slawek/linux-cloud-router
3
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: the router's IPsec remote access is called IKEv2 instead of road-warrior.
Release / release (push) Successful in 53s
Details

Browse Source
This commit is contained in:
slawek committed 2026-10-27 08:46:36 +01:00
1 parent 1697e1aa38
commit dd2dfaaf2b
14 files changed
+76 -65
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ADR.md
+10 -10
View File
@@ -46,7 +46,7 @@ and as a Tailwind CSS page for a browser, and `/status` is the same status as JS
much as `web.status_content` says, since the router is reachable from the internet and the
operator decides how much it tells strangers: `basic`, the default because it tells the least,
the overall status and the Client IP, `standard` also the package versions and the number of
active and other services, and `full` also each service and the state of the site-to-site, road-warrior, OpenVPN and
active and other services, and `full` also each service and the state of the site-to-site, IKEv2, OpenVPN and
WireGuard features. The Client IP is the address the request came from, through the trusted
proxies, so a person can see the address the router sees. Nothing comes from the configuration.
`/status` names its content, so clients such as manage-ui and the Router Manager show what it
@@ -458,7 +458,7 @@ refresh tokens after the operations of `vpnrouter_auth.REVOKING`.
Consequences: A Manager-only account cannot become a VPN user, as LDAP cannot change an entry's
structural class and its password hash cannot be copied; it is removed and added again instead.
It has no certificate, so OpenVPN and road-warrior access refuse it. The administrator's password
It has no certificate, so OpenVPN and IKEv2 access refuse it. The administrator's password
is on disk only until setup has run.
## ADR-19: The package has an LDAP schema of its own under a UUID OID
@@ -655,8 +655,8 @@ one, so its name is the one the tunnel always had.
- **Local settings per connection:** each connection has its own `local_cidrs` and
`local_id_mode`, as each peer expects its own traffic selectors and identity. `wan.local_fqdn`
stays the router's one name, used by the `fqdn` mode, resolved once for the `public_ip` mode,
and used by HTTPS, road-warrior and OpenVPN. `local.cidrs` stays the subnets the router
routes, masquerades and offers to road-warrior and OpenVPN clients.
and used by HTTPS, IKEv2 and OpenVPN. `local.cidrs` stays the subnets the router
routes, masquerades and offers to IKEv2 and OpenVPN clients.
- **One file:** `vpn-router-setup` writes every connection that is ready to
`/etc/swanctl/conf.d/site-to-site.conf`, with the proposals and timers the one tunnel had, and
removes the file when none is. The NAT exemptions pair each connection's `local_cidrs` with its
@@ -766,9 +766,9 @@ signs the requester's CSR, or makes the key and returns it once in a PKCS#12 fil
the certificate, so a key it gave away cannot leak from it later. The PKCS#12 file uses 3DES and
SHA-1 MACs, the encryption the key stores of Windows and macOS import. strongSwan reads only the
first certificate of a PEM file, so each CA has a file of its own in `/etc/swanctl/x509ca`;
road-warrior and site-to-site name their CA in `cacerts`, which restricts the trust chain to it.
IKEv2 access and site-to-site name their CA in `cacerts`, which restricts the trust chain to it.
Consequences: The P2S CA's certificates are accepted by road-warrior and OpenVPN only, the site-to-site CA's by
Consequences: The P2S CA's certificates are accepted by IKEv2 and OpenVPN only, the site-to-site CA's by
site-to-site only. With an offline root, new issuing CAs and the root CRL need the offline step,
and a router whose P2S CA waits has no VPN server certificate and so no P2S access. The router
keeps the users' keys, as the OpenVPN profile embeds them.
@@ -1198,7 +1198,7 @@ resolver share no address.
Status: Accepted
Context: macOS, iOS and iPadOS connect to the road-warrior access with their built-in IKEv2 client,
Context: macOS, iOS and iPadOS connect to the IKEv2 access with their built-in IKEv2 client,
configured by a configuration profile. The router keeps each user's certificate and key. Apple's
clients read a PKCS#12 only when it is encrypted with 3DES and SHA-1, send one proposal per SA,
and show an unsigned profile as unverified.
@@ -1213,18 +1213,18 @@ Consequences: The password is never stored; the device asks for it when the prof
A profile shows as unverified. A changed proposal of `road-warrior.conf` must be changed in the
profile too. WireGuard is not part of it.
