strongSwan on Windows
strongSwan can be built for the Windows platform using the MinGW toolchain. Supported are Windows 7 / Server 2008 R2 and newer releases.
Beside some other limitations, the
kernel-iphnetworking backend currently does not support the installation of virtual IP addresses. Such addresses are usually assigned to road-warrior clients, making the strongSwan Windows port not usable as client for this particular scenario.
socket-winsocket plugin by default binds to UDP ports 500 and 4500. To receive any packets, the Windows native IKE service must be disabled by stopping/disabling the
IKEEXTservice. If you see any
WFP MM failureerrors, the
IKEEXTservice is probably running.
strongSwan has a large codebase and not all functionality has been ported to
Windows. Beside the
libcharon core libraries the
libtnccs libraries are known to work under Windows.
The following plugins are supported in the Windows build:
Many more plugins might work without or with minor modifications, but have not yet been tested extensively. The following additional components are also supported:
Specifically for the Windows port, the following components have been introduced:
Windows IKE service using
IKE socket implementation using Winsock2 API
HTTP/HTTPS CRL/OCSP fetcher using WinHTTP API
Networking backend using IP Helper API
Interface to native Windows IPsec backend in the Windows Filtering Platform
kernel-wfp plugins currently have some
limitations and known issues, please consult their wiki pages.
There are no hard third party dependencies on the Windows platform, as strongSwan uses a native (non-pthread) threading backend on Windows. You’ll need a working crypto backend, though, and OpenSSL is known to work fine. Other crypto backends have not yet been tested, future releases might include a native Windows crypto backend.
There are two ways how to build strongSwan for the Windows platform:
The first option is usually simpler and recommended when building from Git sources.
The port has been done using the MinGW-W64 toolchain. Other compilers are currently not supported. Using Visual C compilers is not an option in the near future as we heavily use some C99 features which MSVC does not support.
In strongSwan only monolithic builds are supported, hence pass
variants are supported. The 32-bit build variants have been tested less extensively,
though. As many of the strongSwan default plugins are not supported, it is
recommended to pass
./configure and enable the specific options as
required. A minimal set of
could look like:
CFLAGS="-g -O2 -Wall -Wno-pointer-sign -Wno-format-security \ -Wno-format -mno-ms-bitfields \ -I/c/path/to/openssl/include" \ LDFLAGS="-L/c/path/to/openssl/lib" \ ./configure --disable-defaults --enable-monolithic --enable-static \ --enable-svc --enable-ikev2 --enable-ikev1 \ --enable-nonce --enable-pem --enable-pkcs1 \ --enable-x509 --enable-openssl --enable-socket-win \ --enable-kernel-wfp --enable-kernel-iph --enable-pubkey \ --enable-swanctl --with-swanctldir=swanctl \ --with-strongswan-conf=strongswan.conf
It is usually a good idea to specify relative paths for
strongswan.conf and the
swanctl directory as it allows you to move these
files freely along with your binaries.
Windows Native Build
First install MinGW-W64, preferably using the installer.
The 4.8.1 version is known to work fine using the
x64 Architecture and native
./configure you’ll need
MSYS, e.g. by
using the MinGW-W64 MSYS builds. After extracting the
msys.bat and run:
to complete the installation. Use this shell to
./configure and build strongSwan.
Unix Cross-Compile Build
After installing the MinGW-W64 toolchain and the Windows system headers for your distribution, add
or for 32-bit builds
./configure to enable cross-compilation.
To extract the binaries, you may use
make install using a specific
or manually copy the requires binaries from the
.libs subdirectories. A
future version hopefully provides a more convenient way to create a
redistributable binary package.
charon-svc for instructions how to
install the IKE service or run it in a console window.
swanctl has more information about configuring the
IKE service accordingly.