Openwrt 路由器，使用 strongswan 配置 ikev2 服务

[wuruxu]

背景：方便在外面连接家中网络
软件环境 OpenWrt SNAPSHOT, r27700 / Linux OpenWrt 6.6.54 / Strongswan 5.9.14
配置 /etc/config/ipsec

config 'ipsec'
	list listen 'wan'
	option 'zone' 'ssvpn'

config 'remote' 'acme'
	option 'enabled' '1'
	option 'gateway' 'any'
	option 'authentication_method' 'pubkey'
	option 'local_gateway' 'xyz.mydomain.cn'
	option 'local_cert' 'xyz.mydomain.cn.cer'
	option 'local_key' 'xyz.mydomain.cn.key'
	option 'rekeytime' '6h'
	option 'keyingretries' '3'
	option 'mobike' '1'
	option 'fragmentation' 'yes'
	option 'keyexchange' 'ikev2'
	option 'local_identifier' 'xyz.mydomain.cn'
	#option 'dpdaction' 'clear'
	list 'local_sourceip' '0.0.0.0'
	list 'local_sourceip' '::'
	list 'crypto_proposal' 'ike_proposal1'
	list 'crypto_proposal' 'ike_proposal2'
	list 'tunnel' 'sstun'
	list 'pools' 'ipv4addr'

config 'crypto_proposal' 'ike_proposal1'
	option 'encryption_algorithm' 'chacha20poly1305'
	option 'dh_group' 'curve25519'
	option 'prf_algorithm' 'prfsha512'

config 'crypto_proposal' 'ike_proposal2'
	option 'encryption_algorithm' 'aes256gcm16'
	option 'dh_group' 'curve25519'
	option 'prf_algorithm' 'prfsha512'

# we don't specify subnets because we're going to use XFRM-interfaced based routes instead
config 'tunnel' 'sstun'
	list 'local_subnet' '0.0.0.0/0'
	#list 'remote_subnet' '0.0.0.0/0'
	list 'remote_subnet' 'dynamic'
	list 'remote_subnet' '224.0.0.0/4'
	option 'if_id' '666'
	option 'rekeytime' '1h'
	option 'dpdaction' 'clear'
	option 'startaction' 'none'
	option 'closeaction' 'none'
	list   'crypto_proposal' 'esp_proposal1'
	list   'crypto_proposal' 'esp_proposal2'

config 'crypto_proposal' 'esp_proposal1'
	option 'encryption_algorithm' 'chacha20poly1305'
	option 'dh_group' 'x25519'

config 'crypto_proposal' 'esp_proposal2'
	option 'encryption_algorithm' 'aes256gcm'
	option 'dh_group' 'modp2048'

config 'pools' 'ipv4addr'
	option 'addrs' '192.168.166.0/24'
	list 'dns' '192.168.163.1'

配置 VPN 用户/etc/swanctl/conf.d/10.EAP_MSCHAPv2.users.conf

secrets {
    eap-user1 {
        id = user1
        secret = "user11980#"
    }
}