FreeS/WAN 2.06

FreeS/WAN is an implementation of IPSEC & IKE for Linux. IPSEC is Internet Protocol SECurity. It uses strong cryptography to provide both authentication and encryption services. Authentication ensures that packets are from the right sender and have not been altered in transit. Encryption prevents unauthorised reading of packet contents. These services allow you to build secure tunnels through untrusted networks.

Two protocols are used

ESP (Encapsulating Security Payload) provides encryption plus authentication
IKE (Internet Key Exchange) negotiates connection parameters, including keys, for ESP

Freeswan implementation has three main parts:

KLIPS (kernel IPsec) implements ESP, and packet handling within the kernel
Pluto (an IKE daemon) implements IKE, negotiating connections with other systems
various scripts provide an adminstrators interface to the machinery.

Because IPsec operates at the network layer, it is remarkably flexible and can be used to secure nearly any type of Internet traffic. Two applications, however, are extremely widespread:

a Virtual Private Network, or VPN, allows multiple sites to communicate securely over an insecure Internet by encrypting all communication between the sites.
"Road Warriors" connect to the office from home, or perhaps from a hotel somewhere

There is enough opportunity in these applications that vendors are flocking to them. IPsec is being built into routers, into firewall products, and into major operating systems, primarily to support these applications. See our list of implementations for details.

We support both of those applications, and various less common IPsec applications as well, but we also add one of our own:

opportunistic encryption, the ability to set up FreeS/WAN gateways so that any two of them can encrypt to each other, and will do so whenever packets pass between them.

This is an extension we are adding to the protocols. FreeS/WAN is the first prototype implementation, though we hope other IPsec implementations will adopt the technique once we demonstrate it. See project goals below for why we think this is important.

A somewhat more detailed description of each of these applications is below. Our quickstart section will show you how to build each of them.