## ADR-45: Road-warrior clients get split DNS domains, p2s.dns_domains
## ADR-45: IKEv2 clients get split DNS domains, p2s.dns_domains
Status: Accepted
Context: The road-warrior access is a split tunnel. macOS and iOS use the DNS server an IKEv2 VPN
Context: The IKEv2 access is a split tunnel. macOS and iOS use the DNS server an IKEv2 VPN
pushes only for queries scoped to the tunnel, so names only the router resolves, such as Azure's
internal names, fail. RFC 8598 defines INTERNAL_DNS_DOMAIN (attribute 25): the client resolves the
listed domains and their subdomains with the VPN's servers. strongSwan's pools take numeric
attributes with string values; Apple profiles name such domains in `SupplementalMatchDomains`.
Decision: The setting `p2s.dns_domains` lists the domains; setup pushes each as attribute 25 of the
road-warrior pool, and the Apple VPN profile gives them as match domains of the router's resolver,
IKEv2 address pool, and the Apple VPN profile gives them as match domains of the router's resolver,
the addresses setup records for the web service.
Consequences: Clients resolve the listed domains through the tunnel and everything else with their
README.md
+29 -29
View File
@@ -3,11 +3,11 @@
A Debian package that configures a Linux host or virtual machine as a VPN router:
- site-to-site IKEv2 IPSec with pre-shared key or certificate authentication (strongSwan swanctl)
- road-warrior (P2S) access using IKEv2 EAP-TLS
- IKEv2 access using EAP-TLS
- a two-level certificate authority: a root, which may be kept offline, and issuing CAs for the VPN
clients, for site-to-site and for general use, with certificate templates, published certificates
and CRLs, and an optional ACME server
- OpenVPN (P2S) access with a certificate and a password per user, the users kept in a local
- OpenVPN access with a certificate and a password per user, the users kept in a local
LDAP directory and managed with `vpn-router-user` or the web service
- optional WireGuard endpoint
- routing and NAT for a protected subnet, TCP MSS clamping, and UFW firewall rules
@@ -108,15 +108,15 @@ must have the type shown below; an unknown section or setting is an error.
| `general` | `mode` | string | `manual` | How much you supply: `manual`, `interfaces` or `auto` |
| `interfaces` | `external` | string | | Name of the NIC facing the untrusted network |
| `interfaces` | `internal` | string | | Name of the NIC facing the protected network |
| `wan` | `local_fqdn` | string | | This router's name or IP address: its IKE identity in `fqdn` mode, the name resolved in `public_ip` mode, and the name of HTTPS, road-warrior and OpenVPN |
| `local` | `cidrs` | list | | Local subnets routed via the internal side, masqueraded to the external one, and offered to road-warrior and OpenVPN clients |
| `wan` | `local_fqdn` | string | | This router's name or IP address: its IKE identity in `fqdn` mode, the name resolved in `public_ip` mode, and the name of HTTPS, IKEv2 and OpenVPN |
| `local` | `cidrs` | list | | Local subnets routed via the internal side, masqueraded to the external one, and offered to IKEv2 and OpenVPN clients |
| `local` | `int_addr` | string | | This host's address on the internal network |
| `local` | `int_gateway_ip` | string | | Next hop on the internal side |
| `site_to_site` | | object | | The site-to-site connections, each a name and an object of the settings below |
| `p2s` | `enabled` | boolean | `false` | Road-warrior access |
| `p2s` | `address_pool` | string | | CIDR assigned to road-warrior clients |
| `p2s` | `dns_domains` | list | | The domains road-warrior clients resolve with the router's resolver (INTERNAL_DNS_DOMAIN, RFC 8598, and the match domains of the Apple VPN profile), at most 16 |
| `p2s` | `dns_listen` | string | `internal` | The addresses of the resolver the road-warrior, OpenVPN and WireGuard clients are given: `internal`, `external` or `both` |
| `p2s` | `enabled` | boolean | `false` | IKEv2 access |
| `p2s` | `address_pool` | string | | CIDR assigned to IKEv2 clients |
| `p2s` | `dns_domains` | list | | The domains IKEv2 clients resolve with the router's resolver (INTERNAL_DNS_DOMAIN, RFC 8598, and the match domains of the Apple VPN profile), at most 16 |
| `p2s` | `dns_listen` | string | `internal` | The addresses of the resolver the IKEv2, OpenVPN and WireGuard clients are given: `internal`, `external` or `both` |
| `wireguard` | `enabled` | boolean | `false` | WireGuard endpoint |
| `wireguard` | `address` | string | | The router's own address on `wg0` with the prefix of the peers' network, for example `192.168.200.1/24`; the network and the broadcast address of a network larger than /31 are refused |
| `wireguard` | `listen_port` | integer | `51820` | UDP port |
@@ -251,9 +251,9 @@ A minimal site-to-site configuration in `auto` mode:
The router's IKE identity (`wan.local_fqdn` in `fqdn` mode) and the remote one (`id`) are
an FQDN or an IPv4 or IPv6 address. They are written to the strongSwan configuration as given;
strongSwan reads an address as an IP identity and a name as an FQDN, so a leading `@` is not needed
and is refused. Road-warrior and OpenVPN access need a name in `wan.local_fqdn`.
