How to setup ikev2 vpn server on ubuntu 22.04

Setting up an IKEv2 VPN server on Ubuntu 22.04 allows secure remote connections with strong encryption and authentication. 

Step 1: Install Required Packages

To run an IKEv2 VPN, you need strongSwan and other supporting tools installed:

sudo apt update
sudo apt install strongswan strongswan-pki libcharon-extra-plugins -y

Step 2: Generate Server Certificates

Certificates are required to secure VPN connections and authenticate the server to clients:

mkdir -p ~/pki/{cacerts,certs,private}
ipsec pki --get --outform pem > ~/pki/private/key.key
ipsec pki --self --in ~/pki/private/ca.key --dn "CN=VPN-CA" --ca --out from pem > ~/pki/cacerts/ca.pem

Step 3: Create Server Certificate

Create a key and certificate so the VPN server can authenticate clients securely:

ipsec pki --gen --out from pem > ~/pki/private/server.key
ipsec pki --pub --in ~/pki/private/server.key | ipsec pki --issue --cacert ~/pki/cacerts/ca.pem --cakey ~/pki/private/ca.key --dn "CN=vpn.example.com" --san "vpn.example.com" --flag serverAuth --flag ikeIntermediate --outform pem > ~/pki/certs/server.pem

Step 4: Configure StrongSwan

Edit the StrongSwan configuration files to define IKEv2 policies, authentication, and IP ranges for clients:

sudo nano /etc/ipsec.conf

Add:

config setup
    charondebug="ike 2, knl 2, cfg 2"

conn ikev2-vpn
    auto=add
    compress=no
    type=tunnel
    key exchange=ikev2
    dp action=clear
    left=%any
    leftcert=server.pem
    leftsendcert=always
    leftsubnet=0.0.0.0/0
    right=%any
    rightdns=8.8.8.8,8.8.4.4
    rightsourceip=10.10.10.0/24
    ike=aes256-sha256-modp2048!
    esp=aes256-sha256!

Step 5: Start VPN Server

Enable and restart the StrongSwan service, then verify that the VPN is active:

sudo systemctl enable strongswan
sudo systemctl restart strongswan
sudo systemctl status strongswan