Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I ran IKEv2 2-3 VPNs for multiple years with a few dozen users, I have to say from experience I disagree with you there (I'm the author of the repo, @pirate). For various reasons, StrongSwan required manual intervention much more frequently than WireGuard has for far. Often I'd have to manually restart the service, or adding a new host would break stuff for all the others. The minimal config required to match my current WireGuard config was about 3x the number of lines, which meant 3x the number of things that could break each time I added a host. Even if it's better documented, that surface area is painful to deal with from a Sysadmin perspective when all I want is something that just works.


Initial setup for IKEv2 is convoluted at best, but once it’s setup there are very few problems with it.

I (used to) run L2TP/IPSec and WireGuard on my Edgerouter 4, and both would give “acceptable” speeds (30-40 MBit on a 300/300 connection), but when recreating my firewall in PfSense, I went full IKEv2, and have not regretted it. With my SG-3100 I get ~100 MBit with IKEv2.

On thing I hated about WireGuard is the fact that all clients require configuration on the server.

I do still run it on one of my servers, as a client to Mullvad VPN, which in turn is used by a few docker containers. It could easily be replaced by IKEv2, but sadly most VPN providers only support OpenVPN and WireGuard, or have horrible speeds.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: