Learn L2TP IPsec - Libreswan: Configuration & Features

#Introduction

Libreswan is an open-source fork of Openswan, and one of the oldest and most mature IPsec implementations in the Linux ecosystem. Episode 9 dissects it thoroughly: the ipsec.conf configuration language, secret management in ipsec.secrets, the flagship features, and a complete L2TP/IPsec assembly example.

This understanding matters because Libreswan hosts the L2TP/IPsec architecture we build throughout this series. After this episode, you can read and write Libreswan configuration without guessing — including when you need to adapt it to a production environment.

#The Anatomy of ipsec.conf

#The config setup and conn Blocks

ipsec.conf consists of a config setup block for global settings and conn blocks for each connection. One connection describes one IPsec relationship, complete with both ends. A minimal example:

config setup
    logfile=/var/log/pluto.log
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16
 
conn L2TP-PSK
    type=transport
    left=%any
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any
    authby=secret
    ikev2=never
    phase2alg=aes128-sha1
    pfs=no
    auto=add

#left and right: The Two Ends

Every connection has two ends. left is the local side, right is the remote side. The value %any means accepting any address — the right pattern for remote access. Protocol restrictions are written with leftprotoport=17/1701, meaning the local end is only involved for traffic to UDP port 1701.

Other important columns: ike= for the Phase 1 suite, phase2alg= (or esp=) for the Phase 2 suite, authby=secret|rsasig for the authentication method, and auto=add|start to decide whether the connection is built at boot.

#Managing Secrets: ipsec.secrets

#PSK and RSA Keys

All secret material — PSKs, RSA private keys — is stored in /etc/ipsec.secrets with 0600 permissions. Its format pairs hosts and their material:

%any %any : PSK "satu-kunci-untuk-semua"
203.0.113.10 198.51.100.20 : PSK "kunci-spesifik-host"
#include /etc/ipsec.d/secrets.rpm

The %any %any : PSK "..." form is easiest for remote access because all clients use the same key. For better security, use a key specific to each host pair.

#Libreswan Flagship Features

#NSS and X.509 Certificates

Libreswan uses Mozilla's NSS (Network Security Services) to store keys and certificates. That is why server certificates are not stored as plain files but inside the NSS database at /etc/ipsec.d/. Manage it with certutil:

sudo certutil -A -d sql:/etc/ipsec.d -n server-cert -t ,, -i server.crt
sudo certutil -A -d sql:/etc/ipsec.d -n ca-cert -t CT,, -i ca.crt

The certutil -A -d sql:/etc/ipsec.d command adds a certificate to the database. Full management is covered in episode 16.

#NAT-T and DPD

Libreswan supports NAT Traversal automatically — when NAT is detected, IKE moves to UDP 4500 and ESP is wrapped in UDP — as well as DPD (Dead Peer Detection), which tears down dead peers. Enable them with:

conn L2TP-PSK
    nat_traversal=yes
    force_keepalive=yes
    dpddelay=10
    dpdtimeout=60
    dpdaction=clear

The dpddelay=10 value sends a DPD probe every 10 seconds; if there is no answer within dpdtimeout, the peer is considered dead.

#A Complete L2TP/IPsec Assembly

#Putting It All Together

Assemble all the features into one ready-to-use remote access configuration:

config setup
    logfile=/var/log/pluto.log
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16
 
conn L2TP-PSK
    type=transport
    left=%any
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any
    authby=secret
    ikev2=never
    ike=aes256-sha2;modp2048,aes128-sha1;modp1024
    phase2alg=aes128-sha1
    pfs=no
    nat_traversal=yes
    force_keepalive=yes
    dpddelay=10
    dpdtimeout=60
    dpdaction=clear
    auto=add

Apply and check it:

sudo ipsec setup --restart
sudo ipsec auto --add L2TP-PSK
sudo ipsec status

The ipsec status output must show the L2TP-PSK connection with status added. When a client connects, the status changes to up.

#Closing

Episode 9 dissected Libreswan down to its configuration language: the config setup and conn blocks, the roles of left and right, the choice of ike, esp, authby, and auto, secret management in ipsec.secrets, and the NSS, NAT-T, DPD, and XAUTH features. The complete assembly example built here becomes the foundation of your remote access deployment.

Key takeaways:

• ipsec.conf consists of a global config setup block and conn blocks.
• left is the local end, right the remote end; %any for dynamic addresses.
• authby=secret for PSK, authby=rsasig for certificates.
• Keys and certificates are stored in the NSS database at /etc/ipsec.d.
• force_keepalive and dpd* enable NAT-T and DPD.
• Always verify with ipsec status after loading the configuration.

In the next episode, episode 10, we will discuss strongSwan: configuration and features — the anatomy of ipsec.conf and strongswan.conf, the modern swanctl approach, and the IKEv2, EAP, MOBIKE, and certificate chain features.