Documentation
VyOS Documentation
VPN on VyOS
IPsec VPN

IPsec VPN

IPsec (Internet Protocol Security) is a standardized protocol for building secure VPN tunnels with encryption and authentication.

Overview

IPsec provides:

  • Authentication - verifying the identity of the parties
  • Encryption - protecting data from interception
  • Integrity - protection against data tampering
  • Key Exchange - secure key exchange
  • Key Management - key management

VyOS uses strongSwan to implement IPsec.

VPN types:

  • Policy-based - based on static security policies
  • Route-based - based on Virtual Tunnel Interfaces (VTI)

Use cases:

  • Site-to-Site VPN between offices
  • Remote Access (Road Warrior) for mobile users
  • Cloud connectivity (AWS, Azure, GCP)
  • Enterprise WAN

IPsec Protocols

Authentication Header (AH) - RFC 4302

Provides:

  • Data integrity
  • Source authentication
  • Protection against replay attacks

Creates a hash based on the IP header and the data.

Does not provide encryption.

Encapsulating Security Payload (ESP) - RFC 4303

Provides:

  • Data encryption
  • Authentication
  • Integrity
  • Protection against replay attacks

Recommended for most scenarios.

IPsec Modes

Transport Mode

The IPsec header is inserted between the IP header and the upper-layer protocol header.

[IP Header][IPsec Header][TCP/UDP Header][Data]

Used for:

  • Host-to-host communication
  • L2TP/IPsec

Tunnel Mode

The entire original IP packet is encapsulated in a new IP packet.

[New IP Header][IPsec Header][Original IP Header][TCP/UDP Header][Data]

Used for:

  • Site-to-Site VPN
  • Remote Access VPN
  • Gateway-to-gateway

VyOS uses Tunnel Mode by default.

IKE (Internet Key Exchange)

A protocol for securely negotiating IPsec parameters and exchanging keys.

IKEv1

The older version with two phases:

Phase 1 (Main Mode or Aggressive Mode):

  • Mutual authentication
  • Establishing a secure channel (ISAKMP SA)
  • Key exchange via Diffie-Hellman

Phase 2 (Quick Mode):

  • Negotiating the IPsec SA
  • Creating the ESP/AH tunnels

Modes:

  • Main Mode - 6 messages, more secure (for site-to-site)
  • Aggressive Mode - 3 messages, less secure (for road warrior)

IKEv2

The modern version (RFC 7296):

Advantages:

  • Fewer messages (4 instead of 9)
  • Built-in NAT traversal
  • More reliable reconnection (MOBIKE)
  • Better performance
  • Protection against DoS attacks

VyOS recommends using IKEv2.

Authentication Methods

Pre-Shared Key (PSK)

A shared secret key (password) known to both parties.

Advantages:

  • Simple to configure
  • No PKI infrastructure required

Disadvantages:

  • Hard to scale
  • Requires secure key exchange
  • Vulnerable to brute-force (with a weak key)

Use case: Small networks, site-to-site between 2 locations.

RSA Keys

Using RSA keys for authentication.

Advantages:

  • More secure than PSK
  • Easier to manage than a full PKI

Disadvantages:

  • Requires generating and exchanging public keys
  • No certificate revocation

X.509 Certificates (PKI)

Using digital certificates with a Certificate Authority (CA).

Advantages:

  • The most secure method
  • Scalability
  • Certificate revocation (CRL, OCSP)
  • Automatic certificate renewal

Disadvantages:

  • Complex setup
  • Requires PKI infrastructure

Use case: Corporate networks, remote access with many clients.

Dead Peer Detection (DPD)

A mechanism for detecting inactive VPN tunnels.

How it works:

  • Periodically sends keepalive messages
  • If there is no response, considers the peer unreachable
  • Initiates reconnection or closes the tunnel

Parameters:

  • action - the action taken on detection (restart, hold, clear)
  • interval - the check interval (seconds)
  • timeout - the response timeout (seconds)

Route-based VPN (VTI)

Uses a Virtual Tunnel Interface (VTI) to route traffic through IPsec.

Advantages

  • Dynamic routing (OSPF, BGP) over the tunnel
  • Simpler firewall configuration (a single interface)
  • Flexible routing
  • QoS and policy routing
  • Monitoring like a regular interface

Basic configuration

Site A (Initiator):

# VTI interface
set interfaces vti vti0 address 10.10.0.1/30
set interfaces vti vti0 description 'IPsec to Site B'

# IPsec authentication
set vpn ipsec authentication psk site-b id '203.0.113.1'
set vpn ipsec authentication psk site-b id '203.0.113.2'
set vpn ipsec authentication psk site-b secret 'SuperSecretKey123!'

# IKE group (Phase 1)
set vpn ipsec ike-group IKE-SiteB key-exchange 'ikev2'
set vpn ipsec ike-group IKE-SiteB lifetime '28800'
set vpn ipsec ike-group IKE-SiteB proposal 1 dh-group '14'
set vpn ipsec ike-group IKE-SiteB proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-SiteB proposal 1 hash 'sha256'

# ESP group (Phase 2)
set vpn ipsec esp-group ESP-SiteB lifetime '3600'
set vpn ipsec esp-group ESP-SiteB pfs 'dh-group14'
set vpn ipsec esp-group ESP-SiteB proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-SiteB proposal 1 hash 'sha256'

# Peer configuration
set vpn ipsec site-to-site peer site-b authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer site-b authentication pre-shared-secret 'site-b'
set vpn ipsec site-to-site peer site-b connection-type 'initiate'
set vpn ipsec site-to-site peer site-b ike-group 'IKE-SiteB'
set vpn ipsec site-to-site peer site-b default-esp-group 'ESP-SiteB'
set vpn ipsec site-to-site peer site-b local-address '203.0.113.1'
set vpn ipsec site-to-site peer site-b remote-address '203.0.113.2'
set vpn ipsec site-to-site peer site-b vti bind 'vti0'
set vpn ipsec site-to-site peer site-b vti esp-group 'ESP-SiteB'

# Disable route auto-install
set vpn ipsec options disable-route-autoinstall

# Static route over the VTI
set protocols static route 192.168.2.0/24 interface vti0

commit
save

Site B (Responder):

# VTI interface
set interfaces vti vti0 address 10.10.0.2/30
set interfaces vti vti0 description 'IPsec to Site A'

# IPsec authentication
set vpn ipsec authentication psk site-a id '203.0.113.1'
set vpn ipsec authentication psk site-a id '203.0.113.2'
set vpn ipsec authentication psk site-a secret 'SuperSecretKey123!'

# IKE group (Phase 1)
set vpn ipsec ike-group IKE-SiteA key-exchange 'ikev2'
set vpn ipsec ike-group IKE-SiteA lifetime '28800'
set vpn ipsec ike-group IKE-SiteA proposal 1 dh-group '14'
set vpn ipsec ike-group IKE-SiteA proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-SiteA proposal 1 hash 'sha256'

# ESP group (Phase 2)
set vpn ipsec esp-group ESP-SiteA lifetime '3600'
set vpn ipsec esp-group ESP-SiteA pfs 'dh-group14'
set vpn ipsec esp-group ESP-SiteA proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-SiteA proposal 1 hash 'sha256'

# Peer configuration
set vpn ipsec site-to-site peer site-a authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer site-a authentication pre-shared-secret 'site-a'
set vpn ipsec site-to-site peer site-a connection-type 'respond'
set vpn ipsec site-to-site peer site-a ike-group 'IKE-SiteA'
set vpn ipsec site-to-site peer site-a default-esp-group 'ESP-SiteA'
set vpn ipsec site-to-site peer site-a local-address '203.0.113.2'
set vpn ipsec site-to-site peer site-a remote-address '203.0.113.1'
set vpn ipsec site-to-site peer site-a vti bind 'vti0'
set vpn ipsec site-to-site peer site-a vti esp-group 'ESP-SiteA'

# Disable route auto-install
set vpn ipsec options disable-route-autoinstall

# Static route over the VTI
set protocols static route 192.168.1.0/24 interface vti0

commit
save

Verifying the VTI tunnel

show interfaces vti
show vpn ipsec sa
ping 10.10.0.2 source-address 10.10.0.1

Policy-based VPN

Uses traffic selectors (policies) to define which traffic is encrypted.

