IKEv2 配置过程中的两个坑

服务器提供 /64 的 IPv6 地址，使用 Let's Encrypt 证书和 EAP-MSCHAPv2 认证

坑 1. iOS 可以正常连接到 IPv4 并且可以和服务器用 IPv6 互相 ping 通但是无法访问 IPv6 网站，推测是因为没有设置网关导致 IPv6 数据包无法被转发

坑 2. Windows 10.15063 无法连接，IKE 身份验证凭证不可接受。Let's Encrypt 证书 EKU 为serverAuth非ikeIntermediate，设置HKLM\SYSTEM\CurrentControlSet\Services\RasMan\Parameters\DisableIKENameEkuCheck = 0无效

ipsec.conf

conn %default keyexchange = ikev2 ike = aes256-sha256-modp2048! esp = aes256-sha256! auto = add fragmentation = yes ikelifetime = 1h keylife = 1h rekey = no left = %any leftid = @example.com leftauth = pubkey leftcert = fullchain.pem leftsendcert = always leftsubnet = 0.0.0.0/0,::/0 right = %any rightsourceip = 10.10.10.0/24,2001:A:B:C::/64 rightdns = 8.8.8.8,2001:4860:4860::8888 conn EAP-MSCHAPv2 rightauth = eap-mschapv2 

Firewall

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE