ipsec.conf

# ipsec.conf - strongSwan IPsec configuration file

config setup
  #strictcrlpolicy=yes
  uniqueids = no
  #charondebug="cfg 2, dmn 2, ike 2, net 2, tls 2"

conn %default
        # Use IKEv2 by default
        keyexchange=ikev2

        # Dead peer discovery
        dpdaction=clear
        dpddelay=300s

        # Be efficient
        fragmentation=yes
        compress=yes

        # Server side
        left=%any
        leftsubnet=0.0.0.0/0
        leftid=@@host@@
        leftauth=pubkey
        leftcert=serverCert.pem
        leftsendcert=yes #critical for Mac VPN-clients
        forceencaps=yes #fake NAT detection payloads to surmount restrictive firewalls

        # Client side
        right=%any
        rightsourceip=10.0.0.0/24 #virtual subnet of client
        rightdns=8.8.8.8

# Public Key Authentication (PKA) for remote
conn IPsec-IKEv2-PKA
        rightauth=pubkey
        auto=add

# Extensible Authentication Protocol (EAP) for remote
conn IPsec-IKEv2-EAP
        rightauth=eap-tls
        auto=add

# Cisco-compatible verstion (IKEv1/XAUTH) for remote
conn IPsec-IKEv1-XAUTH
        keyexchange=ikev1
        rightauth=pubkey
        rightauth2=xauth
        auto=add