#strongswan

You'll need to get strongSwan installed, on Arch linux it's in aur so you'll need to use aur.sh or yaourt to get it installed. I prefer to use yaourt. I'm not going to cover how to get yaourt installed. Google it.

$ yaourt -S strongswan

Begin by editing the /etc/ipsec.conf file.

# nano /etc/ipsec.conf

Replace the contents with

Note you will need to replace the line leftid=@<YOUR FQDN> with your FQDN. For example, [email protected]. Also, make sure rightsourceip is a different subnet than your raspberry pi. We're not going to use DHCP for assigning IP addresses due to a bug/way wifi switching is handled on Windows Phone. If you use DHCP, when switching wifi it will not be able to assign a new IP address for that connection as it's still active and in use. This gets around that problem.

Next you'll need to set DNS servers for strongSwan to use. Since we're using this to stay anonymous, let's use the new dns.watch service. Edit /etc/strongswan.d/charon/attr.conf

# nano /etc/strongswan.d/charon/attr.conf

Add the line inside the attr block

dns = 84.200.69.80, 84.200.70.40

This can be set to any DNS service you want, if something should work better for you.

Configure your user accounts now, although we'll need to fix this later due to the way Windows Phone handles logins. Create and edit /etc/ipsec.secrets

# nano /etc/ipsec.secrets

Add the lines

: RSA server.key "steveballmer" : EAP "developers"

In the above example, steveballmer is the user and developers is the password. Change these to whatever you choose. We'll come back to these later.

Now, strongswan is (for the most part, there's one thing we need to fix) configured. We'll need to generate some certificates. Windows Phone (and I assume Windows) are picky about the certificates used. These steps, for the most part are from Ary Kleinerman's guide. So thanks, Ary.

For this, I like to work in a temp directory in my home folder.

$ mkdir ~/swankeys && cd ~/swankeys

Copy the openSSL configuration file, as we're going to need to edit some stuff.

$ cp /etc/ssl/openssl.cnf ~/swankeys/openssl.cnf

Edit the file, and look for the [v3_ca] block. Change/add the lines as needed so it now contains

basicConstraints = critical, CA:true extendedKeyUsage = serverAuth keyUsage = critical, keyCertSign, cRLSign

Generate your CA private key

$ openssl genrsa -out ca.key 1024

selfsign a CA certificate. Fill in the information as needed.

$ openssl req -new -x509 -key ca.key -out ca.crt -days 1095 -config openssl.cnf

Create your gateway certificates

Generate a private key

$ openssl genrsa -out server.key 1024

Create a certificate. Note the Common Name MUST match your fqdn of your vpn you set earlier in ipsec.conf or it won't work.

$ openssl req -new -key server.key -out server.csr

Windows requires some special attributes to be set, so we'll need to create a config file with them.

$ nano settings.conf

add the contents, again use your same fqdn as you've been using.

extendedKeyUsage = serverAuth subjectAltName = DNS:**YOUR FQDN** authorityKeyIdentifier=keyid

Sign the certificate.

$ openssl x509 -req -days 1094 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt -extfile settings.conf

Move the generated certificates into their proper places

# cp ca.crt /etc/ipsec.d/cacerts/ # cp server.crt /etc/ipsec.d/certs # cp server.key /etc/ipsec.d/private

Now that your certificates are generated, and in place. You need to get ca.crt onto your phone. I copied and emailed it to myself, but putting it online and accessing via internet explorer works fine. Install the certificate.

Before we start the VPN Server, we need to set some kernel flags. Replace the contents of /etc/sysctl.conf with

net.ipv4.ip_forward = 1 net.ipv4.conf.default.proxy_arp = 1 net.ipv4.conf.default.arp_accept = 1 net.ipv4.conf.default.proxy_arp_pvlan = 1 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.rp_filter = 0 net.ipv4.conf.default.accept_source_route = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.icmp_ignore_bogus_error_responses = 1

Enable forwarding in iptables

# iptables --table nat --append POSTROUTING --jump MASQUERADE

Start the strongSwan VPN server just in a console for now so we can fix the username problem.

# /usr/bin/ipsec start --nofork

Add your VPN accont to your Windows Phone, using the login and password you created in /etc/ipsec.secrets In this case username: steveballmer password: developers. It will fail to login, this is expected. Look in the output from ipsec for the line that says

13[IKE] received EAP identity [...]

This will be different on every phone, on mine it's "13[IKE] received EAP identity 'Nokia Lumia 920\steveballmer'" copy whatever is in quotes from your phone's name and edit /etc/ipsec.secrets again

# nano /etc/ipsec.secrets

and change steveballmer to "Nokia Lumia 920\steveballmer" (In quotes) to whatever your output from ipsec was. Save the file, Quit the ipsec daemon, and restart it again with

# /usr/bin/ipsec start --nofork

Try to connect again from your phone. If everything went right, you'll successfully connect with no errors.

Enable the daemon to run at start with

# systemctl enable strongswan # systemctl start strongswan

Now you have full encrypted internet access on the go over cellular, or wifi. And can access local services on your LAN, like a Tor proxy, or mpd.