| CARVIEW |
Select Language
HTTP/1.1 200 OK
Date: Tue, 30 Dec 2025 14:20:34 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Set-Cookie: PHPSESSID=d1c77sal7kelo7plh8rv5aiqtr; expires=Tue, 06-Jan-2026 14:20:34 GMT; Max-Age=604800; path=/; secure; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Encoding: gzip
Vary: Accept-Encoding,User-Agent
Content-Length: 3879
Content-Type: text/html; charset=UTF-8
strongSwan - IPsec VPN for Linux, Android, FreeBSD, macOS, Windows
strongSwan
Open-source, modular and portable IPsec-based VPN solution
Latest Release
Version 6.0.4, 2025-12-12 ChangelogGet the latest open-source GPLv2 version now, or learn more about commercial licensing options
strongSwan is a comprehensive implementation of the Internet Key Exchange (IKE) protocols that allows securing IP traffic in policy- and route-based IPsec scenarios from simple to very complex.
Features
Below you'll find some of the key features of strongSwan. More information and how-tos can be found in the documentation.
Internet Key Exchange (IKE)
- Implements the IKEv2 (RFC 7296) key exchange protocol (IKEv1 is also supported)
- Fully tested support of IPv6 IPsec tunnel and transport mode connections
- Dynamic IP address and interface update with MOBIKE (RFC 4555)
- Automatic insertion and deletion of IPsec-policy-based firewall rules
- NAT-Traversal via UDP encapsulation and port floating (RFC 3947)
- Support of IKEv2 message fragmentation (RFC 7383) to avoid issues with IP fragmentation
- Dead Peer Detection (DPD, RFC 3706) takes care of dangling tunnels
- Virtual IP address pool managed by IKE daemon, DHCP, RADIUS or SQL database
- IKEv2 SAs may be redirected to another gateway (RFC 5685)
- Childless IKEv2 SA initiation is supported (RFC 6023)
- Implemented RFCs and Internet Drafts
Modularity
- A modular plugin system offers great extensibility and flexibility
- Plugins can provide crypto algorithms, credentials, authentication methods, configs, access to IPsec and network stacks and more
- Optional built-in integrity and crypto tests for plugins and libraries
Authentication / Cryptography
- Secure IKEv2 EAP user authentication (EAP-SIM, EAP-AKA, EAP-TLS, EAP-TTLS, EAP-PEAP, EAP-MSCHAPv2, etc.)
- Optional relaying of EAP messages to AAA server via EAP-RADIUS plugin
- Support of IKEv2 Multiple Authentication Exchanges (RFC 4739)
- Authentication based on X.509 certificates or pre-shared keys
- Use of strong signature algorithms with Signature Authentication in IKEv2 (RFC 7427)
- Support for CRLs and OCSP (RFC 6960)
- Storage of private keys and certificates on a smartcard (PKCS #11 interface) or protected by a TPM 2.0
- Support of NIST elliptic curve DH groups and ECDSA signatures and certificates
- Support of X25519 elliptic curve DH group (RFC 8031) and Ed25519 signatures and certificates (RFC 8420)
- Support for multiple classic and post-quantum key exchanges (RFC 9370), including ML-KEM (FIPS 203)
- Trusted Network Connect compliant to PB-TNC (RFC 5793), PA-TNC (RFC 5792), PT-TLS (RFC 6876), PT-EAP (RFC 7171) and SWIMA for PA-TNC (RFC 8412)
Portability
- Runs on Linux 2.6, 3.x, 4.x, 5.x and 6.x kernels
- Has been ported to Android, FreeBSD, macOS, iOS and Windows
- Integration into Linux desktops via NetworkManager plugin
- An Android app is available