Basic configuration

Site A:

# IPsec authentication
set vpn ipsec authentication psk site-b id '203.0.113.1'
set vpn ipsec authentication psk site-b id '203.0.113.2'
set vpn ipsec authentication psk site-b secret 'SecretPassword!'

# IKE group
set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2'
set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14'
set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256'

# ESP group
set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256'

# Peer configuration
set vpn ipsec site-to-site peer site-b authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer site-b authentication pre-shared-secret 'site-b'
set vpn ipsec site-to-site peer site-b connection-type 'initiate'
set vpn ipsec site-to-site peer site-b ike-group 'IKE-GROUP'
set vpn ipsec site-to-site peer site-b default-esp-group 'ESP-GROUP'
set vpn ipsec site-to-site peer site-b local-address '203.0.113.1'
set vpn ipsec site-to-site peer site-b remote-address '203.0.113.2'

# Traffic selectors (policies)
set vpn ipsec site-to-site peer site-b tunnel 1 local prefix '192.168.1.0/24'
set vpn ipsec site-to-site peer site-b tunnel 1 remote prefix '192.168.2.0/24'

commit
save

Site B:

# IPsec authentication
set vpn ipsec authentication psk site-a id '203.0.113.1'
set vpn ipsec authentication psk site-a id '203.0.113.2'
set vpn ipsec authentication psk site-a secret 'SecretPassword!'

# IKE group
set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2'
set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14'
set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256'

# ESP group
set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256'

# Peer configuration
set vpn ipsec site-to-site peer site-a authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer site-a authentication pre-shared-secret 'site-a'
set vpn ipsec site-to-site peer site-a connection-type 'respond'
set vpn ipsec site-to-site peer site-a ike-group 'IKE-GROUP'
set vpn ipsec site-to-site peer site-a default-esp-group 'ESP-GROUP'
set vpn ipsec site-to-site peer site-a local-address '203.0.113.2'
set vpn ipsec site-to-site peer site-a remote-address '203.0.113.1'

# Traffic selectors (policies)
set vpn ipsec site-to-site peer site-a tunnel 1 local prefix '192.168.2.0/24'
set vpn ipsec site-to-site peer site-a tunnel 1 remote prefix '192.168.1.0/24'

commit
save

Remote Access VPN (Road Warrior)

IPsec IKEv2 for mobile clients.

Server configuration

# ESP group
set vpn ipsec esp-group ESP-RW lifetime '3600'
set vpn ipsec esp-group ESP-RW pfs 'disable'
set vpn ipsec esp-group ESP-RW proposal 1 encryption 'aes128gcm128'
set vpn ipsec esp-group ESP-RW proposal 1 hash 'sha256'

# IKE group
set vpn ipsec ike-group IKE-RW key-exchange 'ikev2'
set vpn ipsec ike-group IKE-RW lifetime '7200'
set vpn ipsec ike-group IKE-RW proposal 1 dh-group '14'
set vpn ipsec ike-group IKE-RW proposal 1 encryption 'aes128gcm128'
set vpn ipsec ike-group IKE-RW proposal 1 hash 'sha256'

# IP pool for clients
set vpn ipsec remote-access pool rw-pool name-server '8.8.8.8'
set vpn ipsec remote-access pool rw-pool name-server '8.8.4.4'
set vpn ipsec remote-access pool rw-pool prefix '10.255.0.0/24'

