IKEv2 配置过程中的两个坑

[Oathbinder]

服务器提供 /64 的 IPv6 地址，使用 Let's Encrypt 证书和 EAP-MSCHAPv2 认证

坑 1. iOS 可以正常连接到 IPv4 并且可以和服务器用 IPv6 互相 ping 通但是无法访问 IPv6 网站，推测是因为没有设置网关导致 IPv6 数据包无法被转发

坑 2. Windows 10.15063 无法连接，IKE 身份验证凭证不可接受。Let's Encrypt 证书 EKU 为serverAuth非ikeIntermediate，设置HKLM\SYSTEM\CurrentControlSet\Services\RasMan\Parameters\DisableIKENameEkuCheck = 0无效

ipsec.conf

conn %default
        keyexchange = ikev2
        ike = aes256-sha256-modp2048!
        esp = aes256-sha256!
        auto = add
        fragmentation = yes
        ikelifetime = 1h
        keylife = 1h
        rekey = no
        left = %any
        leftid = @example.com
        leftauth = pubkey
        leftcert = fullchain.pem
        leftsendcert = always
        leftsubnet = 0.0.0.0/0,::/0
        right = %any
        rightsourceip = 10.10.10.0/24,2001:A:B:C::/64
        rightdns = 8.8.8.8,2001:4860:4860::8888

conn EAP-MSCHAPv2
        rightauth = eap-mschapv2

Firewall

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE