caddy,
           pdns-server,
           pdns-backend-pgsql,
           proxmox-backup-client-static
-Description: Linux VPN router with IPSec, road-warrior, OpenVPN and WireGuard support
+Description: Linux VPN router with IPSec, IKEv2, OpenVPN and WireGuard support
  Configures a Linux host or virtual machine as a VPN router: site-to-site
  IKEv2 IPSec (strongSwan swanctl) with pre-shared keys or certificates,
- optional road-warrior access using EAP-TLS, optional OpenVPN with a
+ optional IKEv2 access using EAP-TLS, optional OpenVPN with a
  certificate and a password per user, kept in a local LDAP directory, optional
  WireGuard, and the routing, NAT, MSS clamping and firewall rules a router
  needs. Its two-level CA, whose root may be kept offline, has issuing CAs for

debian-package/debian/templates

@@ -4,7 +4,7 @@ Choices: none, generic, azure, gcp
 Default: none
 Description: Platform:
  Which platform this router runs on. The choice loads platform-specific
- additions, such as the provider DNS resolver for road-warrior clients.
+ additions, such as the provider DNS resolver for IKEv2 clients.
  .
  none defers configuration entirely: the package installs its files and
  changes nothing on the machine. Choose it when the router will be configured
@@ -58,7 +58,7 @@ Type: string
 Default:
 Description: Local router FQDN:
  Fully-qualified domain name of this router (for example
- router.example.com). Used as the road-warrior server identity and
+ router.example.com). Used as the IKEv2 server identity and
  certificate common name.
 
 Template: vpn-router/local_id_mode
@@ -122,15 +122,15 @@ Description: Pre-shared key (PSK):
 Template: vpn-router/p2s_enabled
 Type: boolean
 Default: false
-Description: Enable road-warrior (P2S) access?
+Description: Enable IKEv2 access?
  If enabled, this router accepts IKEv2 EAP-TLS connections from individual
  clients, with certificates of the router's P2S issuing CA.
 
 Template: vpn-router/p2s_address_pool
 Type: string
 Default:
-Description: Road-warrior address pool:
+Description: IKEv2 address pool:
- CIDR block assigned to road-warrior clients (for example 172.16.0.0/24).
+ CIDR block assigned to IKEv2 clients (for example 172.16.0.0/24).
 
 Template: vpn-router/pki_root_name
 Type: string

debian-package/src/usr/lib/vpn-router/metrics

@@ -7,7 +7,7 @@ disables the unit.
 Every SAMPLE_SECONDS, on the minute, a sample is taken with psutil: the CPU utilization since the
 previous sample, the memory used and in total, the free and the total space of /, the bytes
 received and sent per second on the external and the internal interface, and the load averages;
-and the VPN clients of each enabled VPN system (vpnrouter_status): road-warrior (p2s) and
+and the VPN clients of each enabled VPN system (vpnrouter_status): IKEv2 (p2s) and
 OpenVPN clients and WireGuard peers with a recent handshake; and of each site-to-site connection
 that is set up, whether it is up, the bytes and packets per second through its child SAs since
 the previous sample, and how long its IKE SA has been up. The interfaces, the enabled systems and

debian-package/src/usr/lib/vpn-router/vpnrouter.py

@@ -1063,7 +1063,7 @@ def routing_ready(ctx):
 
 
 def p2s_ready(ctx):
-    """Road-warrior access needs its settings and the router's VPN server certificate, which the P2S CA issues."""
+    """IKEv2 access needs its settings and the router's VPN server certificate, which the P2S CA issues."""
     return bool(ctx['p2s_enabled'] and ctx['p2s_address_pool'] and ctx['local_fqdn'] and ctx['server_certificate'])
 
 

debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/__init__.py

@@ -10,7 +10,7 @@ adding one file here. Nothing in the core has to be edited.
 
