FireBrick Road Warrior strongSwan
FireBrick acting as the ipsec 'server', and configuring a strongSwan/Debian client.
This example uses strongSwan on Debian, but the config would suit other flavours once you've installed the package(s).
$ sudo apt-get install strongswan libcharon-extra-plugins
maybe also libstrongswan-extra-plugins if you need the curl plugin for strongswan to fetch CA certificates (eg from lets encrypt)
libcharon-extra-plugins is needed for the eap-identity plugin which is required to connect to the FireBrick. The plugin is loaded automatically, so you don't need to change any config files (normally you'd have to change the "load =" statement in strongswan.conf).
Download your CA certificate from the FireBrick, and copy to /etc/ipsec.d/cacerts/ on your client box. Strongswan shouldn't mind if PEM or DER.
If you're using a Let's Encrypt cert on the FireBrick (which is easy) - you'll need to symlink the system CA:
ln -s /etc/ssl/certs/DST_Root_CA_X3.pem /etc/ipsec.d/cacerts/DST_Root_CA_X3.pem
Add your user to: /etc/ipsec.secrets:
username : EAP "password"
Add your connection to /etc/ipsec.conf:
conn firebrick # Arbitrary name - doesn't have to be 'firebrick' left=%defaultroute # Use your default route to the internet leftfirewall=yes # Yes as you may be behind firewall/NAT leftauth=eap-mschapv2 # Match the EAP method defined on FireBrick leftid=@peer-ID # Peer ID as defined in FB IPsec IKE setting leftsourceip=%config # Ask for an IP from the roaming pool eap_identity=username # Username as in ipsec.secrets and FB config right=hostname.example.com # Hostname/IP of FireBrick rightauth=pubkey # FireBrick should be set to auth-method Certificate email@example.com # ID of FireBrick auto=route # Try to connect on startup
If the FireBrick is configured to give an IPv6 address in the Roaming pool, then tell strongSwan to request IPv6 too:
$ sudo service ipsec reload
That should be it.
Split tunnelling being where it uses the machine's default route for internet access, this can often can be useful - you may not want to tunnel your normal non-work browsing/streaming through your company's servers.
Here's some StrongSwan info on split tunnelling: https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling
You use leftsubnet on the strongSwan roadwarrior to determine whether to use the tunnel as default gateway - you'd need leftsubnet=0.0.0.0/0 to ensure all traffic used the tunnel, and leftsubnet=<serverLAN> for split tunnelling.
If you want to route additional blocks via the tunnel, use rightsubnet, eg:
rightsubnet=10.1.0.0/24,10.2.0.0/24,fd00:1::/64,fd00:1::/64 # IPs to route down tunnel
ipsec up <username> # manually attempt to bring up the connection - look for errors ipsec listcacerts # check if your cert is loaded ipsec statusall