and is refused. IKEv2 and OpenVPN access need a name in `wan.local_fqdn`.
WireGuard peers are P2S users' devices: a VPN user of the router's directory may have up to 16
WireGuard peers are VPN users' devices: a VPN user of the router's directory may have up to 16
peers, each with its public key and its IPs, IPv4 addresses or networks, kept in the user's
entry (`vpnRouterWireGuardPeer`) and set with `PUT /users/<name>` (`wireguard_peers`) or on the
WireGuard tab of the Router Manager's Remote access management. A key is used by one peer only,
@@ -398,7 +398,7 @@ systemctl restart vpn-router-setup
The service also runs at boot. With platform `none` it does nothing and says so.
Otherwise it regenerates the configuration files, resolves the interfaces and their
addresses as `mode` directs, applies routes, generates WireGuard keys and injects
firewall rules. It provisions the user directory in `slapd` while OpenVPN or road-warrior
firewall rules. It provisions the user directory in `slapd` while OpenVPN or IKEv2
access is configured. It then starts `strongswan`, `wg-quick@wg0` and
`openvpn-server@vpn-router` if the corresponding feature is configured, reloading or
restarting them only when their inputs changed, and
@@ -449,7 +449,7 @@ The root signs the issuing CAs only (path length 1), and the issuing CAs sign th
(path length 0):
- `p2s`, named `pki.p2s_name`, signs the router's VPN server certificate, which IKEv2 and OpenVPN
present, and the users' certificates. Road-warrior and OpenVPN accept client certificates of
present, and the users' certificates. IKEv2 and OpenVPN accept client certificates of
this CA only.
- `s2s`, named `pki.s2s_name`, signs the router's site-to-site certificate and the certificates
of its peers.
@@ -652,7 +652,7 @@ certificate names:
### The user directory
Once a platform is chosen, `vpn-router-setup` keeps a directory of users in the local slapd,
whether or not OpenVPN or road-warrior access is enabled, so users can be managed before either
whether or not OpenVPN or IKEv2 access is enabled, so users can be managed before either
is switched on:
- its own database, `dc=vpn-router,dc=local` in `/var/lib/ldap/vpn-router`, next to the one the
@@ -773,22 +773,22 @@ When the Router Manager is installed with an administrator (its debconf question
Manager-only account, adds it to the group `admins`, which it creates when missing, and removes
the file.
The certificate is also accepted by road-warrior (IKEv2 EAP-TLS) access, which checks
The certificate is also accepted by IKEv2 (EAP-TLS) access, which checks
certificates only, so `disable` does not affect it; `remove` revokes the certificate for both.
