OW(OpenWrt) as Client for Zyxel

Client side

Statusall:

Status of IKE charon daemon (strongSwan 5.6.3, Linux 4.14.63, mips):
uptime: 19 minutes, since Feb 06 18:34:08 2019
worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 5
loaded plugins: charon aes des rc2 sha2 sha1 md5 random nonce x509 revocation constraints pubkey pkcs1 pgp dnskey sshkey pem fips-prf gmp xcbc hmac attr kernel-netlink resolve socket-default connmark stroke updown xauth-generic
Listening IP addresses:
192.168.2.1
fd57:ea51:6153::1
192.168.43.25
Connections:
Status of IKE charon daemon (strongSwan 5.6.3, Linux 4.14.63, mips):
uptime: 19 minutes, since Feb 06 18:34:08 2019
worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 5
loaded plugins: charon aes des rc2 sha2 sha1 md5 random nonce x509 revocation constraints pubkey pkcs1 pgp dnskey sshkey pem fips-prf gmp xcbc hmac attr kernel-netlink resolve socket-default connmark stroke updown xauth-generic
Listening IP addresses:
192.168.2.1
fd57:ea51:6153::1
192.168.43.25
Connections:
PC_tunnel: %any...70.100.100.100 IKEv2, dpddelay=90s
PC_tunnel: local: uses pre-shared key authentication
PC_tunnel: remote: uses pre-shared key authentication
PC_tunnel: child: 192.168.221.33/32 === 192.168.222.0/24 TUNNEL, dpdaction=restart
Security Associations (1 up, 0 connecting):
PC_tunnel[1]: ESTABLISHED 19 minutes ago, 192.168.43.25[192.168.43.25]...70.100.100.100[70.100.100.100]
PC_tunnel[1]: IKEv2 SPIs: a2b29e7ecbc633f4_i* bb00cad66a4f4b04_r, pre-shared key reauthentication in 31 minutes
PC_tunnel[1]: IKE proposal: 3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_3072
PC_tunnel{1}: INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c6381c83_i c270fcd8_o
PC_tunnel{1}: AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 24 minutes
PC_tunnel{1}: 192.168.221.33/32 === 192.168.222.0/24

IPSEC.conf

ipsec.conf - strongSwan IPsec configuration file

basic configuration

config setup
# strictcrlpolicy=yes
# uniqueids = no

Add connections here.

Sample VPN connections

conn PC_tunnel
authby=secret
auto=start
closeaction=restart
dpddelay=90
dpdaction=restart
keyexchange=ikev2
keyingtries=%forever
fragmentation=yes
left=%defaultroute
leftsubnet=192.168.221.33/32
right=70.100.100.100
rightid=%any
rightsubnet=192.168.222.0/24

Network

config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fd57:ea51:6153::/48'

config interface 'lan'
option type 'bridge'
option ifname 'eth0.1'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '192.168.2.1'

config device 'lan_dev'
option name 'eth0.1'
option macaddr '80:1f:02:21:0d:bb'

config interface 'wan'
option ifname 'eth0.2'
option proto 'dhcp'

config device 'wan_dev'
option name 'eth0.2'
option macaddr '80:1f:02:21:0d:b8'

config interface 'wan6'
option ifname 'eth0.2'
option proto 'dhcpv6'

config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'

config switch_vlan
option device 'switch0'
option vlan '1'
option ports '1 2 3 4 9t'

config switch_vlan
option device 'switch0'
option vlan '2'
option ports '0 9t'

config interface 'wifiwan'
option proto 'dhcp'

firewall

config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'

config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan'

config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan wan6 wifiwan'

config forwarding
option src 'lan'
option dest 'wan'

config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'

config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'

config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'

config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'

config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'

config include
option path '/etc/firewall.user'