It does not behave like it did with openswan. No ip address is assigned for example.
Ran iperf on local subnet thru an ipsec tunnel from the turris router to an debian vm. It reaches 120MBit/sec with eap=aes128-sha1
Anyway I think turris-os needs this patch kernel/modules: fix crypto API RNG for >=4.2 · openwrt-mirror/openwrt@5d40955 · GitHub
kernel/modules: fix crypto API RNG for >=4.2
Since kernel 4.2, DRBG is the default crypto API RNG, replacing krng. As
DRBG is not enabled, there is no crypto API RNG available when running
kernel 4.2 or later. Because of this, IPsec SAs fail to install. In
strongSwan, this results in a vague error that is difficult to debug:
received netlink error: No such file or directory (2)
Solve this by adding DRBG to the kmod-crypto-rng package. As enabling
DRBG in the kernel config also enables the Jitterentropy RNG, include it
in kmod-crypto-rng instead of having it in a separate package.
Signed-off-by: Stijn Tintel stijn@linux-ipv6.be
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@47827 3c298f89-4303-0410-b956-a3cf2f4a3e73