### Apple VPN profile
While `p2s.enabled` is `true` and `wan.local_fqdn` is set, `/users/<name>/apple-profile` and a
user's own `/account/apple-profile` give an unsigned Apple configuration profile (`.mobileconfig`)
that sets up road-warrior access in the built-in VPN client of macOS, iOS and iPadOS. It holds:
that sets up IKEv2 access in the built-in VPN client of macOS, iOS and iPadOS. It holds:
- the P2S CA and the root CA, the root installed as a trusted root;
- the user's certificate and key as a PKCS#12 encrypted with the password of the request, with
3DES and SHA-1, the only encryption Apple's clients read; the device asks for the password when
the profile is installed, and the router does not keep it;
- an IKEv2 VPN to `wan.local_fqdn`, with the user name as the local identity, the certificate over
EAP-TLS, and AES-256, SHA2-256 and group 14 for IKE and ESP, as the router's road-warrior
connection takes them;
EAP-TLS, and AES-256, SHA2-256 and group 14 for IKE and ESP, as the router's IKEv2
connection (`road-warrior`) takes them;
- with `p2s.dns_domains`, the router's resolver for those domains and their subdomains
(`SupplementalMatchDomains`). macOS and iOS use the DNS server of a VPN that does not carry all
traffic only for its match domains.
@@ -892,7 +892,7 @@ deploying.
which is how a deferred install is expressed. `generic` is the module to choose when the
router should be configured but the platform adds nothing.
The shipped modules currently add nothing. Road-warrior, OpenVPN and WireGuard clients are given the
The shipped modules currently add nothing. IKEv2, OpenVPN and WireGuard clients are given the
router's addresses of `p2s.dns_listen` as their DNS servers, by default the internal address,
the WireGuard clients in the configuration the Router Manager makes for a device (`DNS =`),
where `vpn-router-resolver.service`, dnsmasq with `/etc/vpn-router/dnsmasq.conf`, answers and
@@ -908,7 +908,7 @@ A module may define any of the following, and takes the default for anything it
| Name | Type | Effect |
|---|---|---|
| `EXTRA_P2S_DNS` | `str` | added to the road-warrior pool `dns` list |
| `EXTRA_P2S_DNS` | `str` | added to the `dns` list of the IKEv2 address pool |
| `EXTRA_LOCAL_TS` | `str` | added to `local_ts` on both connections |
| `apply(ctx)` | function | called once the system is configured, to apply platform-specific state; must be idempotent |
@@ -941,7 +941,7 @@ configuration: no key, identity, subnet, or address but the client's. They show
|---|---|
| `basic` (default) | The overall status (`ok` or `degraded`), the time and the Client IP |
| `standard` | Also the `vpn-router` version, the `vpn-router-manager` version or that it is not installed, and the number of active services and of services in any other state, without their names |
| `full` | Also each service and its state, Docker, how many site-to-site connections are set up and how many of them are established (`site_to_site`: `connections` and `established`, `null` when swanctl cannot be asked), road-warrior, OpenVPN and WireGuard |
| `full` | Also each service and its state, Docker, how many site-to-site connections are set up and how many of them are established (`site_to_site`: `connections` and `established`, `null` when swanctl cannot be asked), IKEv2, OpenVPN and WireGuard |
The Client IP is the address the request came from: the last entry of `X-Forwarded-For` for a
request from one of `web.trusted_proxies`, by default the address the request came in on, so
@@ -976,7 +976,7 @@ curl http://10.0.0.4:17081/
| `/status` | The same status as JSON |
| `/auth` | Signing in with a user's password and TOTP code, refreshing and signing out |
| `/config` | The configuration without its secret options, and what the router resolved and runs, as JSON; needs a token |
| `/users` | The users of OpenVPN and road-warrior access; needs a token |
| `/users` | The users of OpenVPN and IKEv2 access; needs a token |
| `/service-accounts` | The service accounts; needs a token |
| `/groups` | The groups of users; needs a token |
| `/site-to-site` | The site-to-site connections: list, add, change and remove; needs a token |
@@ -989,14 +989,14 @@ curl http://10.0.0.4:17081/
The status holds the state of `vpn-router-setup`, `slapd` and each PostgreSQL cluster unit
(`postgresql@<version>-<cluster>`, or `postgresql` as `no cluster` without one), of
`vpn-router-manager` when that package is installed, of `strongswan` when site-to-site or
road-warrior access is configured, of `wg-quick@wg0` when WireGuard is, and of
IKEv2 access is configured, of `wg-quick@wg0` when WireGuard is, and of
`openvpn-server@vpn-router` when OpenVPN is; the number of connected
OpenVPN clients, from the server's status file, which OpenVPN rewrites every 5 seconds; the package version and,
as `manager_version`, the installed version of `vpn-router-manager` (`null`, shown as not installed, without it); whether
Docker is installed, and when it is, the state of `docker.service` and of `vpn-router-docker`
(the Docker rules), which do not change `status`; as `site_to_site`, the number of site-to-site
connections that are set up (`connections`) and of those established (`established`, `null` when
swanctl cannot be asked), without their names; the number of connected road-warrior (IPsec P2S) clients; and
swanctl cannot be asked), without their names; the number of connected IKEv2 clients; and
the WireGuard peers with the age of their last handshake and their traffic. `status` is `ok` when
all these services are active, and `degraded` otherwise.