 A module may define any of:
 
-    EXTRA_P2S_DNS   str, added to the road-warrior pool 'dns' list
+    EXTRA_P2S_DNS   str, added to the 'dns' list of the IKEv2 address pool
     EXTRA_LOCAL_TS  str, added to 'local_ts' on both connections
     apply(ctx)      called once the system has been configured, to apply
                     platform-specific state. Must be idempotent. ctx is the

debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/azure.py

@@ -3,7 +3,7 @@
 No platform-specific configuration is currently required.
 
 The Azure platform resolver 168.63.129.16 is deliberately *not* advertised to
-road-warrior clients and *not* added to the traffic selectors. Clients are
+IKEv2 clients and *not* added to the traffic selectors. Clients are
 given the router's addresses of p2s.dns_listen as their DNS servers, where dnsmasq
 forwards to the router's own systemd-resolved. That resolves
 Azure-internal names without routing the wireserver address through the tunnel

debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/gcp.py

@@ -2,7 +2,7 @@
 
 No platform-specific configuration is currently required.
 
-As on Azure, road-warrior clients are given the router itself as their DNS
+As on Azure, IKEv2 clients are given the router itself as their DNS
 server and the router forwards through its own systemd-resolved, so the
 metadata resolver does not belong in the pool or in the traffic selectors.
 """

debian-package/src/usr/lib/vpn-router/vpnrouter_users.py

@@ -814,7 +814,7 @@ def profile(connection, name):
 
 
 def apple_profile(connection, name, password):
-    """The Apple configuration profile (.mobileconfig, unsigned) of the user's IKEv2 road-warrior access: the root CA and
+    """The Apple configuration profile (.mobileconfig, unsigned) of the user's IKEv2 access: the root CA and
     the P2S CA, the user's certificate and key as a PKCS#12 encrypted with the password, and the VPN.
 
     The connection matches road-warrior.conf: the router's wan.local_fqdn as address and identity, the user name, a
@@ -828,7 +828,7 @@ def apple_profile(connection, name, password):
     cfg = vpnrouter.load_config()
     fqdn = cfg['wan']['local_fqdn'].strip()
     if not cfg['p2s']['enabled'] or not fqdn:
-        raise Failure('IKEv2 road-warrior access is not enabled', 2)
+        raise Failure('IKEv2 access is not enabled', 2)
     credentials = vpnrouter_pki.user_credentials(name)
     if credentials is None:
         raise Failure(f'user {name} has no certificate')

debian-package/src/usr/lib/vpn-router/web

@@ -29,7 +29,7 @@ Pages:
   /backup  the backup settings, the last run and the local archives: show, change and run
            now (see backup())
   /remote-access
-           the settings of IKEv2 road-warrior, OpenVPN and WireGuard access and whether each
+           the settings of IKEv2, OpenVPN and WireGuard access and whether each
            runs: show and change, applied by vpn-router-setup (see remote_access())
   /ca      the PKI: its settings, the root and issuing CAs, the certificates issued; change the
            settings, issue and revoke certificates, and take the certificate of an issuing CA
@@ -79,7 +79,7 @@ default, the overall status, the time and the client's address (its address as f
 below); standard also the package version, the installed version of vpn-router-manager
 (manager_version, null when it is not installed) and the number of active and other services; full
 whether each service runs, whether Docker is installed, how many of the site-to-site connections are established
-(site_to_site: connections and established, null when swanctl cannot be asked), and road-warrior (IPsec P2S), OpenVPN
+(site_to_site: connections and established, null when swanctl cannot be asked), and IKEv2, OpenVPN
 and WireGuard. No configuration data, key or connection name is shown, and no address but the client's.
 
