strongswan

psycroptic · 07-26-2014, 11:29 PM

curious on how to restrict strongswan MTU size without reducing the MTU on the physical interface on which it's running. I'm finding lots of ways to do it via iptables MSS clamping, but that appears to only work for TCP; strongswan (5.1.3) appears to be using encapsulated UDP, as far as my packet captures can tell.

Ser Olmy · 07-27-2014, 06:40 AM

Since IPsec doesn't use tunnel interfaces, the payload size is limited by the MTU of the outgoing interface (and the path MTU, obviously). Unless StrongSwan has a configuration parameter that can limit the payload size (and I don't think such a parameter exists), you're stuck with the interface MTU.

BTW, StrongSwan doesn't "use encapsulated UDP", it uses IPsec/ESP, which in turn may use IPsec NAT Traversal encapsulation (UDP port 4500) if NAT is detected or if you force NAT-T with the relevant parameter.

psycroptic · 07-27-2014, 10:48 AM

OK, that's what i thought. Thanks for the info.

As an aside, have you ever used Strongswan? If so, what do you think of it? Has it worked well for you?

Ser Olmy · 07-27-2014, 11:10 AM

Quote:

Originally Posted by psycroptic

As an aside, have you ever used Strongswan? If so, what do you think of it? Has it worked well for you?

I've only just started using it, but so far it seems to work very well. It has an impressive list of features.

I can't say I'm perfectly happy with the configuration syntax (seriously, "left" and "right"? How about "local" and "remote"?), but all in all it wasn't too difficult to set up connections that would talk to other IPsec equipment.

psycroptic · 07-27-2014, 11:23 AM

word. Coming from OpenVPN, I am also finding its syntax more squirrely.

Have you tried using it with Android, specifically with the Strongswan app? im noticing lots of random disconnects there, sometimes requiring a phone reboot to be able to reconnect again

Ser Olmy · 07-27-2014, 05:09 PM

I haven't used the Android app, but I would suspect the cause of any instabilities to be on the Android side. strongSwan on x86 Linux seems rock solid.

psycroptic · 07-27-2014, 05:21 PM

Quote:

Originally Posted by Ser Olmy

strongSwan on x86 Linux seems rock solid.

yeah, same for me going from Linux to Win7.