Static ip for a mobile client

  • Hello,

    I wanted to specify a static ip address to a mobile client. When using OpenVPN i was able to push an ip address to the client using


    Is there a way to do that in IPSEC?

  • Rebel Alliance Developer Netgate

    VPN > IPsec, Pre-Shared Keys tab, where you setup the key for a user there is a Virtual Address Pool option where you can set a static IP address for a user.

  • The Pre-shared keys information is not being used by the android client.

    In Pre-Shared keys tab, I created an entry with peer identifier set to an email address (this is what i set in the android client), a random number PSK and a virtual IP of
    The same email address is what I used as Peer Identifier (User distinguised name) in VPN>IPsec>Mobile Clients>Edit Phase 1. Also, I set a Virtual Address pool of in VPN>IPSec>Mobile Clients. The authentication I have setup for Phase 1 is 'Mutual PSK+Xauth'.

    Can you clarify how the Pre-Shared Keys entries should match up with the data in VPN>IPsec>Mobile Clients and Phase 1 entries?

  • Rebel Alliance Developer Netgate

    The P1 entries are global for all users. That's typically called something like a group ID or key, or a Pre-Shared Key in clients.

    The entries on the PSK tab setup per-user keys used as username/password style entries for IKEv2, which is probably why it's not working for you. xauth users regular users (or RADIUS).

    You could try setting a PSK tab entry for the username the user enters, which would be different from their identity, but I haven't tried that.

    Pretty much everyone has moved away from xauth to IKEv2, though. I know it isn't supported on Android natively (even on 10), but the strongSwan app works quite well in my experience.

  • Ok, I ditched xauth in favor of IKEv2 and now have strongSwan on my Android 10 mobile. I can ping LAN ip addresses and external ips (tried from the mobile, however DNS resolving does not work. I did pass the firewall IP as a DNS server in IPSEC>Mobile Clients settings. On the firewall, I am using DNS Resolver with the following settings,


    I specified an ACL for Network which the mobile uses,


    In Firewall rules for IPSEC interface I have Any to Any allow all rule for IPV4. In Diagnostic>States, i can see a state from the mobile client to the firewall ip at port 53 with state NO_TRAFFIC:SINGLE and packets 2/0. Any idea why is the firewall not responding to the mobile? Am i missing a route back from the firewall to the mobile?

  • This seemed to have helped with the DNS issue.

Log in to reply