@@ -1206,7 +1206,7 @@ and answer bodies are JSON; a request body is at most 65536 bytes.
| `POST /users/<name>/unlock` | | the user |
| `DELETE /users/<name>` | | `{"name", "removed": true}` |
| `GET /users/<name>/profile` | | `{"name", "profile"}`, the OpenVPN client profile |
| `POST /users/<name>/apple-profile` | `{"password"}` | `{"name", "profile"}`, the Apple configuration profile of IKEv2 road-warrior access (see Apple VPN profile) |
| `POST /users/<name>/apple-profile` | `{"password"}` | `{"name", "profile"}`, the Apple configuration profile of IKEv2 access (see Apple VPN profile) |
| `POST /users/<name>/otp` | | `{"name", "secret", "uri"}`, a new TOTP secret; nothing is stored |
| `PUT /users/<name>/otp` | `{"secret", "code"}` | the user, once the code matches the secret |
| `DELETE /users/<name>/otp` | | the user |
@@ -1216,7 +1216,7 @@ and answer bodies are JSON; a request body is at most 65536 bytes.
A failure is `{"error": ...}` with 400 for an invalid request, 404 for a user that does not
exist or is a service account, 409 for a user that exists and 500 otherwise. `/users` does not
list service accounts; `/service-accounts` serves them. `/users` works whether or not OpenVPN or
road-warrior access is enabled; the profile needs OpenVPN. Passwords, private keys and TOTP
IKEv2 access is enabled; the profile needs OpenVPN. Passwords, private keys and TOTP
secrets cross the internal network in plain HTTP, like the token.
```bash
@@ -1264,7 +1264,7 @@ router manages them, their display name and description included. A failure is o
| `PUT /account/passkeys` | `{"id", "credential", "label"?}`, `credential` the browser's answer as its `toJSON()` gives it; `label` at most 64 characters, `Passkey` without one | the user |
| `DELETE /account/passkeys/<id>` | | the user |
| `POST /account/profile` | `{"current_password", "current_code"}` | `{"name", "profile"}`, the user's OpenVPN client profile |
| `POST /account/apple-profile` | `{"current_password", "current_code", "password"}` | `{"name", "profile"}`, the user's Apple configuration profile of IKEv2 road-warrior access (see Apple VPN profile) |
| `POST /account/apple-profile` | `{"current_password", "current_code", "password"}` | `{"name", "profile"}`, the user's Apple configuration profile of IKEv2 access (see Apple VPN profile) |
`current_code` is needed only for a user enrolled for TOTP; removing a passkey needs neither. A wrong current password or code gets
403 and counts as a failed login; slapd accepts each code once, so a code used to sign in is not
@@ -1334,7 +1334,7 @@ A change is made, checked and applied as for `/site-to-site`.
### The /remote-access API
`/remote-access` shows and changes the remote access systems, IKEv2 road-warrior (`p2s`),
`/remote-access` shows and changes the remote access systems, IKEv2 (`p2s`),
OpenVPN (`openvpn`) and WireGuard (`wireguard`), with the same token as `/users`.
| Request | Body | Answer |
@@ -1615,7 +1615,7 @@ The domains are added with `/dns` or the Router Manager, each with:
A domain inside another domain of the router is delegated from it with NS records. Setup writes the
domains at each run, and after each change through `/dns`; the SOA's serial grows only when the
records change. While P2S, OpenVPN or WireGuard is enabled, dnsmasq answers their clients on port 53
records change. While IKEv2, OpenVPN or WireGuard is enabled, dnsmasq answers their clients on port 53
of the addresses of `p2s.dns_listen`, by default the internal address, so `dns.listen` must not
share an interface with it. The parent zone of each domain must delegate it to `dns.nameserver` and
the secondaries, with glue records for name servers inside the domain.
