====== Pure IPSec VPN on OpenVZ ====== 
Since there is not **Native** support for IPSec in **OpenVZ** kernel, it is not possible to use **openSwan**, **strongSwan** or **Racoon** for **IPSec VPN** on **OpenVZ VM**. This has been changed, a plugin called **//kernel-libipsec//** was introduced after strongSwan Version 5.10. We can use this plugin with TUN to simulate a IPSec support in userspace. 
===== Prerequisites ===== 
==== TUN/TAP check ==== 
First We have to check whether **TUN/TAP** is enabled for the VPS:
<code bash>
cat /dev/net/tun
</code>
We should get the output:
<code bash>
cat: /dev/net/tun: File descriptor in bad state
</code>
Otherwise we cannot continue since **TUN/TAP** support is a **prerequisite**. 
===== Installation ===== 
==== Debian on Non-OpenVZ ==== 
Using APT.
<code bash>
apt-get install strongswan libcharon-extra-plugins
</code> 
==== Get the source code ==== 
Download the source code and decompress.
<code bash>
wget http://download.strongswan.org/strongswan.tar.gz && tar zxvf strongswan* && cd strongswan*
</code> 
==== Dependance === 
Install the packaged which is needed for the compiling:
<code bash>
apt-get update && apt-get install build-essential libgmp3-dev openssl libssl-dev
</code> 
==== Parameters for compiling ==== 
If you want to integrate **StrongSwan** with **Radius**:
<code bash>
./configure --sysconfdir=/etc --disable-sql --disable-mysql --disable-ldap --enable-dhcp --enable-eap-identity --enable-eap-mschapv2 --enable-md4 --enable-xauth-eap --enable-eap-peap --enable-eap-md5 --enable-openssl --enable-shared --enable-unity --enable-eap-tls --enable-eap-ttls --enable-eap-tnc --enable-eap-dynamic --enable-addrblock --enable-eap-radius --enable-radattr --enable-nat-transport --enable-cisco-quirks --enable-kernel-netlink --enable-kernel-libipsec
</code>
Otherwise you can use for a minimal installation:
<code bash>
./configure --sysconfdir=/etc --disable-sql --disable-mysql --disable-ldap --enable-openssl --enable-shared --enable-kernel-libipsec
</code>
==== Compile and install ====
<code bash> make && make install
</code> 
===== Configuration ===== 
==== ipsec.conf ==== 
Edit strongSwan IPsec configuration file:
<code bash>
vi /etc/ipsec.conf
</code>
/etc/ipsec.conf:
<code bash>
# ipsec.conf - strongSwan IPsec configuration file 
config setup
    uniqueids=never
conn %default
    rekey=no
    left=%defaultroute
    leftsubnet=0.0.0.0/0
    right=%any
    dpddelay=300s
    dpdtimeout=1h
    dpdaction=clear
    auto=add
conn ikecommon
    rightsourceip=10.11.0.0/24
    #modeconfig=push
    #esp=aes128-sha1-modp2048
    compress=yes
conn ikev1pskaggressive
    aggressive=yes
    #type=tunnel
    also=ikev1psk
conn ikev1psk
    #authby=xauthpsk
    leftauth=psk
    rightauth=psk
    rightauth2=xauth
    #xauth=server
    also=ikev1
conn ikev1
    keyexchange=ikev1
    #ikelifetime=60m
    #keylife=20m
    #rekeymargin=3m
    #keyingtries=3
    fragmentation=yes
    also=ikecommon
conn L2TP-PSK-NAT
    leftfirewall=yes
    rightfirewall=yes
    also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
    keyexchange=ikev1
    type=transport
    authby=psk
    keyingtries=3
    rekey=no
    leftprotoport=17/1701
    rightprotoport=17/%any
    ike="aes256-sha1-modp2048!"
    esp="aes-sha1!"
</code>
==== strongswan.conf ====
Edit strongSwan configuration file:
<code bash>
vi /etc/strongswan.conf
</code>
Add below
<code bash>
duplicheck.enable = no 
install_virtual_ip = yes 
i_dont_care_about_security_and_use_aggressive_mode_psk = yes 
dns1 = 8.8.8.8 
dns2 = 8.8.4.4
</code>
to ///etc/strongswan.conf// **charon** block:
<code bash>
charon {
# number of worker threads in charon threads = 16
**INSERT HERE**
# send strongswan vendor ID?
# send_vendor_id = yes 
</code>
==== ipsec.secrets ====
Edit file for public key:
<code bash>
vi /etc/ipsec.secrets
</code>
Add below to /etc/ipsec.secrets:
<code bash>
: PSK "YOURPSKKEY" 
YOURUSERNAME : XAUTH "YOURPASSWORD"
</code>
Replace **YOURPSKKEY** **YOURUSERNAME** **YOURPASSWORD** with your entries. 
==== iptables ==== 
Add following rules to iptables:
<code bash>
iptables -A INPUT -p esp -j ACCEPT iptables -A INPUT -p udp --dport 500 -j ACCEPT iptables -A INPUT -p udp --dport 4500 -j ACCEPT
</code>
If your iptables supports MASQUERADE, then:
<code bash>
iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -o venet0 -j MASQUERADE
</code>
Otherwise:
<code bash>
iptables -A POSTROUTING -t nat -s 10.0.0.0/8 -j SNAT --to-source YOURSERVERIP
</code>
Replace **YOURSERVERIP** with your server ip address. 

If you want enable internal communication between VPN clients, add:
<code bash>
iptables -A FORWARD -s 10.0.0.0/8 -j ACCEPT
</code> 
===== Startup ===== 
Start strongSwan:
<code bash>
/usr/local/sbin/ipsec start
</code>
If you want strongSwan running in the foreground, then use:
<code bash>
/usr/local/sbin/ipsec start --nofork
</code>