2023-02-26 15:03:53 +00:00
|
|
|
# References
|
|
|
|
|
|
|
|
|
|
- https://github.com/hwdsl2/docker-ipsec-vpn-server
|
2023-04-04 21:54:27 +00:00
|
|
|
|
|
|
|
|
# Notes
|
|
|
|
|
|
2023-04-04 22:39:09 +00:00
|
|
|
> IKEv2 mode has improvements over IPsec/L2TP and IPsec/XAuth ("Cisco IPsec"), and does not require an IPsec PSK, username or password.
|
|
|
|
|
|
|
|
|
|
--> Therefore, IKEv2 only was chosen as preset via the environment variables of the provided docker-compose.yml.
|
|
|
|
|
|
2023-04-04 21:54:27 +00:00
|
|
|
````
|
|
|
|
|
# copy IKEv2 VPN profile from docker container onto host
|
|
|
|
|
docker cp ipsec-vpn-server:/etc/ipsec.d/vpnclient.p12 ./
|
|
|
|
|
|
2023-04-04 22:20:21 +00:00
|
|
|
# inspect randomly created certificate password
|
|
|
|
|
docker logs ipsec-vpn-server
|
|
|
|
|
|
|
|
|
|
# elevated powershell; import the VPN profile into Windows using the password from docker logs above
|
2023-04-04 22:29:06 +00:00
|
|
|
# if you have not chosen to use a randomly created password (env var VPN_PROTECT_CONFIG=yes), then use a blank entry and just hit enter
|
2023-04-04 21:54:27 +00:00
|
|
|
certutil.exe -f -importpfx .\vpnclient.p12 NoExport
|
|
|
|
|
|
2023-04-04 22:20:21 +00:00
|
|
|
# elevated powershell; set additional reg key to harden IKEv2 key exchange
|
|
|
|
|
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\RasMan\Parameters /v NegotiateDH2048_AES256 /t REG_DWORD /d 0x1 /f
|
|
|
|
|
|
|
|
|
|
# lowpriv powershell; add the IKEv2 VPN connection
|
2023-04-04 21:54:27 +00:00
|
|
|
powershell -command "Add-VpnConnection -ServerAddress 'vpn.example.com' -Name 'IKEVPN' -TunnelType IKEv2 -AuthenticationMethod MachineCertificate -EncryptionLevel Required -PassThru"
|
|
|
|
|
|
|
|
|
|
powershell -command "Set-VpnConnectionIPsecConfiguration -ConnectionName 'IKEVPN' -AuthenticationTransformConstants GCMAES128 -CipherTransformConstants GCMAES128 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -PfsGroup None -DHGroup Group14 -PassThru -Force"
|
|
|
|
|
````
|