@@ -1636,7 +1636,7 @@ takes a sample of the router with `psutil`:
- the free and the total space of `/`;
- the bytes received and sent per second on the external and the internal interface;
- the 1, 5 and 15 minute load averages;
- the VPN clients of each enabled VPN system: road-warrior (IPsec P2S) and OpenVPN clients, and
- the VPN clients of each enabled VPN system: IKEv2 and OpenVPN clients, and
WireGuard peers with a handshake in the last 3 minutes;
- for each site-to-site connection that is set up: whether it is up (1 or 0), the bytes and the
packets per second received and sent through its child SAs since the previous sample, and the
debian-package/debian/changelog
+11
View File
@@ -1,3 +1,14 @@
vpn-router (0.33.2-1) unstable; urgency=medium
fix: the router's IPsec remote access is called IKEv2 instead of road-warrior.
* The README, the package description, the installer's questions, the
status page, the messages of the web service and the examples say
IKEv2 access and IKEv2 clients; the strongSwan connection keeps its
name, road-warrior.
-- Slawomir Koszewski <slawek@koszewscy.waw.pl> Tue, 27 Oct 2026 23:00:00 +0100
vpn-router (0.33.1-1) unstable; urgency=medium
fix: the name server is the primary of any number of domains, each with secondary name servers and a switch for the records of the sites.
debian-package/debian/control
+2 -2
View File
@@ -46,10 +46,10 @@ Suggests: caddy,
pdns-server,
pdns-backend-pgsql,
proxmox-backup-client-static
Description: Linux VPN router with IPSec, road-warrior, OpenVPN and WireGuard support
Description: Linux VPN router with IPSec, IKEv2, OpenVPN and WireGuard support
Configures a Linux host or virtual machine as a VPN router: site-to-site
IKEv2 IPSec (strongSwan swanctl) with pre-shared keys or certificates,
optional road-warrior access using EAP-TLS, optional OpenVPN with a
optional IKEv2 access using EAP-TLS, optional OpenVPN with a
certificate and a password per user, kept in a local LDAP directory, optional
WireGuard, and the routing, NAT, MSS clamping and firewall rules a router
needs. Its two-level CA, whose root may be kept offline, has issuing CAs for
debian-package/debian/templates
+5 -5
View File
@@ -4,7 +4,7 @@ Choices: none, generic, azure, gcp
Default: none
Description: Platform:
Which platform this router runs on. The choice loads platform-specific
additions, such as the provider DNS resolver for road-warrior clients.
additions, such as the provider DNS resolver for IKEv2 clients.
.
none defers configuration entirely: the package installs its files and
changes nothing on the machine. Choose it when the router will be configured
@@ -58,7 +58,7 @@ Type: string
Default:
Description: Local router FQDN:
Fully-qualified domain name of this router (for example
router.example.com). Used as the road-warrior server identity and
router.example.com). Used as the IKEv2 server identity and
certificate common name.
Template: vpn-router/local_id_mode
@@ -122,15 +122,15 @@ Description: Pre-shared key (PSK):
Template: vpn-router/p2s_enabled
Type: boolean
Default: false
Description: Enable road-warrior (P2S) access?
Description: Enable IKEv2 access?
If enabled, this router accepts IKEv2 EAP-TLS connections from individual
clients, with certificates of the router's P2S issuing CA.
Template: vpn-router/p2s_address_pool
Type: string
Default:
Description: Road-warrior address pool:
CIDR block assigned to road-warrior clients (for example 172.16.0.0/24).
Description: IKEv2 address pool:
CIDR block assigned to IKEv2 clients (for example 172.16.0.0/24).
Template: vpn-router/pki_root_name
Type: string
debian-package/src/usr/lib/vpn-router/metrics
+1 -1
View File
@@ -7,7 +7,7 @@ disables the unit.
