IKEv2/IPsec setup for Linux

Choose a VPN protocol

Before you begin

You need an active Cloud1VPN server configured for IKEv2/IPsec. Open My Servers and retrieve the issued certificate or configuration profile before importing it into your client.

Get your IKEv2/IPsec configuration

Linux setup

Connect with IKEv2/IPsec

Use strongSwan with the certificate and connection details generated for your Cloud1VPN server.

  1. Prepare strongSwan

    Install strongSwan and its certificate or NetworkManager integration packages from your distribution.

    View the official IKEv2 client guidance

  2. Download your IKEv2 credentials

    Open My Servers and download the issued client certificate or configuration profile. Keep the private key and export password secure.

  3. Import the certificate and settings

    Import the certificate and private key into strongSwan or NetworkManager, then create an IKEv2 connection using the exact server and identity values shown in Cloud1VPN.

  4. Connect

    Start the IKEv2 connection and confirm Linux trusts the Cloud1VPN server certificate and identity.

  5. Verify your connection

    Confirm the IKEv2 connection is active, then verify that your public IP matches the Cloud1VPN server.

    Open What's My IP?

Installation & Configuration FAQs

Linux IKEv2/IPsec setup

Which IKEv2/IPsec client should I use?

Use the maintained IKEv2/IPsec client described in this guide, such as strongSwan where supported. Use the supported client and setup flow in this guide instead of a random third-party VPN application.

Where do I download my IKEv2/IPsec profile?

In My Servers, open the Cloud1VPN server you want to use and download its current IKEv2/IPsec credential bundle or configuration profile. It is tied to that server, so retrieve a replacement after a rebuild, relocation, or credential renewal.

How do I import the profile and certificates?

Install the client certificate, private key, and issuing CA in the client locations described in this guide, then use the supplied server identity in the connection profile. Keep the server address, server identity, authentication method, and certificate material exactly as supplied by Cloud1VPN.

Do I need the complete certificate bundle?

Yes. Certificate-based IKEv2 needs the client certificate, its private key, and the issuing CA as required by your client. Importing only the public certificate is not enough to authenticate the connection.

How should I configure the VPN connection?

Use the Cloud1VPN server address and identity exactly as given. Do not replace the server identity with an IP address or disable certificate validation. If the client offers a connection name, label it clearly and keep only one VPN connection active while testing.

Should I replace an older IKEv2/IPsec profile?

Yes, whenever Cloud1VPN supplies a new profile or credential bundle. Remove the old VPN connection and its superseded profile, then import the current download instead of editing the old configuration manually.

How do I confirm that setup worked?

Connect the installed profile, confirm the system shows the VPN as connected, then open What's My IP?. A full-tunnel Cloud1VPN profile should show your Cloud1VPN server address.

Still Need Help?

Visit our Knowledge Base for troubleshooting guides. Premium members can also sign in to submit a support ticket.