IKEv2 on Linux with strongSwan (NetworkManager)

Desktop Linux speaks IKEv2 through strongSwan, and the friendliest way to drive it is the NetworkManager plugin: the VPN shows up next to your Wi-Fi networks, toggled from the system menu.

One setting people miss

With default options the connection authenticates and then fails at the tunnel stage with FAILED_CP_REQUIRED / TS_UNACCEPT. The fix is a single checkbox, Request an inner IP address, covered in step 4. If you’re here because of that error, jump straight to it.

What you need

From your Servers page (log in first):

• Your VPN username and password (top card; separate from your website login)
• A server address from the IKEv2 tab

Setup Guide

1. Install the strongSwan NetworkManager plugin

   Debian / Ubuntu

   sudo apt update && sudo apt install network-manager-strongswan libcharon-extra-plugins

   Fedora

   sudo dnf install NetworkManager-strongswan-gnome

   Arch

   sudo pacman -S networkmanager-strongswan strongswan

   Log out and back in (or sudo systemctl restart NetworkManager) so the new VPN type appears.

2. Add the VPN connection

   Open Settings → Network → VPN → Add, and choose IPsec/IKEv2 (strongswan).

   

3. Fill in the server and credentials

   • Address: the server address from the Servers page IKEv2 tab
   • Certificate: leave as (None); the server presents a public certificate
   • Authentication: EAP (Username/Password)
   • Username / Password: your VPN credentials from the Servers page

4. Tick “Request an inner IP address”

   Open the Options section at the bottom and enable Request an inner IP address. This is the step the default dialog leaves unchecked, and without it the tunnel is rejected after authentication.

   

5. Save and connect

   Save, then flip the VPN toggle in your system menu.

Verify

From a terminal:

curl -s https://buyvpn.com/api/ip

If it returns the VPN server’s IP, not yours, you’re tunnelled. IKEv2 is a fast native protocol, so on a good line it barely dents your speed. Here’s a real result through the tunnel on a UK server:

Troubleshooting

Common Issues

FAILED_CP_REQUIRED or TS_UNACCEPT (authenticates, then drops)

• The single most common cause: Request an inner IP address is unchecked. Enable it in the connection’s Options (step 4) and reconnect.

Authentication fails

• VPN credentials, not website credentials: copy them fresh from the Servers page.

The IKEv2 option doesn’t appear when adding a VPN

• The plugin isn’t loaded: reinstall the package for your distro above, then sudo systemctl restart NetworkManager or re-login.

Won’t connect on this network

• IKEv2 uses UDP 500/4500, which hotel and campus firewalls often block. On those networks you need stealth: Hiddify on Linux runs our VLESS Reality and Hysteria2 subscription.

Headless server instead?

Without a desktop, strongSwan is configured via swanctl.conf, which is its own rabbit hole. For servers we recommend the simpler OpenVPN CLI route, or open a ticket and we’ll help with a swanctl config.