Every SAMPLE_SECONDS, on the minute, a sample is taken with psutil: the CPU utilization since the
previous sample, the memory used and in total, the free and the total space of /, the bytes
received and sent per second on the external and the internal interface, and the load averages;
and the VPN clients of each enabled VPN system (vpnrouter_status): road-warrior (p2s) and
and the VPN clients of each enabled VPN system (vpnrouter_status): IKEv2 (p2s) and
OpenVPN clients and WireGuard peers with a recent handshake; and of each site-to-site connection
that is set up, whether it is up, the bytes and packets per second through its child SAs since
the previous sample, and how long its IKE SA has been up. The interfaces, the enabled systems and
debian-package/src/usr/lib/vpn-router/vpnrouter.py
+1 -1
View File
@@ -1063,7 +1063,7 @@ def routing_ready(ctx):
def p2s_ready(ctx):
"""Road-warrior access needs its settings and the router's VPN server certificate, which the P2S CA issues."""
"""IKEv2 access needs its settings and the router's VPN server certificate, which the P2S CA issues."""
return bool(ctx['p2s_enabled'] and ctx['p2s_address_pool'] and ctx['local_fqdn'] and ctx['server_certificate'])
debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/__init__.py
+1 -1
View File
@@ -10,7 +10,7 @@ adding one file here. Nothing in the core has to be edited.
A module may define any of:
EXTRA_P2S_DNS str, added to the road-warrior pool 'dns' list
EXTRA_P2S_DNS str, added to the 'dns' list of the IKEv2 address pool
EXTRA_LOCAL_TS str, added to 'local_ts' on both connections
apply(ctx) called once the system has been configured, to apply
platform-specific state. Must be idempotent. ctx is the
debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/azure.py
+1 -1
View File
@@ -3,7 +3,7 @@
No platform-specific configuration is currently required.
The Azure platform resolver 168.63.129.16 is deliberately *not* advertised to
road-warrior clients and *not* added to the traffic selectors. Clients are
IKEv2 clients and *not* added to the traffic selectors. Clients are
given the router's addresses of p2s.dns_listen as their DNS servers, where dnsmasq
forwards to the router's own systemd-resolved. That resolves
Azure-internal names without routing the wireserver address through the tunnel
debian-package/src/usr/lib/vpn-router/vpnrouter_platforms/gcp.py
+1 -1
View File
@@ -2,7 +2,7 @@
No platform-specific configuration is currently required.
As on Azure, road-warrior clients are given the router itself as their DNS
As on Azure, IKEv2 clients are given the router itself as their DNS
server and the router forwards through its own systemd-resolved, so the
metadata resolver does not belong in the pool or in the traffic selectors.
"""
debian-package/src/usr/lib/vpn-router/vpnrouter_users.py
+2 -2
View File
@@ -814,7 +814,7 @@ def profile(connection, name):
def apple_profile(connection, name, password):
"""The Apple configuration profile (.mobileconfig, unsigned) of the user's IKEv2 road-warrior access: the root CA and
"""The Apple configuration profile (.mobileconfig, unsigned) of the user's IKEv2 access: the root CA and
the P2S CA, the user's certificate and key as a PKCS#12 encrypted with the password, and the VPN.
The connection matches road-warrior.conf: the router's wan.local_fqdn as address and identity, the user name, a
@@ -828,7 +828,7 @@ def apple_profile(connection, name, password):
cfg = vpnrouter.load_config()
fqdn = cfg['wan']['local_fqdn'].strip()
if not cfg['p2s']['enabled'] or not fqdn:
raise Failure('IKEv2 road-warrior access is not enabled', 2)
raise Failure('IKEv2 access is not enabled', 2)
credentials = vpnrouter_pki.user_credentials(name)
if credentials is None:
raise Failure(f'user {name} has no certificate')
debian-package/src/usr/lib/vpn-router/web
+6 -6
View File
@@ -29,7 +29,7 @@ Pages:
/backup the backup settings, the last run and the local archives: show, change and run
now (see backup())
/remote-access
the settings of IKEv2 road-warrior, OpenVPN and WireGuard access and whether each
the settings of IKEv2, OpenVPN and WireGuard access and whether each
runs: show and change, applied by vpn-router-setup (see remote_access())
/ca the PKI: its settings, the root and issuing CAs, the certificates issued; change the
settings, issue and revoke certificates, and take the certificate of an issuing CA
@@ -79,7 +79,7 @@ default, the overall status, the time and the client's address (its address as f
below); standard also the package version, the installed version of vpn-router-manager
(manager_version, null when it is not installed) and the number of active and other services; full
whether each service runs, whether Docker is installed, how many of the site-to-site connections are established
(site_to_site: connections and established, null when swanctl cannot be asked), and road-warrior (IPsec P2S), OpenVPN
(site_to_site: connections and established, null when swanctl cannot be asked), and IKEv2, OpenVPN
and WireGuard. No configuration data, key or connection name is shown, and no address but the client's.
