IKEV2 EAP User name/Password client on *BSD reddit / BSD ---------------------------------------------------------------------- canadian05 · 2018-04-17 22:01 I'm new to BSD aside from using pfSense as my firewall/router. I'd like to stop running OpenVPN clients on my pfSense machine and connect via IPSEC IKEV2 on a separate 24/7 machine. [Here](https://protonvpn.com/support/macos-ikev2-vpn-setup/) is an example of connecting on MacOS. pfSense does not support remote access/client IKEV2 connections using EAP User name/Password. I was curious if this is possible on a BSD distro. I've considered replacing pfSense with freeBSD or OpenBSD in the past and this would be a small step in that direction if it's possible. Any guidance? ---------------------------------------------------------------------- gonzopancho · 2018-04-18 00:23 > pfSense does not support remote access/client IKEV2 connections using EAP User name/Password. News to me. > I was curious if this is possible on a BSD distro. pfSense is a BSD distro. > I've considered replacing pfSense with freeBSD or OpenBSD in the past and this would be a small step in that direction if it's possible. For IKEv2, you're either going to run [Strongswan](https://wiki.strong swan.org/projects/strongswan/wiki/FreeBSD) or [OpenIKED](https://www.openiked.org). pfSense uses [Strongswan](https://www.freshports.org/security/strongswan). ---------------------------------------------------------------------- canadian05 · 2018-04-18 03:47 To clarify, I don't mean for pfSense to act as a server for clients to connect to. I mean for pfSense to be the client connecting to a server. I haven't been able to find any documentation indicating that it's possible for pfSense to connect as a client using IKEV2 EAP. I've done some trial and error seeing if it would work and I haven't been able to figure it out. If you have any direction or resources I'd appreciate the help. > pfSense is a BSD distro. Yes. But pfSense isn't vanilla BSD. I know there is some level of alteration but not enough to know what I can and cannot mess with outside of the UI. So, I started looking at FreeBSD and OpenBSD as alternatives. This is partly out of curiosity and wanting to learn more. > pfSense uses Strongswan. Part of why I posted here is that I've had trouble finding documentation to use Strongswan for a client connection. As far as I know it's capable of connecting as a remote client, but this is not documented as well as using Strongswan as the server with Windows, Android, iOS, and MacOS as clients. It doesn't help when the OS I want to use is usually the server and is just not as commonly used in general. ---------------------------------------------------------------------- gonzopancho · 2018-04-18 06:15 > To clarify, I don't mean for pfSense to act as a server for clients to connect to. I mean for pfSense to be the client connecting to a server. I see. https://wiki.strongswan.org/projects/strongswan/wiki/IKEv2ClientConfig I've not thought about how to apply this to pfSense. Maybe it goes right in. Don't know. Busy. >> pfSense is a BSD distro. > Yes. But pfSense isn't vanilla BSD. I know there is some level of alteration but not enough to know what I can and cannot mess with outside of the UI. So, I started looking at FreeBSD and OpenBSD as alternatives. This is partly out of curiosity and wanting to learn more. There is nothing wrong with FreeBSD or OpenBSD. Or curiosity or learning. >> pfSense uses Strongswan. > Part of why I posted here is that I've had trouble finding documentation to use Strongswan for a client connection. See above. Also: https://wiki.strongswan.org/projects/strongswan/wiki/MacOSX#Native- application Also: https://wiki.strongswan.org/projects/strongswan/wiki/AndroidVPNClient Also: https://wiki.strongswan.org/projects/strongswan/wiki/NetworkManager While none of these are BSD, it does show that Strongswan gets used for client connections. ---------------------------------------------------------------------- canadian05 · 2018-04-18 07:30 Yes! I just finished getting it to work on Ubuntu. I agree, now that I know what ipsec.conf to use along with some familiarity of how strongswan works it should be doable on BSD. I imagine I SHOULD be able to set it up on pfSense via shell commands/file edits. I wonder it would break something? Might have to boot up a test install to try.