strongSwan VPN Client strongSwan View log Search VPN not supported Your device does not support VPN applications.\nPlease contact the manufacturer. VPN connections are not supported if a built-in VPN has the always-on feature enabled. Unable to get permission to create VPN connections. Either because it was denied by the user, or because a different VPN app has the always-on feature enabled. Loading… Profile not found strongSwan shortcut VPN connection state Provides information about the VPN connection state and serves as permanent notification to keep the VPN service running in the background. Settings Default VPN profile Connect to most recently used profile Ignore battery optimizations Don\'t show a warning if the app is not on the device\'s power whitelist Log Send log file Log file is empty strongSwan %1$s Log File No VPN profiles. Add VPN profile Edit Copy %1$s (Copy) Delete Select profiles Selected profiles deleted No profile selected One profile selected %1$d profiles selected Save Import Cancel Profile name (optional) Profile name Defaults to the configured server Defaults to \"%1$s\" Server IP address or hostname of the VPN server VPN Type Username Password (optional) Leave blank to get prompted on demand User certificate Select user certificate Select a specific user certificate Install user certificate CA certificate Select automatically Select CA certificate Select a specific CA certificate Advanced settings Show advanced settings Server identity Defaults to the configured server. Custom values are explicitly sent to the server and enforced during authentication Defaults to \"%1$s\". Custom values are explicitly sent to the server and enforced during authentication Client identity Defaults to the configured username. Custom values may be used if expected/required by the server Defaults to the certificate\'s subject identity. Custom values may be used if expected/required by the server. Note that these usually must be confirmed by the certificate (auto-completion is provided for the certificate\'s alternative identities, if any) DNS servers Custom DNS servers to use when connected to the VPN (separated by spaces, e.g. \"8.8.8.8 2001:4860:4860::8888\"), defaults to those received from the VPN server MTU of the VPN tunnel device In case the default value is unsuitable for a particular network Server port UDP port to connect to, if different from the default NAT-T keepalive interval Small packets are sent to keep mappings on NAT routers alive if there is no other traffic. In order to save energy the default interval is 45 seconds. Behind NAT routers that remove mappings early this might be too high, try 20 seconds or less in that case. Send certificate requests Certificate requests are sent for all available or selected CA certificates. To reduce the size of the IKE_AUTH message this can be disabled. However, this only works if the server sends its certificate even if it didn\'t receive any certificate requests. Use OCSP to check certificate Use the Online Certificate Status Protocol (OCSP), if available, to check that the server certificate has not been revoked. Use CRLs to check certificate Use Certificate Revocation Lists (CRL), if available, to check that the server certificate has not been revoked. CRLs are only used if OCSP doesn\'t yield a result. Use strict revocation checking In strict mode the authentication will fail not only if the server certificate has been revoked but also if its status is unknown (e.g. because OCSP failed and no valid CRL was available). Use RSA/PSS signatures Use the stronger PSS encoding instead of the classic PKCS#1 encoding for RSA signatures. Authentication will fail if the server does not support such signatures. Use IPv6 transport addresses Use IPv6 for outer transport addresses if available. Can only be enabled if UDP encapsulation for IPv6 is supported by the server. Note that the Linux kernel only supports this since version 5.8, so many servers will not support it yet. Split tunneling By default, the client will route all network traffic through the VPN, unless the server narrows the subnets when the connection is established, in which case only traffic the server allows will be routed via VPN (by default, all other traffic is routed as if there was no VPN). Block IPv4 traffic not destined for the VPN Block IPv6 traffic not destined for the VPN Custom subnets Only route traffic to specific subnets via VPN, everything else is routed as if there was no VPN (separated by spaces, e.g. \"192.168.1.0/24 2001:db8::/64\") Excluded subnets Traffic to these subnets will not be routed via VPN, but as if there was no VPN (separated by spaces, e.g. \"192.168.1.0/24 2001:db8::/64\") Applications Select applications No applications selected One application selected %1$d applications selected Algorithms Optionally configure specific algorithms to use for IKEv2 and/or IPsec/ESP instead of the defaults. Refer to our wiki for a list of algorithm identifiers (note that not all are supported by this app). Both fields take a list of algorithms, each separated by a hyphen. IKEv2 Algorithms For non-AEAD/classic encryption algorithms, an integrity algorithm, a pseudo random function (optional, defaults to one based on the integrity algorithm) and a Diffie-Hellman group are required (e.g. aes256-sha256-ecp256). For combined-mode/AEAD algorithms, the integrity algorithm is omitted but a PRF is required (e.g. aes256gcm16-prfsha256-ecp256). IPsec/ESP Algorithms For non-AEAD/classic encryption algorithms, an integrity algorithm is required, a Diffie-Hellman group is optional (e.g. aes256-sha256 or aes256-sha256-ecp256). For combined-mode/AEAD algorithms, the integrity algorithm is omitted (e.g. aes256gcm16 or aes256gcm16-ecp256). If a DH group is specified IPsec SA rekeying will use a DH key exchange. However, DH groups specified here are not used when the connection is established initially because the keys there are derived from the IKE SA key material. Therefore, any configuration mismatch with the server will only cause errors later during rekeying. Import VPN profile Failed to import VPN profile Failed to import VPN profile: %1$s File not found Host unknown TLS handshake failed Invalid value in \"%1$s\" This VPN profile already exists, its current settings will be replaced. Import certificate from VPN profile Certificate for \"%1$s\" Profile ID A value is required to initiate the connection Please enter your username No CA certificate selected Please select one or activate Select automatically Please enter a number in the range from %1$d - %2$d Please enter valid subnets and/or IP addresses, separated by spaces Please enter valid IP addresses, separated by spaces Please enter a valid list of algorithms, separated by hyphens EAP-TNC may affect your privacy Device data is sent to the server operator Trusted Network Connect (TNC) allows server operators to assess the health of a client device.

For that purpose the server operator may request data such as a unique identifier, a list of installed packages, system settings, or cryptographic checksums of files.

Any data will be sent only after verifying the server\'s identity.]]> CA certificates No certificates Reload CA certificates System User Imported Delete certificate? The certificate will be permanently removed! Import certificate Certificate successfully imported Failed to import certificate CRL cache Clear CRL cache? The CRL cache is empty The CRL cache contains %1$d file (%2$s). The CRL cache contains %1$d files (%2$s). Clear Status: Profile: Disconnect Connecting… Connected Disconnecting… No active VPN Error Dismiss Assessment: Restricted Failed View remediation instructions Remediation instructions Enter password to connect Username Password Connect Failed to establish VPN: %1$s. Server address lookup failed Server is unreachable Verifying server authentication failed User authentication failed Security assessment failed Unspecified failure while connecting Password unavailable Client certificate unavailable VPN connected This VPN profile is currently connected! Reconnect Connect %1$s? This will replace your active VPN connection! Disconnect VPN? This will disconnect the active VPN connection! Connect Retry Retry in %1$d second Retry in %1$d seconds Cancel retry Disable battery optimizations Please confirm the next dialog to add the app to the device\'s power whitelist so it can ignore battery optimizations and schedule NAT keep-alives and rekeyings accurately in order to constantly keep reachable while the VPN is established. Toggle VPN Connect VPN Disconnect VPN