SOURCE-BACKED VPN COMPARISONSClear prices. Informed choices.
stealthvpn. Shortlist 0
← All VPN software

FREE & OPEN-SOURCE SOFTWARE

strongSwan

A modular IPsec implementation with IKEv2 support, certificate-based authentication and documented interoperability scenarios.

THE IDEA, MAPPEDIPsec with negotiated security.
  1. 01

    IKE / IPsec endpoint

    Credentials identify the authorized endpoint.

  2. 02

    Encrypted connection

    Protocol and configuration define the tunnel.

  3. 03

    Remote endpoint

    Routes and access policy decide what is reachable.

Conceptual topology, not a deployment we tested. Follow the project documentation for supported configurations and operational requirements.

IPsec / IKE VPN implementation

Standards-based remote access and site-to-site links for administrators.

Software cost and scope

No software license fee for the listed open-source edition. Hosting, bandwidth, hardware and administration are separate.

License: GPL-2.0; project also offers commercial licensing. Open-source implementation; app/platform components and commercial options need their own review.

Read the project license information (opens in a new tab)

What you configure

You manage gateways, credentials, policies, supported algorithms and client compatibility.

Protocol: IKEv2 / IPsec.

SEE THE CONTROLS. FOLLOW THE STEPS.

Create and use an Android IKEv2 profile

Android · strongSwan VPN Client · 7 steps

This is the Android client workflow, not a swanctl server configuration tutorial.

What you’ll do: Create an Android IKEv2 profile, confirm identity, connect, check access, and stop deliberately.

Documentation checked 2026-11-09. Source-based walkthrough; we have not deployed or tested this connection. Pictures are labelled by origin. Publisher screenshots can show older interfaces; use the linked current documentation when your version differs.

Version scope: strongSwan VPN Client on Android; exact Android and app builds in the publisher screenshots are not stated.

Before you start

  • Install the client from the project’s linked official distribution options.
  • Obtain the server name, authentication method, credentials and required certificate information.
Gateway
The server hostname and expected server identity.
Authentication
The IKEv2 method and credentials or client certificate specified by the operator.
Trust
The CA/certificate information or a trusted .sswan profile.

Use your own authorized account and configuration. Keep private keys, QR codes and sign-in codes out of shared pictures.

  1. Install the client and collect the settings

    Use a distribution linked by the strongSwan project.

    1. Install strongSwan VPN Client for Android.
    2. Ask for the gateway, VPN type, credentials and certificate instructions.
    What you should see

    You have the required settings or a trusted .sswan import.

    strongSwan Android client documentation (opens in a new tab) · strongSwan profile import and credential fields (opens in a new tab)

    Documentation screenshotstrongSwan VPN Client for Android :: strongSwan Documentation — official documentation page. (opens in a new tab)
    Open full size (opens in a new tab)StealthVPN browser capture of the official documentation, 9 November 2026. Shows the website, not an installed application or completed connection.Source: strongSwan Android client documentation (opens in a new tab)

  2. Create the VPN profile

    Open Add VPN Profile for a manual configuration.

    1. Enter the operator’s server and VPN type.
    2. Fill in the authentication fields appropriate to that type.
    What you should see

    The profile has your own server and account values.

    strongSwan Android client documentation (opens in a new tab) · strongSwan profile import and credential fields (opens in a new tab) · strongSwan Project: official Android listing and screenshots (opens in a new tab)

    Publisher screenshotstrongSwan Project screenshot: profile editor with server, VPN type, username and CA certificate selection. (opens in a new tab)
    Open full size (opens in a new tab)Publisher-supplied example. App version not stated; the interface may differ today.Source: strongSwan Project: official Android listing and screenshots (opens in a new tab)

  3. Check identity and certificate trust

    The example server in a screenshot is not your gateway.

    1. Match the server identity and CA information to the issued instructions.
    2. For certificate authentication, use the operator’s client-certificate procedure.
    What you should see

    The identity and trust choice match your gateway.

    strongSwan Android client documentation (opens in a new tab) · strongSwan profile import and credential fields (opens in a new tab) · strongSwan Project: official Android listing and screenshots (opens in a new tab)

    Publisher screenshotstrongSwan Project screenshot: profile editor with server, VPN type, username and CA certificate selection. (opens in a new tab)
    Open full size (opens in a new tab)Publisher-supplied example. App version not stated; the interface may differ today.Source: strongSwan Project: official Android listing and screenshots (opens in a new tab)

  4. Save and select the profile

    Return to the saved profile list.

