Open Source IKEv2 IPsec-based VPN solution
# pkg install strongswaninstalls 6.1.0 from latest; from quarterly (2026Q4) 6.1.0# cd /usr/ports/security/strongswan && make install clean# make -C /usr/ports/security/strongswan config # change options first
The default strongSwan configuration interface have been updated to vici since version 5.9.2_1. To use the stroke interface by default either compile the port without the vici option or set 'strongswan_interface="stroke"' in your rc.conf file.
The default strongSwan configuration interface have been updated to vici. To use the stroke interface by default either compile the port without the vici option or set 'strongswan_interface="stroke"' in your rc.conf file.
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 6.1.0 | 6.1.0 | – |
| FreeBSD 15 | 6.1.0 | 6.1.0 | – |
| FreeBSD 14 | 6.1.0 | 6.1.0 | 6.1.0 |
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 6.1.0 | 6.1.0 | – |
| FreeBSD 14 | 6.1.0 | 6.1.0 | 6.1.0 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
pkg audit for the packaged version 6.1.0.| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-78130 | 7.5 | 2026-09-11 | strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser. |
| CVE-2026-78132 | 7.5 | 2026-09-11 | strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax. |
| CVE-2026-78133 | 7.5 | 2026-09-11 | libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling. |
| CVE-2026-78134 | 7.1 | 2026-09-11 | strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity. |
| CVE-2026-78129 | 5.9 | 2026-09-11 | strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption. |
| CVE-2026-78123 | 5.9 | 2026-09-11 | strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin. |
| CVE-2026-78126 | 5.9 | 2026-09-11 | strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin. |
| CVE-2026-78127 | 3.7 | 2026-09-11 | libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser. |
| CVE-2026-78131 | 3.7 | 2026-09-11 | strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser. |
| CVE-2026-78124 | 3.7 | 2026-09-11 | strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime. |
CVE-2026-78123, CVE-2026-78124, CVE-2026-78126, CVE-2026-78127, CVE-2026-78129, CVE-2026-78130, CVE-2026-78131, CVE-2026-78132, CVE-2026-78133, CVE-2026-78134, CVE-2026-78135
security/strongswan: Update to 5.8.2 PR: 242687 Approved by: maintainer Obtained from: pfSense Sponsored by: Rubicon Communications, LLC (Netgate)63290106b6
Add a new option to enable PKCS11 plugin PR: 240684 Approved by: strongswan@Nanoteq.com (maintainer) Obtained from: pfSense Sponsored by: Rubicon Communications, LLC (Netgate)c2e5505afa
security/strongswan: update to 5.8.1 PR: 240316 Submitted by: Jose Luis Duran <jlduran@gmail.com> Approved by: strongswan@Nanoteq.com (maintainer)b1c34a2767
security/strongswan: Add support for the VIA Padlock plugin PR: 239458 Submitted by: Evgeny <mojolicious@yandex.com> (initial revision) strongswan@Nanoteq.com (maintainer, brushed-up revision) Approved by: strongswan@Nanoteq.com (maintainer)c07f70692d
Implement new virtual category: net-vpn for VPN related ports based on discussion at ports@ [1]. As VPN softwares are put in different physical category net and security. This is a little bit confusing. Let's give them new virtual category net-vpn. [1] https://lists.freebsd.org/pipermail/freebsd-ports/2019-April/115915.html PR: 239395 Submitted by: myself Approved by: portmgr (mat) Differential Revision: https://reviews.freebsd.org/D21174222e095f2a
security/strongswan: Update to 5.8.0 PR: 238173 Approved by: maintainer Obtained from: pfSense Sponsored by: Rubicon Communications, LLC (Netgate)d5a85043e3
security/strongswan: add vici-based configuration for the rc script The rc script is modified to allow both a legacy (ipsec.conf-based) startup or a new (swanctl.conf-based) config. Default is the legacy. The new setup is based on vici, the Versatile IKE Configuration Interface. For more details, see: https://wiki.strongswan.org/projects/strongswan/wiki/Vici PR: 234648 Submitted by: Jose Luis Duran <jlduran@gmail.com> Reviewed by: Sam Chen <sc.gear@one.caeon.com> Approved by: strongswan@Nanoteq.com (maintainer) Differential Revision: D1936735f91bc9a3
