Which VPN to choose?

Question

I need to setup a VPN which is compatible with iOS devices (IPSec / L2TP / IKEv2, no PPTP please). My requirements are:

• Encrypted connection to a single server (with a critical application on it that should not be exposed to the internet)
• Only traffic to this specific server shall go through the VPN, traffic to other sites shall not be routed through the VPN
• Multiple clients should be able to connect to VPN to use the app on the server
• Those clients have dynamic IP-addresses
• They don't need to "see" each other but if they do it wouldn't be a problem

I've read a lot in the last days but the combinations and possibilities for VPNs seem to be endless. StrongSwan has some nice configuration examples, but none seem to match my requirements. I don't need a tunnel or bridge sites. A lot of tutorials show how to setup a L2TP over IPSec VPN to access the internet (e.g. from behind the great firewall) but that's not very helpful in my case.

1. Do I need L2TP for this use-case?
2. Can't I just use IPSec in transport mode?
3. How would I setup IPSec authentication?
4. Would IPSec in transport mode allow multiple clients?
5. Can IPSec transport mode work with dynamic IPs of the clients?

Any hints or directions what to read next or what technologies to use are welcome. A configuration example even better :)

Answer 1

Yes, IPSec in transport mode will fit your needs quite nicely and has no problem with multiple clients with dynamic addresses. In my experience, it is also faster and more efficient than other protocols, and once set up, never requires manual connect/disconnect actions when you want access to the server. The down side though, is that I have yet to find any decent configuration tools so figuring out how to set it all up on the command line can be a bit of a PITA.

You will need to install the IKE client/server daemon racoon and configure it so that when clients want to connect, they can call up the IKE server, provide suitable authentication ( password, RSA, or x.509 ), and generate and configure the session key.

See http://www.ipsec-howto.org/