    1. Save your changes.
    2. Tap the profile intended for this connection.
    What you should see

    You selected the named profile you just configured.

    strongSwan Android client documentation (opens in a new tab) · strongSwan Project: official Android listing and screenshots (opens in a new tab)

    Publisher screenshotstrongSwan Project screenshot: Android profile list with no active VPN. (opens in a new tab)
    Open full size (opens in a new tab)Publisher-supplied example. App version not stated; the interface may differ today.Source: strongSwan Project: official Android listing and screenshots (opens in a new tab)

  5. Approve Android’s VPN request

    Android may ask the app for VPN permission.

    1. Check that the expected strongSwan app is requesting the connection.
    2. Approve it and return to the app; system wording varies by Android version.
    What you should see

    The system permission is granted and connection status appears.

    strongSwan Android client documentation (opens in a new tab)

  6. Check the status and destination

    A VPN symbol does not describe every app’s routing.

    1. Inspect status and open the intended resource.
    2. Review any per-app or split-tunnel choices in your profile.
    What you should see

    The intended app or destination uses the expected route.

    strongSwan Android client documentation (opens in a new tab) · strongSwan profile import and credential fields (opens in a new tab) · strongSwan Project: official Android listing and screenshots (opens in a new tab)

    Publisher screenshotstrongSwan Project screenshot: example Home profile connected, with a Disconnect button. (opens in a new tab)
    Open full size (opens in a new tab)Publisher-supplied example. App version not stated; the interface may differ today.Source: strongSwan Project: official Android listing and screenshots (opens in a new tab)

  7. Disconnect and review always-on behavior

    Stop deliberately, especially if blocking is enabled.

    1. Use Disconnect in strongSwan.
    2. Review Android’s always-on/block-without-VPN settings before expecting ordinary traffic.
    What you should see

    Traffic either stays blocked or uses the ordinary network, as configured.

    strongSwan Android client documentation (opens in a new tab) · strongSwan Project: official Android listing and screenshots (opens in a new tab)

    Publisher screenshotstrongSwan Project screenshot: example Home profile connected, with a Disconnect button. (opens in a new tab)
    Open full size (opens in a new tab)Publisher-supplied example. App version not stated; the interface may differ today.Source: strongSwan Project: official Android listing and screenshots (opens in a new tab)

Check the result

Consider leaving the password unsaved: the project’s listing states that passwords saved with profiles are stored as cleartext in the app database.

  • The intended profile establishes a connection without unresolved certificate warnings.
  • The target resource and intended DNS work.
  • You know whether Android is configured to block traffic without the VPN.
  • You can disconnect and describe the resulting blocked or ordinary-network behavior.

If it does not work

If server identity or certificate verification fails, confirm the expected certificate and server identity with the operator. Do not treat an arbitrary imported CA as proof of trust.

Authentication fails

Match the VPN type and identity fields to the operator’s instructions; an account login is not always the IKE identity.

Certificate is rejected

Confirm the gateway name and trusted CA with the operator. Do not accept an unfamiliar certificate to clear the error.

VPN symbol appears but resource fails

Check whether that resource is included in the profile’s routes and your account’s access. Inspect the client log without sharing keys or passwords.

Stop or roll back deliberately

Use Disconnect for the connection. If Android always-on or block-without-VPN was enabled, review it deliberately in Android VPN settings: stopping the tunnel may intentionally leave traffic blocked. Turning that protection off permits ordinary network traffic.

Guide sources and image metadata · Picture credits

Privacy considerations

Use the documented modern configuration path for your platform. This is an administrator’s VPN stack rather than a consumer exit-server subscription.

Your hosting arrangement, physical server location, account records and browser identity still matter. Plan credential management, updates, DNS, routing and connection-failure behavior before relying on a deployment.

Review the privacy checklist

Official resources

Documentation reviewed 2026-11-06. Project documentation reviewed; no independent security testing performed by StealthVPN. Use the project’s current installation and security guidance; platform support and configuration choices can change.

Official installation options (opens in a new tab)