security/strongswan: add PAM to XAUTH PR: 236218 Submitted by: Franco Fichtner <franco@opnsense.org> Approved by: strongswan@Nanoteq.com (maintainer)a17fd70e84
security/strongswan: Minor port improvements - Follow the same patching logic for swanctl.conf as the other config files. - Silence warning: $strongswan_enable not properly set. PR: 235340 Submitted by: Jose Luis Duran <jlduran@gmail.com> Approved by: strongswan@Nanoteq.com (maintainer)1c226cc6ed
security/strongswan: update to version 5.7.2 PR: 234882 Submitted by: Jose Luis Duran <jlduran@gmail.com> Approved by: strongswan@Nanoteq.com (maintainer)f712c6381c
security/strongswan: Update to 5.7.1 PR: 231862 Approved by: maintainer Obtained from: pfSense MFH: 2018Q4 Security: CVE-2018-16151 CVE-2018-16152 Sponsored by: Rubicon Communications, LLC (Netgate)405927e1c4
security/strongswan: Fix rc startup script to support rc.conf settings like _nice, _fib Do not bump version since I'll commit the upgrade to 5.7.1 just after it PR: 211108 Submitted by: Dmitry Wagin <dmitry.wagin@ya.ru> Approved by: maintainer Sponsored by: Rubicon Communications, LLC (Netgate)574f70ef77
- Update security/strongswan to 5.7.0 - While here, silence portlint warning renaming option IKEv1 to IKEV1 PR: 231720 Approved by: maintainer Obtained from: pfSense Sponsored by: Rubicon Communications, LLC (Netgate)531be1c7b6
Update to 5.6.3 Fixes: - Denial-of-Service Vulnerability in the IKEv2 key derivation (CVE-2018-10811) - Denial-of-Service Vulnerability in the stroke plugin (CVE-2018-5388) - Crash on FreeBSD that was present in 5.6.2 - The kernel-pfkey plugin optionally installs routes via internal interface (one with an IP in the local traffic selector). On FreeBSD, enabling this selects the correct source IP when sending packets from the gateway itself. PR: 228631 Submitted by: maintainer9ccf25ffb8
security/strongswan: Fix crash in public key authentication with 5.6.2 While here, added LICENSE_FILE. PR: 226404 Submitted by: strongswan@Nanoteq.com (maintainer) Approved by: tcberner (mentor, implicit)f5b4b6fb0e
- Update security/strongswan to 5.6.2 [1] - Enable CURL option by default [2] PR: 226043 [1], 220488 [2] Submitted by: strongswan@Nanoteq.com (maintainer) [1] karl@denninger.net [2] Approved by: maintainer [2] MFH: 2018Q1 Security: CVE-2018-6459 Sponsored by: Rubicon Communications, LLC (Netgate)b3ff476a60
Remove USES=execinfo. PR: 220271 Submitted by: mat (review), Yasuhiro KIMURA (PR) Sponsored by: Absolight Differential Revision: https://reviews.freebsd.org/D114883fcd0e41de
security/strongswan: update 5.5.3 -> 5.6.0 - the gmp plugin responsible for CVE-2017-11185 is not enabled in the FreeBSD build PR: 221716 Relnotes: https://wiki.strongswan.org/versions/66 Reported by: i.dani@outlook.com Approved by: strongswan@nanoteq.com (maintainer)66ea0a1c94
Update strongswan to 5.5.3 PR: 220823 Submitted by: strongswan@Nanoteq.com (maintainer) Reported by: i.dani@outlook.com51bb85d963
Add option for enabling mediation feature (like STUN for IPSec peers) Approved by: strongswan@nanoteq.com (maintainer) Sponsored by: Orange7d74e337ec
Update security/strongswan to 5.5.2 PR: 218430 Approved by: maintainer Sponsored by: Rubicon Communications (Netgate)cc6418d4b8
- Chase ldns shlip bump PR: 2174956d14406a13
Update security/strongswan to 5.5.1 PR: 213844 Approved by: strongswan@Nanoteq.com (maintainer) Obtained from: pfSense Sponsored by: Rubicon Communications (Netgate)c1ddb127a2
security/strongswan: Fix build with LibreSSL Approved by: SSL blanketd2849d0cce
Update security/strongswan to 5.5.0 PR: 211095 Submitted by: strongswan@Nanoteq.com (maintainer)6651f71c86
security/strongswan: unbreak FreeBSD 9 builds - Add patch to include sys/endian.h header PR: 208446 Submitted by: strongswan@Nanoteq.com (maintainer) MFH: 2016Q2 (build fix blanket)6a2558d8a8
Remove ${PORTSDIR}/ from dependencies, categories r, s, t, and u.
