Hacker News Reader

That strongswan thing is the kind of design HN praises about open protocols by IRC (just the other day...) but in practice is so flexible it can't keep itself upright and it's unusable in practice.

Meanwhile tailscale or wireguard, by being actually opinionated, avoids needing much configuration at both ends.

View on HN

Yes — configuring strongSwan as a bog-standard VPN server was so hard to fathom I made GitHub repo for it [1]. To be fair, some of the complexity comes from OS support that seems specifically designed to make secure setups difficult, presumably at the behest of various Three Letter Agencies.

I have now mostly switched to Wireguard for this, which is much more sane [2].

[1] https://github.com/jawj/IKEv2-setup [2] https://github.com/jawj/wireguard-setup

Reply on news.ycombinator.com