6.5. Manually configuring an IPsec host-to-site VPN with certificate-based authentication

Procedure

1. If Libreswan is not yet installed:

   1. Install the libreswan package:

      # dnf install libreswan

   2. Initialize the Network Security Services (NSS) database:

      # ipsec initnss

      The command creates the database in the /var/lib/ipsec/nss/ directory.

   3. Enable and start the ipsec service:

      # systemctl enable --now ipsec

   4. Open the IPsec ports and protocols in the firewall:

      # firewall-cmd --permanent --add-service="ipsec"
      # firewall-cmd --reload

2. Import the PKCS #12 file into the NSS database:

   # ipsec import ~/file.p12
   Enter password for PKCS12 file: <password>
   pk12util: PKCS12 IMPORT SUCCESSFUL
   correcting trust bits for Example-CA

3. Display the nicknames of the server and CA certificates:

   # certutil -L -d /var/lib/ipsec/nss/
   Certificate Nickname     Trust Attributes
                            SSL,S/MIME,JAR/XPI
   
   vpn-gateway              u,u,u
   Example-CA               CT,,
   ...

   You need this information for the configuration file.

4. Create a .conf file for the connection in the /etc/ipsec.d/ directory. For example, create the /etc/ipsec.d/host-to-site.conf file with the following settings:

   1. Add a config setup section to enable CRL checks:

      config setup
          crl-strict=yes
          crlcheckinterval=1h

      The settings specified in the example include the following:

      crl-strict=yes

      Enables CRL checks. Authenticating clients are rejected if no CRL is available in the NSS database.

      crlcheckinterval=1h

      Re-fetches the CRL from the URL specified in the server’s certificate after the specified period.

   2. Add a section for the gateway:

      conn <connection_name>
          # General setup and authentication type
          auto=start
          ikev2=insist
          authby=rsasig
      
          # VPN gateway settings
          left=%defaultroute
          leftid=%fromcert
          leftcert="<server_certificate_nickname>"
          leftrsasigkey=%cert
          leftsendcert=always
          leftsubnet=192.0.2.0/24
          rekey=no
          mobike=yes
          narrowing=yes
      
          # Client-related settings
          right=%any
          rightid=%fromcert
          rightrsasigkey=%cert
          rightaddresspool=198.51.100.129-198.51.100.254
          rightmodecfgclient=yes
          modecfgclient=yes
          modecfgdns=192.0.2.5
          modecfgdomains="example.com"
      
          # Dead Peer Detection
          dpddelay=30
          dpdtimeout=120
          dpdaction=clear

      The settings specified in the example include the following:

      ikev2=insist

      Defines the modern IKEv2 protocol as the only allowed protocol without fallback to IKEv1.

      left=%defaultroute

      Dynamically sets the IP address of the default route interface when the ipsec service starts. Alternatively, you can set the left parameter to the IP address or the FQDN of the host.

      leftid=%fromcert and rightid=%fromcert

      Configures Libreswan to retrieve the identity from the distinguished name (DN) field of the certificate.

      leftcert="<server_certificate_nickname>"

      Sets the nickname of the server’s certificate used in the NSS database.

      leftrsasigkey=%cert and rightrsasigkey=%cert

      Configures Libreswan to use the RSA public key embedded in the certificate.

      leftsendcert=always

      Instructs the gateway to always send the certificate, so that clients can validate it against the CA certificate.

      leftsubnet=<subnets>

      Specifies the subnets connected to the gateway that clients can access through the tunnel.

      mobike=yes

      Enables clients to seamlessly roam among networks.

      rightaddresspool=<ip_range>

      Specifies from which range the gateway can assign IP addresses to the clients.

      modecfgclient=yes

      Enables clients to receive the DNS server IP set in the modecfgdns parameter and the DNS search domain set in modecfgdomains.

   For details about all parameters used in the example, see the ipsec.conf(5) man page on your system.

5. Enable packet forwarding:

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

6. Restart the ipsec service:

   # systemctl restart ipsec

   If you use auto=start in the configuration file, the connection is automatically activated. With other methods, additional steps are required to activate the connection. For details, see the ipsec.conf(5) man page on your system.

Verification

1. Configure a client and connect to the VPN gateway.

2. Check if the service loaded the CRL and added the entries to the NSS database:

   # ipsec listcrls
   
   List of CRLs:
   
   issuer: CN=Example-CA
   revoked certs: 1
   updates: this Tue Jul 15 10:22:36 2025
            next Sun Jan 11 10:22:36 2026
   
   List of CRL fetch requests:
   
   Jul 15 15:13:56 2025, trials: 1
          issuer:  'CN=Example-CA'
          distPts: 'https://ca.example.com/crl.pem'

Procedure

1. Initialize the Network Security Services (NSS) database:

   # ipsec initnss

   The command creates the database in the /var/lib/ipsec/nss/ directory.

2. Import the PKCS #12 file into the NSS database:

   # ipsec import ~/file.p12
   Enter password for PKCS12 file: <password>
   pk12util: PKCS12 IMPORT SUCCESSFUL
   correcting trust bits for Example-CA

3. Display the nicknames of the user and CA certificates:

   # certutil -L -d /var/lib/ipsec/nss/
   Certificate Nickname     Trust Attributes
                            SSL,S/MIME,JAR/XPI
   
   user                     u,u,u
   Example-CA               CT,,
   ...

   You require this information in the configuration file.

4. Press the Super key, type Settings, and press Enter to open the GNOME Settings application.
5. Click the + button next to the VPN entry.
6. Select IPsec based VPN from the list.

7. On the Identity tab, fill the fields as follows:

   Expand

   표 6.1. Identity tab settings

   Field name	Value	Corresponding ipsec.conf parameter
   Name	<networkmanager_profile_name>	N/A
   Gateway	<ip_address_or_fqdn_of_the_gateway>	right
   Type	IKEv2 (certificate)	authby
   Group name	%fromcert	leftid
   Certificate name	<user_certificate_nickname>	leftcert
   Remote ID	%fromcert	rightid

   Show more
8. Click Advanced.

9. In the Advanced properties window, fill the fields of the Connectivity tab as follows:

   Expand

   표 6.2. Connectivity tab settings

   Field name	Value	Corresponding ipsec.conf parameter
   Remote Network	192.0.2.0/24	rightsubnet
   Narrowing	Selected	narrowing
   Enable MOBIKE	yes	mobike
   Delay	30	dpddelay
   Timeout	120	dpdtimeout
   Action	Clear	dpdaction

   Show more
10. Click Apply to return to the connection settings.
11. Click Apply to save the connection.
12. In the Network tab of the Settings application, toggle the switch next to the VPN profile to activate the connection.