VPN Setup

Set up Cloud1VPN on Unix with IKEv2/IPsec

Install or open the IKEv2 client, import your Cloud1VPN certificate profile, connect, and verify your public IP.

IKEv2/IPsec setup for Unix

Choose a VPN protocol

Before you begin

You need an active Cloud1VPN server configured for IKEv2/IPsec. Open My Servers and retrieve the issued certificate or configuration profile before importing it into your client.

Get your IKEv2/IPsec configuration

Unix setup

Connect with IKEv2/IPsec

Use strongSwan with the certificate and connection details generated for your Cloud1VPN server.

  1. Prepare strongSwan

    Install strongSwan from your Unix package or ports collection; the official FreeBSD guide covers the supported package flow.

    View the official IKEv2 client guidance

  2. Download your IKEv2 credentials

    Open My Servers and download the issued client certificate or configuration profile. Keep the private key and export password secure.

  3. Import the certificate and settings

    Store the certificate and key in the strongSwan credential locations, then configure IKEv2 with the exact server and identity values shown in Cloud1VPN.

  4. Connect

    Start the IKEv2 connection and confirm Unix trusts the Cloud1VPN server certificate and identity.

  5. Verify your connection

    Confirm the IKEv2 connection is active, then verify that your public IP matches the Cloud1VPN server.

    Open What's My IP?

Frequently Asked Questions

Unix IKEv2/IPsec setup & troubleshooting

Why is my client certificate not available to the VPN connection?

Confirm strongSwan can read the client certificate, private key, and issuing CA from its configured credential locations, and that the server identity exactly matches the Cloud1VPN value. If the certificate has expired, lacks its private key, or belongs to an earlier server deployment, download and import the current credential bundle.

What does a server identity or certificate-name mismatch mean?

The client expected one authenticated server name but received or was configured with another. Compare the server address and identity with the values in My Servers. Do not disable certificate validation or substitute an IP address unless the Cloud1VPN profile explicitly uses it as the identity.

Why does IKEv2 fail immediately after importing the profile?

Check the Unix date, time, and timezone first. Then confirm the full certificate chain and private key were imported and that the selected authentication method matches the issued profile. Clock and trust failures can stop the connection before a tunnel is created.

What do “authentication failed” or “no proposal chosen” mean?

Authentication failed usually points to the certificate, private key, identity, or stale credentials. No proposal chosen means the client and server did not agree on the IKE or IPsec settings. In either case, download a current profile rather than weakening or guessing the cryptographic settings.

IKEv2 says connected, but websites do not load. What should I check?

Disconnect other VPN and proxy software, reconnect IKEv2, and open What's My IP?. If the Cloud1VPN address appears but domains fail, check DNS. If no traffic works, check the installed routes and local firewall before replacing certificates.

Why is my normal public IP still visible?

The connection may not be using the default internet route, or another VPN may have higher priority. Confirm the imported Cloud1VPN profile is intended for full-tunnel access, disconnect competing profiles, and reconnect before testing again.

Why did IKEv2 stop working after a rebuild or relocation?

The previous profile can contain an obsolete server address, identity, or certificate. Remove the old VPN connection and its superseded client profile, then install the new configuration from My Servers instead of editing the old connection.

What should I send support for an IKEv2 problem?

Capture the first strongSwan or charon service error at the failure time. Include the Unix version, Cloud1VPN server name, and time and timezone. Never send the private key, certificate export password, configuration profile, or account password.