With hat: portmgr
Sponsored by: Absolight597afc47baUpdate security/strongswan to 5.4.0 PR: 208219 Approved by: swan@nanoteq.com (maintainer) Obtained from: pfSense Sponsored by: Rubicon Communications (Netgate)54774528b6
- bump PORTREVISION on ports depending on unbound PR: 207948 Submitted by: jaap@NLnetLabs.nl (maintainer)98bbb468b4
security/strongswan: enable options to increase usefulness of default pkg - Enable PKI, SWANCTL, and VICI options (no external dependencies) - Document IMPLIES dependency on VICI for SWANCTL; mention in SWANCTL_DESC - Bump PORTREVISION PR: 205438 Reported by: Nick B <nicblais@clkroot.net> Submitted by: strongswan@Nanoteq.com (maintainer)4afaf01c5f
- Update unbound to 1.5.7 - Bump PORTREVISIOn on dependent ports Some Upgrade Notes: This release fixes a validation failure for nodata with wildcards and emptynonterminals. Fixes OpenSSL Library compability. Fixes correct response for malformed EDNS queries. For crypto in libunbound there is libnettle support. Qname minimisation is implemented. Use qname-minimisation: yes to enable it. This version sends the full query name when an error is found for intermediate names. It should therefore not fail for names on nonconformant servers. It combines well with harden-below-nxdomain: yes because those nxdomains are probed by the qname minimisation, and that will both stop privacy sensitive traffic and reduce nonsense traffic to authority servers. So consider enabling both. In this implementation IPv6 reverse lookups add several labels per increment, because otherwise those lookups would be very slow. [ Reference https://tools.ietf.org/html/draft-ietf-dnsop-qname-minimisation-08 ] More details at <http://unbound.net> PR: 206347 Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl> Approved by: maintainer timeout Sponsored by: DK Hostmaster A/Sd140eabacb
Bump PORTREVISION to help users with custom OPTIONS to get the fix committed in r402880, as suggested by AMDmi3a0edc3c586
Add @sample to gcm.conf missed when I introduced it. No bump on PORTREVISION since GCM is disabled by default Submitted by: Jose Luis Duran Obtained from: https://github.com/pfsense/FreeBSD-ports/pull/27b7a23eef6
Update security/strongswan to 5.3.5 PR: 204959 Approved by: strongswan@Nanoteq.com (maintainer) Obtained from: pfSense Sponsored by: Rubicon Communications (Netgate)169aacbd17
Update security/strongswan to 5.3.4 PR: 204597 Submitted by: strongswan@nanoteq.com (maintainer) MFH: 2015Q4 Security: CVE 2015-8023 Security: https://github.com/strongswan/strongswan/commit/453e204ac40dfff2e0978e8f84a5f8ff0cbc45e2 Sponsored by: Rubicon Communications (Netgate)39618f2a30
Backport a couple of commits from master, that will be present in 5.3.4: - dff2d05bb9 [1]: kernel-pfKey: Enable AES-CTR - 04f22cdabc [2]: VICI: add NAT information Bump PORTREVISION [1] https://github.com/strongswan/strongswan/commit/dff2d05bb9bec684b3b2efdafc9a47219550bbe1 [2] https://github.com/strongswan/strongswan/commit/04f22cdabc1c97d38692f95392429839f0fa90d1 PR: 204398 Approved by: maintainer Obtained from: pfSense Sponsored by: Rubicon Communications (Netgate)effa54ec4c