 The service first initializes, without listening: it makes the signing key, the OpenID Provider's key
@@ -184,7 +184,7 @@ BODY_LIMIT = 65536
 #: The settings of a site_to_site connection that /site-to-site adds and changes.
 CONNECTION_SETTINGS = ('addrs', 'id', 'cidrs', 'local_cidrs', 'local_id_mode', 'auth', 'psk', 'remote_ca')
 
-#: The sections of the remote access systems /remote-access changes: IKEv2 road-warrior, OpenVPN and WireGuard.
+#: The sections of the remote access systems /remote-access changes: IKEv2, OpenVPN and WireGuard.
 REMOTE_ACCESS = ('p2s', 'openvpn', 'wireguard')
 
 #: The HTTP status for each status of a vpnrouter_users.Failure; any other is 500.
@@ -490,7 +490,7 @@ def text_of(status):
         lines.append(f'Site to site: {"unknown" if established is None else established} of {connections} established')
     if 'p2s' in status:
         clients = status['p2s']['clients']
-        lines.append(f'Road-warrior (IPsec P2S): {"unknown" if clients is None else f"{clients} connected"}')
+        lines.append(f'IKEv2: {"unknown" if clients is None else f"{clients} connected"}')
     if 'openvpn' in status:
         clients = status['openvpn']['clients']
         lines.append(f'OpenVPN: {"unknown" if clients is None else f"{clients} connected"}')
@@ -566,7 +566,7 @@ def users(state, method, path, body):
       DELETE /users/<name>            remove the user and revoke the certificate
       GET    /users/<name>/profile    the OpenVPN client profile
       POST   /users/<name>/apple-profile
-                                      the Apple configuration profile of IKEv2 road-warrior access: {"password"}, which
+                                      the Apple configuration profile of IKEv2 access: {"password"}, which
                                       encrypts the user's key in it; {"name", "profile"}
       POST   /users/<name>/otp       a new TOTP secret and its otpauth URI; nothing is stored
       PUT    /users/<name>/otp        store a TOTP secret: {"secret", "code"}, code a code of the secret
@@ -1051,7 +1051,7 @@ def account(name, method, path, body):
       POST   /account/profile  the user's OpenVPN client profile: {"current_password", "current_code"?}; {"name",
                                "profile"}
       POST   /account/apple-profile
-                               the user's Apple configuration profile of IKEv2 road-warrior access:
+                               the user's Apple configuration profile of IKEv2 access:
                                {"current_password", "current_code"?, "password"}, password encrypting the user's key in
                                it; {"name", "profile"}
 

examples/azure/variables.tf

@@ -45,7 +45,7 @@ variable "vm_size" {
 }
 
 variable "local_fqdn" {
-  description = "FQDN of the router, used as the road-warrior/IKE identity and, when dns_zone_id is set, as the name of the A record created for it."
+  description = "FQDN of the router, used as the IKE identity and, when dns_zone_id is set, as the name of the A record created for it."
   type        = string
 }
 
@@ -89,13 +89,13 @@ variable "psk" {
 }
 
 variable "p2s_enabled" {
-  description = "Enable road-warrior (P2S) access."
+  description = "Enable IKEv2 access."
   type        = bool
   default     = false
 }
 
 variable "p2s_address_pool" {
-  description = "CIDR block assigned to road-warrior clients."
+  description = "CIDR block assigned to IKEv2 clients."
   type        = string
   default     = ""
 }

examples/gcp/variables.tf

@@ -37,7 +37,7 @@ variable "machine_type" {
 }
 
 variable "local_fqdn" {
-  description = "FQDN of the router, used as the road-warrior/IKE identity and, when dns_managed_zone is set, as the name of the A record created for it."
+  description = "FQDN of the router, used as the IKE identity and, when dns_managed_zone is set, as the name of the A record created for it."
   type        = string
 }
 
@@ -86,13 +86,13 @@ variable "psk" {
 }
 
 variable "p2s_enabled" {
-  description = "Enable road-warrior (P2S) access."
+  description = "Enable IKEv2 access."
   type        = bool
   default     = false
 }
 
 variable "p2s_address_pool" {
-  description = "CIDR block assigned to road-warrior clients."
+  description = "CIDR block assigned to IKEv2 clients."
   type        = string
   default     = ""
 }