# Remote access connection
set vpn ipsec remote-access connection rw authentication client-mode 'eap-mschapv2'
set vpn ipsec remote-access connection rw authentication local-id '203.0.113.1'
set vpn ipsec remote-access connection rw authentication server-mode 'x509'
set vpn ipsec remote-access connection rw authentication x509 ca-certificate 'CA1'
set vpn ipsec remote-access connection rw authentication x509 certificate 'SERVER1'
set vpn ipsec remote-access connection rw esp-group 'ESP-RW'
set vpn ipsec remote-access connection rw ike-group 'IKE-RW'
set vpn ipsec remote-access connection rw local-address '203.0.113.1'
set vpn ipsec remote-access connection rw pool 'rw-pool'

# User authentication
set vpn ipsec remote-access connection rw authentication local-users username alice password 'SecurePass123!'
set vpn ipsec remote-access connection rw authentication local-users username bob password 'AnotherPass456!'

commit
save

Certificates for Remote Access

Generate the CA:

generate pki ca install ca-name CA1

Generate the server certificate:

generate pki certificate sign ca-name CA1 install certificate-name SERVER1

Export the CA certificate for clients:

show pki ca CA1 certificate

Encryption Algorithms

IKE Encryption

Recommended (in descending priority):

  • aes256gcm128 - AES-256 GCM (AEAD, the most modern)
  • aes256 - AES-256 CBC
  • aes192 - AES-192 CBC
  • aes128gcm128 - AES-128 GCM
  • aes128 - AES-128 CBC

Deprecated (not recommended):

  • 3des - Triple DES
  • des - DES

Hash Algorithms

Recommended:

  • sha512 - SHA-512
  • sha384 - SHA-384
  • sha256 - SHA-256 (the optimal balance)

Deprecated:

  • sha1 - SHA-1 (vulnerable)
  • md5 - MD5 (vulnerable)

Diffie-Hellman Groups

Recommended:

  • 20 - NIST P-384 (ECC, high security)
  • 19 - NIST P-256 (ECC, optimal)
  • 16 - 4096-bit MODP
  • 14 - 2048-bit MODP (the minimum acceptable)

Deprecated:

  • 5 - 1536-bit MODP
  • 2 - 1024-bit MODP (weak)

Perfect Forward Secrecy (PFS)

PFS uses a separate DH exchange for each IPsec SA:

set vpn ipsec esp-group ESP-GROUP pfs 'dh-group14'

Options:

  • enable - use the DH group from IKE
  • dh-groupN - a specific DH group
  • disable - no PFS (not recommended)

Dead Peer Detection (DPD)

DPD configuration

set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart'
set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '30'
set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '120'

action:

  • restart - restart the tunnel
  • hold - hold the tunnel
  • clear - clear the tunnel

interval: The check interval (seconds), default 30.

timeout: The response timeout (seconds), default 120.

DPD recommendations

  • Site-to-Site: action restart, interval 30, timeout 120
  • Remote Access: action clear, interval 15, timeout 60
  • Unstable connections: lower interval and timeout

NAT Traversal

IPsec ESP is incompatible with NAT (it modifies packets, which breaks the integrity check).

NAT-T (NAT Traversal) solves the problem:

  • Encapsulates ESP in UDP port 4500
  • Automatically detects NAT
  • Enabled by default in VyOS

Configuration behind NAT

If VyOS is behind NAT:

set vpn ipsec site-to-site peer site-b local-address '192.168.1.1'
set vpn ipsec site-to-site peer site-b remote-address '203.0.113.2'
  • local-address - the internal IP of VyOS
  • remote-address - the public IP of the remote peer

VyOS uses NAT-T automatically.

