How to setup strongswan client on openwrt 22.03

Heya,

Setting up a StrongSwan client on OpenWRT 22.03 to tunnel all traffic through a VPN can be achieved with the following steps. Please note that while I will try to simplify the process, working with networking and VPN configurations can sometimes involve complex steps. Make sure you have a backup of your router configuration before making changes.

Install StrongSwan on OpenWRT:

SSH into your OpenWRT router and install StrongSwan:

opkg update 
opkg install strongswan-minimal

Configure StrongSwan:

Edit the StrongSwan configuration file:

vi /etc/strongswan.conf

Add the following lines to the configuration file:"

charon {
    load_modular = yes
    duplicheck.enable = no
}

Create VPN Configuration:

Create a VPN configuration file:

vi /etc/ipsec.conf

Add a configuration similar to the following (adjust according to your server’s details):

conn myvpn
    auto=start
    leftsourceip=%config
    leftauth=eap-tls
    leftcert=/etc/ssl/private/client-cert.pem
    right=<SERVER_IP>
    rightid=<SERVER_DOMAIN_OR_IP>
    rightsubnet=0.0.0.0/0
    rightauth=pubkey

Replace <SERVER_IP> and <SERVER_DOMAIN_OR_IP> with the actual server IP or domain. Configure VPN Credentials:

Create a directory to store VPN credentials:

mkdir -p /etc/strongswan/ipsec.d/certs

Place your client certificate and private key in this directory (client-cert.pem and client-key.pem, respectively). Restart StrongSwan:

Start and enable the StrongSwan service:

/etc/init.d/strongswan enable
/etc/init.d/strongswan start

Routing and NAT:

Edit the firewall configuration to enable routing and NAT for the VPN traffic:

vi /etc/config/firewall

Add the following lines within the config zone section for lan:

option forward 'REJECT'
option output 'ACCEPT'
option masq '1'
option mtu_fix '1'

Save and exit the file, then restart the firewall:

/etc/init.d/firewall restart

Reboot the router or restart the networking service to apply the changes:

/etc/init.d/network restart