strongSwan on Windows
strongSwan can be built for the Windows platform using the MinGW toolchain. Supported are Windows 7 / Server 2008 R2 and newer releases.
Beside some other limitations, the
kernel-iphnetworking backend currently does not support the installation of virtual IP addresses. Such addresses are usually assigned to road-warrior clients, making the strongSwan Windows port not usable as client for this particular scenario.
socket-winsocket plugin by default binds to UDP ports 500 and 4500. To receive any packets, the Windows native IKE service must be disabled by stopping/disabling the
IKEEXTservice. If you see any
WFP MM failureerrors, the
IKEEXTservice is probably running.
strongSwan has a large codebase and not all functionality has been ported to
Windows. Beside the
libcharon core libraries the
libtnccs libraries are known to work under Windows.
The following plugins are supported in the Windows build:
Many more plugins might work without or with minor modifications, but have not yet been tested extensively. The following additional components are also supported:
Specifically for the Windows port, the following components have been introduced:
Windows IKE service using
IKE socket implementation using Winsock2 API
HTTP/HTTPS CRL/OCSP fetcher using WinHTTP API
Networking backend using IP Helper API
Interface to native Windows IPsec backend in the Windows Filtering Platform
There are no hard third party dependencies on the Windows platform, as strongSwan uses a native (non-pthread) threading backend on Windows. You’ll need a working crypto backend, though, and OpenSSL is known to work fine. Other crypto backends have not yet been tested, future releases might include a native Windows crypto backend.
There are two ways how to build strongSwan for the Windows platform:
The first option is usually simpler and recommended when building from Git sources.
The port has been done using the MinGW-W64 toolchain. Other compilers are currently not supported. Using Visual C compilers is not an option in the near future as we heavily use some C99 features which MSVC does not support.
In strongSwan only monolithic builds are supported, hence pass
variants are supported. The 32-bit build variants have been tested less extensively,
though. As many of the strongSwan default plugins are not supported, it is
recommended to pass
CFLAGS="-g -O2 -Wall -Wno-pointer-sign -Wno-format-security \ -Wno-format -mno-ms-bitfields \ -I/c/path/to/openssl/include" \ LDFLAGS="-L/c/path/to/openssl/lib" \ ./configure --disable-defaults --enable-monolithic --enable-static \ --enable-svc --enable-ikev2 --enable-ikev1 \ --enable-nonce --enable-pem --enable-pkcs1 \ --enable-x509 --enable-openssl --enable-socket-win \ --enable-kernel-wfp --enable-kernel-iph --enable-pubkey \ --enable-swanctl --with-swanctldir=swanctl \ --with-strongswan-conf=strongswan.conf
to complete the installation. Use this shell to
./configure and build strongSwan.
To extract the binaries, you may use
make install using a specific
or manually copy the requires binaries from the
.libs subdirectories. A
future version hopefully provides a more convenient way to create a
redistributable binary package.