Configuration Examples

Site-to-Site VTI with IKEv2 and AES-256

HQ (Initiator):

# VTI
set interfaces vti vti10 address 172.16.0.1/30

# PSK
set vpn ipsec authentication psk branch-01 id '198.51.100.1'
set vpn ipsec authentication psk branch-01 id '203.0.113.10'
set vpn ipsec authentication psk branch-01 secret 'MyStrongPassword123!@#'

# IKE
set vpn ipsec ike-group IKE-BRANCH key-exchange 'ikev2'
set vpn ipsec ike-group IKE-BRANCH lifetime '28800'
set vpn ipsec ike-group IKE-BRANCH proposal 1 dh-group '14'
set vpn ipsec ike-group IKE-BRANCH proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-BRANCH proposal 1 hash 'sha256'
set vpn ipsec ike-group IKE-BRANCH dead-peer-detection action 'restart'
set vpn ipsec ike-group IKE-BRANCH dead-peer-detection interval '30'
set vpn ipsec ike-group IKE-BRANCH dead-peer-detection timeout '120'

# ESP
set vpn ipsec esp-group ESP-BRANCH lifetime '3600'
set vpn ipsec esp-group ESP-BRANCH pfs 'dh-group14'
set vpn ipsec esp-group ESP-BRANCH proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-BRANCH proposal 1 hash 'sha256'

# Peer
set vpn ipsec site-to-site peer branch-01 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer branch-01 authentication pre-shared-secret 'branch-01'
set vpn ipsec site-to-site peer branch-01 connection-type 'initiate'
set vpn ipsec site-to-site peer branch-01 ike-group 'IKE-BRANCH'
set vpn ipsec site-to-site peer branch-01 default-esp-group 'ESP-BRANCH'
set vpn ipsec site-to-site peer branch-01 local-address '198.51.100.1'
set vpn ipsec site-to-site peer branch-01 remote-address '203.0.113.10'
set vpn ipsec site-to-site peer branch-01 vti bind 'vti10'
set vpn ipsec site-to-site peer branch-01 vti esp-group 'ESP-BRANCH'

# Options
set vpn ipsec options disable-route-autoinstall

# Routing
set protocols static route 192.168.10.0/24 interface vti10

commit
save

Branch (Responder):

# VTI
set interfaces vti vti10 address 172.16.0.2/30

# PSK
set vpn ipsec authentication psk hq id '198.51.100.1'
set vpn ipsec authentication psk hq id '203.0.113.10'
set vpn ipsec authentication psk hq secret 'MyStrongPassword123!@#'

# IKE
set vpn ipsec ike-group IKE-HQ key-exchange 'ikev2'
set vpn ipsec ike-group IKE-HQ lifetime '28800'
set vpn ipsec ike-group IKE-HQ proposal 1 dh-group '14'
set vpn ipsec ike-group IKE-HQ proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-HQ proposal 1 hash 'sha256'
set vpn ipsec ike-group IKE-HQ dead-peer-detection action 'restart'
set vpn ipsec ike-group IKE-HQ dead-peer-detection interval '30'
set vpn ipsec ike-group IKE-HQ dead-peer-detection timeout '120'

# ESP
set vpn ipsec esp-group ESP-HQ lifetime '3600'
set vpn ipsec esp-group ESP-HQ pfs 'dh-group14'
set vpn ipsec esp-group ESP-HQ proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-HQ proposal 1 hash 'sha256'

# Peer
set vpn ipsec site-to-site peer hq authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer hq authentication pre-shared-secret 'hq'
set vpn ipsec site-to-site peer hq connection-type 'respond'
set vpn ipsec site-to-site peer hq ike-group 'IKE-HQ'
set vpn ipsec site-to-site peer hq default-esp-group 'ESP-HQ'
set vpn ipsec site-to-site peer hq local-address '203.0.113.10'
set vpn ipsec site-to-site peer hq remote-address '198.51.100.1'
set vpn ipsec site-to-site peer hq vti bind 'vti10'
set vpn ipsec site-to-site peer hq vti esp-group 'ESP-HQ'