- Add a new option, SWANCTL, to install swanctll utility - When VICI option is selected, install libvici.h to include directory, it's useful when you need to build a custom code linked to libvici - Pass path to USE_LDCONFIG otherwise libraries will not be visible PR: 204098 Approved by: maintainer Obtained from: pfSense Sponsored by: Rubicon Communications (Netgate)9c90e69933
- Add a new option (VICI) to build VICI management protocol - Change SMP option description to show users it's deprecated PR: 204090 Approved by: maintainer48f7ab060b
strongSwan can be beuit using 3 different printf hooks: builtin, glibc (compatible with FreeBSD's libc) and vstr (devel/vstr). Since it's not selected any of them on CONFIGURE_ARGS, it uses auto, and end up using glibc. pfSense users reported memory leaks on strongSwan [2] [3] and a it was reported to upstream [1]. Add a single option and let user choose which printf hook to use, and change default to use builtin. Bump PORTREVISION due to default change [1] https://wiki.strongswan.org/issues/1106 [2] https://forum.pfsense.org/index.php?topic=96767.0 [3] https://redmine.pfsense.org/issues/5149 PR: 204051 Approved by: maintainer Obtained from: pfSense MFH: 2015Q4 Sponsored by: Rubicon Communications (Netgate)1f33e7ef35
Fix pkg-descr, Strongswan supports IKEv1 since version 5.0.0 Spotted by: Jim Thompson <jim@netgate.com> Approved by: strongswan@Nanoteq.com (maintainer) Sponsored by: Rubicon Communications (Netgate)4aaa296bd1
Update security/strongswan to 5.3.3 PR: 203178 Approved by: strongswan@Nanoteq.com (maintainer) Sponsored by: Rubicon Communications (Netgate)0ef9966922
Update to 5.3.2 PR: 200721 Approved by: strongswan@Nanoteq.com (maintainer) MFH: 2015Q2 Security: CVE-2015-3991 Sponsored by: Netgate30bfe91aba
Fix PLIST when EAPAKA3GPP2 is unset and EAPDYNAMIC is set PR: 199652 Approved by: stronswan@Nanoteq.com (maintainer) Sponsored by: Netgatecd5bec75b8
- Add CPE info Approved by: portmgr blanket0ef5155046
Add patches to fix Strongswan Management Protocol SMP is an XML control interface for Strongswan used by pfSense and Opnsense. SMP has been deprecated by upstream since 5.2.0 in favor of a newer IPC mechanism called VICI. As a result upstream is not motivated to take patches for SMP, and this uses non-portable strlcpy anyway. The code has not been deleted from the project and if we can bludgeon it into a working state I see no harm. PR: 199442d8fe21535f
- Update to 5.3.0 - Add a new option UNITY, to enable Cisco unity extension plugin PR: 199064 Approved by: maintainer Sponsored by: Netgate2daf580402
- Add GCM and SMP options - Add pkgconfig to the list of dependencies - Enable IKEv1 OPTION by default - Bump PORTREVISION PR: 197824 Submitted by: Franco Fichtner <franco@lastsummer.de> (based on) Reworked by: strongswan@Nanoteq.com (maintainer) Approved by: strongswan@Nanoteq.com (maintainer)37b65d30ff
- Update to 5.2.2 - Add LICENSE PR: 196615 Approved by: strongswan@Nanoteq.com (maintainer) Security: CVE-2014-9221c9e8d09893
- Update to version 5.2.1 [1] - Convert to USES=execinfo - Fix LDAP, MYSQL options PR: 195580 [1] Submitted by: maintainer [1]2b036931bf
Remove useless %D Notified by: antoine50ab18630d