The service first initializes, without listening: it makes the signing key, the OpenID Provider's key
@@ -184,7 +184,7 @@ BODY_LIMIT = 65536
#: The settings of a site_to_site connection that /site-to-site adds and changes.
CONNECTION_SETTINGS = ('addrs', 'id', 'cidrs', 'local_cidrs', 'local_id_mode', 'auth', 'psk', 'remote_ca')
#: The sections of the remote access systems /remote-access changes: IKEv2 road-warrior, OpenVPN and WireGuard.
#: The sections of the remote access systems /remote-access changes: IKEv2, OpenVPN and WireGuard.
REMOTE_ACCESS = ('p2s', 'openvpn', 'wireguard')
#: The HTTP status for each status of a vpnrouter_users.Failure; any other is 500.
@@ -490,7 +490,7 @@ def text_of(status):
lines.append(f'Site to site: {"unknown" if established is None else established} of {connections} established')
if 'p2s' in status:
clients = status['p2s']['clients']
lines.append(f'Road-warrior (IPsec P2S): {"unknown" if clients is None else f"{clients} connected"}')
lines.append(f'IKEv2: {"unknown" if clients is None else f"{clients} connected"}')
if 'openvpn' in status:
clients = status['openvpn']['clients']
lines.append(f'OpenVPN: {"unknown" if clients is None else f"{clients} connected"}')
@@ -566,7 +566,7 @@ def users(state, method, path, body):
DELETE /users/<name> remove the user and revoke the certificate
GET /users/<name>/profile the OpenVPN client profile
POST /users/<name>/apple-profile
the Apple configuration profile of IKEv2 road-warrior access: {"password"}, which
the Apple configuration profile of IKEv2 access: {"password"}, which
encrypts the user's key in it; {"name", "profile"}
POST /users/<name>/otp a new TOTP secret and its otpauth URI; nothing is stored
PUT /users/<name>/otp store a TOTP secret: {"secret", "code"}, code a code of the secret
@@ -1051,7 +1051,7 @@ def account(name, method, path, body):
POST /account/profile the user's OpenVPN client profile: {"current_password", "current_code"?}; {"name",
"profile"}
POST /account/apple-profile
the user's Apple configuration profile of IKEv2 road-warrior access:
the user's Apple configuration profile of IKEv2 access:
{"current_password", "current_code"?, "password"}, password encrypting the user's key in
it; {"name", "profile"}
examples/azure/variables.tf
+3 -3
View File
@@ -45,7 +45,7 @@ variable "vm_size" {
}
variable "local_fqdn" {
description = "FQDN of the router, used as the road-warrior/IKE identity and, when dns_zone_id is set, as the name of the A record created for it."
description = "FQDN of the router, used as the IKE identity and, when dns_zone_id is set, as the name of the A record created for it."
type = string
}
@@ -89,13 +89,13 @@ variable "psk" {
}
variable "p2s_enabled" {
description = "Enable road-warrior (P2S) access."
description = "Enable IKEv2 access."
type = bool
default = false
}
variable "p2s_address_pool" {
description = "CIDR block assigned to road-warrior clients."
description = "CIDR block assigned to IKEv2 clients."
type = string
default = ""
}
examples/gcp/variables.tf
+3 -3
View File
@@ -37,7 +37,7 @@ variable "machine_type" {
}
variable "local_fqdn" {
description = "FQDN of the router, used as the road-warrior/IKE identity and, when dns_managed_zone is set, as the name of the A record created for it."
description = "FQDN of the router, used as the IKE identity and, when dns_managed_zone is set, as the name of the A record created for it."
type = string
}
@@ -86,13 +86,13 @@ variable "psk" {
}
variable "p2s_enabled" {
description = "Enable road-warrior (P2S) access."
description = "Enable IKEv2 access."
type = bool
default = false
}
variable "p2s_address_pool" {
description = "CIDR block assigned to road-warrior clients."
description = "CIDR block assigned to IKEv2 clients."
type = string
default = ""
}