# Options
set vpn ipsec options disable-route-autoinstall

# Routing
set protocols static route 192.168.1.0/24 interface vti10

commit
save

Hub-and-Spoke with Multiple Branches

Hub:

# VTI for Branch 1
set interfaces vti vti10 address 172.16.10.1/30
set vpn ipsec authentication psk branch-01 id 'hub'
set vpn ipsec authentication psk branch-01 id 'branch-01'
set vpn ipsec authentication psk branch-01 secret 'Branch01Secret!'

set vpn ipsec site-to-site peer branch-01 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer branch-01 authentication pre-shared-secret 'branch-01'
set vpn ipsec site-to-site peer branch-01 connection-type 'respond'
set vpn ipsec site-to-site peer branch-01 ike-group 'IKE-BRANCHES'
set vpn ipsec site-to-site peer branch-01 default-esp-group 'ESP-BRANCHES'
set vpn ipsec site-to-site peer branch-01 local-address '198.51.100.1'
set vpn ipsec site-to-site peer branch-01 remote-address '203.0.113.10'
set vpn ipsec site-to-site peer branch-01 vti bind 'vti10'
set vpn ipsec site-to-site peer branch-01 vti esp-group 'ESP-BRANCHES'

# VTI for Branch 2
set interfaces vti vti20 address 172.16.20.1/30
set vpn ipsec authentication psk branch-02 id 'hub'
set vpn ipsec authentication psk branch-02 id 'branch-02'
set vpn ipsec authentication psk branch-02 secret 'Branch02Secret!'

set vpn ipsec site-to-site peer branch-02 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer branch-02 authentication pre-shared-secret 'branch-02'
set vpn ipsec site-to-site peer branch-02 connection-type 'respond'
set vpn ipsec site-to-site peer branch-02 ike-group 'IKE-BRANCHES'
set vpn ipsec site-to-site peer branch-02 default-esp-group 'ESP-BRANCHES'
set vpn ipsec site-to-site peer branch-02 local-address '198.51.100.1'
set vpn ipsec site-to-site peer branch-02 remote-address '203.0.113.20'
set vpn ipsec site-to-site peer branch-02 vti bind 'vti20'
set vpn ipsec site-to-site peer branch-02 vti esp-group 'ESP-BRANCHES'

# Routing
set protocols static route 192.168.10.0/24 interface vti10
set protocols static route 192.168.20.0/24 interface vti20

commit
save

Remote Access with EAP-MSCHAPv2

# ESP/IKE groups
set vpn ipsec esp-group ESP-MOBILE lifetime '3600'
set vpn ipsec esp-group ESP-MOBILE proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-MOBILE proposal 1 hash 'sha256'

set vpn ipsec ike-group IKE-MOBILE key-exchange 'ikev2'
set vpn ipsec ike-group IKE-MOBILE proposal 1 dh-group '14'
set vpn ipsec ike-group IKE-MOBILE proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-MOBILE proposal 1 hash 'sha256'

# IP pool
set vpn ipsec remote-access pool mobile-pool name-server '8.8.8.8'
set vpn ipsec remote-access pool mobile-pool prefix '10.255.0.0/24'

# Remote access connection
set vpn ipsec remote-access connection mobile authentication client-mode 'eap-mschapv2'
set vpn ipsec remote-access connection mobile authentication local-id 'vpn.company.com'
set vpn ipsec remote-access connection mobile authentication server-mode 'x509'
set vpn ipsec remote-access connection mobile authentication x509 ca-certificate 'CompanyCA'
set vpn ipsec remote-access connection mobile authentication x509 certificate 'VPNServer'
set vpn ipsec remote-access connection mobile esp-group 'ESP-MOBILE'
set vpn ipsec remote-access connection mobile ike-group 'IKE-MOBILE'
set vpn ipsec remote-access connection mobile local-address '203.0.113.1'
set vpn ipsec remote-access connection mobile pool 'mobile-pool'

