OpenIKED on Ubuntu 24.04 LTS by cloudimg

OpenIKED on Ubuntu 24.04 LTS by cloudimg

OpenIKED is the OpenBSD project's free implementation of the Internet Key Exchange version 2 (IKEv2) protocol. IKEv2 is the half of an IPsec VPN that does the hard part: it authenticates the two peers to each other, negotiates the cipher suite, and installs the security associations the kernel then uses to encrypt traffic. OpenIKED drives the Linux kernel IPsec stack directly, so once a tunnel is up the data path runs in the kernel rather than through a userspace process.

Why Choose cloudimg?

• 24/7 Expert Support with guaranteed 24 hour response. Contact support@cloudimg.co.uk
• A unique VPN identity per VM the IKEv2 host keypair is generated on first boot, so no two launches of this image share a gateway identity and no key is ever baked into the image
• Proof it actually works a built in self test runs a real IKEv2 negotiation between two network namespaces and asserts the kernel installed keyed ESP security associations, so you can verify the daemon end to end before you point a peer at it
• A negative control too the same self test can run with a deliberately wrong peer key to confirm a mismatched credential is refused rather than silently accepted
• Hardened confinement the packaged AppArmor profile is repaired for Ubuntu 24.04 af_unix mediation so the daemon runs fully confined in enforce mode
• A paired deploy guide and unattended security upgrades

What's Included

• OpenIKED 7.3 with the openiked systemd service
• A per VM IKEv2 host keypair generated on first boot, private key mode 0600
• openiked-ctl, a helper for status, peer key import, IP forwarding and the self test
• openiked-selftest.sh, a real IKEv2 negotiation test with a negative control
• A paired deploy guide and unattended security upgrades

Use Cases

• A site to site IPsec tunnel between a cloud network and an on premises network
• A standards based IKEv2 gateway that interoperates with third party IPsec equipment
• Encrypting traffic between two cloud networks without a proprietary VPN appliance

cloudimg is not affiliated with or endorsed by the OpenIKED or OpenBSD projects. OpenIKED is distributed under the ISC License.