mirror/setup-ipsec-vpn
1
0
Fork 0
mirror of synced 2025-04-03 05:13:29 +03:00
Code Issues Projects Releases Wiki Activity

Update IKEv2 config

Browse source 
- Use the AES_GCM128 cipher for improved performance
  Ref: https://libreswan.org/wiki/Benchmarking_and_Performance_testing
- Update docs
This commit is contained in:
hwdsl2 2021-03-06 14:05:24 -06:00
parent 11f8502e3a
commit 1abcd704be
3 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
docs/ikev2-howto-zh.md
View file

@ -109,7 +109,7 @@ To customize IKEv2 or client options, run this script without arguments.
# 创建 VPN 连接 # 创建 VPN 连接
powershell -command "Add-VpnConnection -Name 'My IKEv2 VPN' -ServerAddress '%server_addr%' -TunnelType IKEv2 -AuthenticationMethod MachineCertificate -EncryptionLevel Required -PassThru" powershell -command "Add-VpnConnection -Name 'My IKEv2 VPN' -ServerAddress '%server_addr%' -TunnelType IKEv2 -AuthenticationMethod MachineCertificate -EncryptionLevel Required -PassThru"
# 设置 IPsec 参数 # 设置 IPsec 参数
powershell -command "Set-VpnConnectionIPsecConfiguration -ConnectionName 'My IKEv2 VPN' -AuthenticationTransformConstants GCMAES256 -CipherTransformConstants GCMAES256 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -PfsGroup None -DHGroup Group14 -PassThru -Force" powershell -command "Set-VpnConnectionIPsecConfiguration -ConnectionName 'My IKEv2 VPN' -AuthenticationTransformConstants GCMAES128 -CipherTransformConstants GCMAES128 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -PfsGroup None -DHGroup Group14 -PassThru -Force"
``` ```
另外，你也可以手动创建 VPN 连接。详细步骤请看 <a href="https://wiki.strongswan.org/projects/strongswan/wiki/Win7Config" target="_blank">这里</a>。如果你在配置 IKEv2 时指定了服务器的域名（而不是 IP 地址），则必须在 **Internet地址** 字段中输入该域名。 另外，你也可以手动创建 VPN 连接。详细步骤请看 <a href="https://wiki.strongswan.org/projects/strongswan/wiki/Win7Config" target="_blank">这里</a>。如果你在配置 IKEv2 时指定了服务器的域名（而不是 IP 地址），则必须在 **Internet地址** 字段中输入该域名。

2
docs/ikev2-howto.md
View file

@ -109,7 +109,7 @@ To customize IKEv2 or client options, run this script without arguments.
# Create VPN connection # Create VPN connection
powershell -command "Add-VpnConnection -Name 'My IKEv2 VPN' -ServerAddress '%server_addr%' -TunnelType IKEv2 -AuthenticationMethod MachineCertificate -EncryptionLevel Required -PassThru" powershell -command "Add-VpnConnection -Name 'My IKEv2 VPN' -ServerAddress '%server_addr%' -TunnelType IKEv2 -AuthenticationMethod MachineCertificate -EncryptionLevel Required -PassThru"
# Set IPsec configuration # Set IPsec configuration
powershell -command "Set-VpnConnectionIPsecConfiguration -ConnectionName 'My IKEv2 VPN' -AuthenticationTransformConstants GCMAES256 -CipherTransformConstants GCMAES256 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -PfsGroup None -DHGroup Group14 -PassThru -Force" powershell -command "Set-VpnConnectionIPsecConfiguration -ConnectionName 'My IKEv2 VPN' -AuthenticationTransformConstants GCMAES128 -CipherTransformConstants GCMAES128 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -PfsGroup None -DHGroup Group14 -PassThru -Force"
``` ```
Alternatively, you can manually create the VPN connection. Click <a href="https://wiki.strongswan.org/projects/strongswan/wiki/Win7Config" target="_blank">here</a> for instructions. If you specified the server's DNS name (instead of its IP address) during IKEv2 setup, you must enter the DNS name in the **Internet address** field. Alternatively, you can manually create the VPN connection. Click <a href="https://wiki.strongswan.org/projects/strongswan/wiki/Win7Config" target="_blank">here</a> for instructions. If you specified the server's DNS name (instead of its IP address) during IKEv2 setup, you must enter the DNS name in the **Internet address** field.

4
extras/ikev2setup.sh
View file

@ -756,7 +756,7 @@ cat > "$mc_file" <<EOF
<key>DiffieHellmanGroup</key> <key>DiffieHellmanGroup</key>
<integer>14</integer> <integer>14</integer>
<key>EncryptionAlgorithm</key> <key>EncryptionAlgorithm</key>
<string>AES-256-GCM</string> <string>AES-128-GCM</string>
<key>LifeTimeInMinutes</key> <key>LifeTimeInMinutes</key>
<integer>1410</integer> <integer>1410</integer>
</dict> </dict>
@ -915,7 +915,7 @@ cat > "$sswan_file" <<EOF
"rsa-pss": "true" "rsa-pss": "true"
}, },
"ike-proposal": "aes256-sha256-modp2048", "ike-proposal": "aes256-sha256-modp2048",
"esp-proposal": "aes256gcm16" "esp-proposal": "aes128gcm16"
} }
EOF EOF