# Users
set vpn ipsec remote-access connection mobile authentication local-users username john password 'JohnPass123!'
set vpn ipsec remote-access connection mobile authentication local-users username jane password 'JanePass456!'
set vpn ipsec remote-access connection mobile authentication local-users username admin password 'AdminSecure789!'

commit
save

Operational Commands

Viewing IPsec status

All SAs (Security Associations):

show vpn ipsec sa

Details of a specific peer:

show vpn ipsec sa peer 203.0.113.10

IKE SA:

show vpn ike sa

Viewing the configuration

show configuration commands | grep ipsec

Statistics

show vpn ipsec statistics

Debug

Enable logging:

set vpn ipsec logging log-level 2
commit

Levels (0-4):

  • 0 - critical errors only
  • 1 - errors
  • 2 - information (recommended for troubleshooting)
  • 3 - debug
  • 4 - verbose debug

Viewing the logs:

show log vpn ipsec

Or via journald:

journalctl -u strongswan

Restarting a tunnel

restart vpn ipsec peer branch-01

All tunnels:

restart vpn

Reset SA

reset vpn ipsec peer branch-01

Integration

With Firewall

Allow IKE and ESP:

# IKE (UDP 500)
set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 destination port 500
set firewall ipv4 input filter rule 100 protocol udp
set firewall ipv4 input filter rule 100 description 'IPsec IKE'

# NAT-T (UDP 4500)
set firewall ipv4 input filter rule 101 action accept
set firewall ipv4 input filter rule 101 destination port 4500
set firewall ipv4 input filter rule 101 protocol udp
set firewall ipv4 input filter rule 101 description 'IPsec NAT-T'

# ESP (protocol 50)
set firewall ipv4 input filter rule 102 action accept
set firewall ipv4 input filter rule 102 protocol esp
set firewall ipv4 input filter rule 102 description 'IPsec ESP'

commit

For VTI interfaces:

set firewall ipv4 input filter rule 200 action accept
set firewall ipv4 input filter rule 200 inbound-interface name vti0
set firewall ipv4 input filter rule 200 description 'Allow from VPN'

commit

With NAT

Exclude VPN traffic from NAT:

# Exclude site-to-site VPN traffic
set nat source rule 100 destination address 192.168.10.0/24
set nat source rule 100 exclude
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24

# Regular NAT for internet
set nat source rule 200 outbound-interface name eth0
set nat source rule 200 source address 192.168.1.0/24
set nat source rule 200 translation address masquerade

commit

With dynamic routing

OSPF over VTI:

set interfaces vti vti0 address 172.16.0.1/30

set protocols ospf interface vti0 area 0
set protocols ospf interface vti0 authentication md5 key-id 1 md5-key 'OspfSecret!'
set protocols ospf interface vti0 network point-to-point

commit

BGP over VTI:

set interfaces vti vti0 address 172.16.0.1/30

set protocols bgp system-as 65001
set protocols bgp neighbor 172.16.0.2 remote-as 65002
set protocols bgp neighbor 172.16.0.2 update-source 172.16.0.1

commit

Troubleshooting

The tunnel does not come up

Check the status:

show vpn ipsec sa

If it is empty, the tunnel is not established.

Check:

  1. Peer reachability:

    ping 203.0.113.10

  2. Firewall rules:

    show firewall

    UDP 500, UDP 4500, and ESP (50) must be allowed.

  3. The PSK matches on both sides

  4. The IKE and ESP parameters match

  5. Logs:

    show log vpn ipsec

Phase 1 succeeds, Phase 2 fails

Check:

  • The ESP group parameters (encryption, hash)
  • The traffic selectors (local/remote prefix)
  • That the firewall is not blocking ESP

The tunnel drops intermittently

Check:

  • The DPD settings
  • MTU problems (set MTU 1400 on the VTI)
  • An unstable connection (change the DPD interval)

