strongSwan

strongSwan is an open-source IPsec-based virtual private network (VPN) solution for Linux and other Unix-like operating systems. It implements the Internet Key Exchange (IKE) protocols, primarily IKEv2 and, in older deployments, IKEv1, to establish cryptographic associations for IPsec-protected traffic. strongSwan supports a range of authentication methods, including X.509 certificates, PKI-based trust, and pre-shared keys, making it suitable for both remote access and site-to-site VPNs.

Historically, strongSwan originated as a fork of the FreeS/WAN project in the mid-2000s and has since evolved as a comprehensive, actively maintained IPsec stack. The project is modular and userland-driven, with the core IKE daemon known as charon for IKEv2 interactions and, in earlier versions, pluto for IKEv1. strongSwan integrates with the Linux kernel’s IPsec stack via the XFRM interface, enabling efficient packet processing while enforcing policies and SA lifetimes from user space.

Key features include support for IKEv2 mobility and multihoming (MOBIKE), various authentication schemes (EAP, RSA/EC certificates, PSK), and extensive extensibility through plugins. It offers flexible configuration through ipsec.conf and strongswan.conf and provides a robust set of cryptographic algorithms and security associations for both remote access and site-to-site deployments.

Licensing is under the GNU General Public License (GPL) v2 or later. strongSwan is widely used in enterprise, data centers, and embedded environments for secure VPN connections, with deployments ranging from individual laptops to large-scale networks.