strongSwan

Open-source, modular and portable IPsec-based VPN solution

Latest Release

Version 6.0.0, 2024-12-03 Changelog

strongSwan is a comprehensive implementation of the Internet Key Exchange (IKE) protocols that allows securing IP traffic in policy- and route-based IPsec scenarios from simple to very complex.

More about its features

Features

Below you'll find some of the key features of strongSwan. More information and how-tos can be found in the documentation.

Internet Key Exchange (IKE)

  • Implements the IKEv2 (RFC 7296) key exchange protocol (IKEv1 is also supported)
  • Fully tested support of IPv6 IPsec tunnel and transport mode connections
  • Dynamic IP address and interface update with MOBIKE (RFC 4555)
  • Automatic insertion and deletion of IPsec-policy-based firewall rules
  • NAT-Traversal via UDP encapsulation and port floating (RFC 3947)
  • Support of IKEv2 message fragmentation (RFC 7383) to avoid issues with IP fragmentation
  • Dead Peer Detection (DPD, RFC 3706) takes care of dangling tunnels
  • Virtual IP address pool managed by IKE daemon, DHCP, RADIUS or SQL database
  • Implemented RFCs and Internet Drafts

Modularity

  • A modular plugin system offers great extensibility and flexibility
  • Plugins can provide crypto algorithms, credentials, authentication methods, configs, access to IPsec and network stacks and more
  • Optional built-in integrity and crypto tests for plugins and libraries

Authentication / Cryptography

  • Secure IKEv2 EAP user authentication (EAP-SIM, EAP-AKA, EAP-TLS, EAP-TTLS, EAP-PEAP, EAP-MSCHAPv2, etc.)
  • Optional relaying of EAP messages to AAA server via EAP-RADIUS plugin
  • Support of IKEv2 Multiple Authentication Exchanges (RFC 4739)
  • Authentication based on X.509 certificates or pre-shared keys
  • Use of strong signature algorithms with Signature Authentication in IKEv2 (RFC 7427)
  • Support for CRLs and OCSP (RFC 6960)
  • Storage of private keys and certificates on a smartcard (PKCS #11 interface) or protected by a TPM 2.0
  • Support of NIST elliptic curve DH groups and ECDSA signatures and certificates
  • Support of X25519 elliptic curve DH group (RFC 8031) and Ed25519 signatures and certificates (RFC 8420)
  • Trusted Network Connect compliant to PB-TNC (RFC 5793), PA-TNC (RFC 5792), PT-TLS (RFC 6876), PT-EAP (RFC 7171) and SWIMA for PA-TNC (RFC 8412)

Portability

  • Runs on Linux 2.6, 3.x, 4.x, 5.x and 6.x kernels
  • Has been ported to Android, FreeBSD, macOS, iOS and Windows
  • Integration into Linux desktops via NetworkManager plugin
  • An Android app is available

The strongSwan source code is licensed under the GPLv2 with commercial licensing options available

More about commercial licensing

Documentation and Support

DocumentationstrongSwan is extensively documented

SupportFree and commecial support is available