12,270
edits
FireBrick Road Warrior strongSwan: Difference between revisions
m
→CA Certificate
m (see also!) |
m (→CA Certificate) |
||
| (2 intermediate revisions by one other user not shown) | |||
|
==CA Certificate==
Usually you can use ACME and Letsencrypt to assign a certificate to the FireBrick, so skip the next step if you're doing this.
Download your CA certificate from the FireBrick, and copy to /etc/ipsec.d/cacerts/ on your client box. Strongswan shouldn't mind if PEM or DER.▼
▲If using a manually creates certificate, Download your CA certificate from the FireBrick, and copy to <tt>/etc/ipsec.d/cacerts/</tt> on your client box. Strongswan shouldn't mind if PEM or DER.
If you're using a Let's Encrypt cert on the FireBrick (which is easy) - you'll need to symlink the system CA:
Here's some StrongSwan info on split tunnelling: https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling
You use <tt>leftsubnet</tt> on the strongSwan roadwarrior to determine whether to use the tunnel as default gateway - you'd need <tt>leftsubnet=0.0.0.0/0</tt> to ensure all traffic used the tunnel, and <tt>leftsubnet=<serverLAN></tt> for split tunnelling.
For example:
| |||