Low performance

  1. MTU optimization:

    set interfaces vti vti0 mtu 1400
commit

  2. Hardware offloading: Check for AES-NI support on the CPU:

    cat /proc/cpuinfo | grep aes

  3. Use AES-GCM:

    set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256gcm128'

  4. Disable PFS (if not critical):

    set vpn ipsec esp-group ESP-GROUP pfs 'disable'

NAT Traversal problems

If the peer is behind NAT and the tunnel does not work:

  1. Make sure UDP 4500 is allowed
  2. Verify that NAT-T is enabled (default)
  3. Try forcing encapsulation:
    set vpn ipsec site-to-site peer site-b force-udp-encapsulation
commit

Certificate problems

Check the certificates:

show pki ca
show pki certificate

Make sure that:

  • The CA certificate is installed
  • The server certificate is signed by the CA
  • The certificate has not expired
  • The CN (Common Name) matches the local-id

Security

Recommendations

  1. Use IKEv2 - more secure than IKEv1

  2. Strong algorithms:

    • Encryption: AES-256-GCM or AES-256
    • Hash: SHA-256 or higher
    • DH Group: 14 or higher

  3. PFS (Perfect Forward Secrecy):

    set vpn ipsec esp-group ESP-GROUP pfs 'dh-group14'

  4. Certificate authentication for remote access (instead of PSK)

  5. Strong PSKs:

    • At least 20 characters
    • Random characters
    • Use a password generator

  6. Firewall for VPN traffic:

    set firewall ipv4 forward filter rule 100 action accept
set firewall ipv4 forward filter rule 100 inbound-interface name vti0
set firewall ipv4 forward filter rule 100 destination address 192.168.1.0/24

  7. Logging:

    set vpn ipsec logging log-level 1

  8. Regular updates of VyOS for security patches

  9. Monitoring of tunnel state

  10. Certificate rotation - renew certificates before they expire

Avoid

  • IKEv1 Aggressive Mode (vulnerable to offline attacks)
  • Weak algorithms: 3DES, MD5, SHA1, DH group < 14
  • Weak PSKs (short or dictionary passwords)
  • Disabling DPD
  • Disabling PFS (where possible)

Performance

Optimization

  1. Hardware AES: Use a CPU with AES-NI instructions to speed up encryption.

  2. AES-GCM:

    set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256gcm128'

    GCM is faster than CBC and provides AEAD.

  3. MTU tuning:

    set interfaces vti vti0 mtu 1400
commit

    Reduces fragmentation.

  4. MSS clamping:

    set firewall ipv4 forward filter rule 10 action accept
set firewall ipv4 forward filter rule 10 protocol tcp
set firewall ipv4 forward filter rule 10 tcp flags syn
set firewall ipv4 forward filter rule 10 tcp mss 1360

  5. Rekey optimization:

    set vpn ipsec ike-group IKE-GROUP lifetime '28800'
set vpn ipsec esp-group ESP-GROUP lifetime '3600'

    A balance between security and performance.

Benchmark

Testing throughput:

iperf3 -c 192.168.2.1 -t 60

Over the VTI:

iperf3 -c 172.16.0.2 -B 172.16.0.1 -t 60

Best Practices

  1. Route-based VPN (VTI) - for flexibility
  2. IKEv2 - for reliability
  3. Certificates - for scalability
  4. DPD - always enabled
  5. PFS - for forward secrecy
  6. Logging - enabled for troubleshooting
  7. Monitoring - track tunnel state
  8. Documentation - describe each tunnel
  9. Naming convention - meaningful names (site-name, not ip)
  10. Redundancy - backup tunnels for critical links

Limitations

  • Maximum performance depends on the CPU (AES encryption)
  • Policy-based VPN does not support dynamic routing
  • Remote access is limited to IKEv2 (IKEv1 is not supported for road warrior)
  • Certificate revocation requires a CRL or OCSP setup

Next Steps

Reviewed by OpenNix LLC · Last updated on
WireGuard VPN on VyOS - Setup and ExamplesOpenVPN