root@fw01:~ # /sbin/sysctl -a | grep ipsec
<118>[4] .ELF ldconfig path: /lib /usr/lib /usr/lib/compat /usr/local/lib /usr/local/lib/compat/pkg /usr/local/lib/compat/pkg /usr/local/lib/ipsec /usr/local/lib/perl5/5.42/mach/CORE
<6>[17] ipsec0: changing name to 'ipsec10'
<118>[23] Setting up routes for ipsec10...done.
<118> IPSECVTI1 (ipsec10) -> v4: 10.0.31.1/30
<6>[823] ipsec1: changing name to 'ipsec11'
<6>[71870] ipsec1: changing name to 'ipsec20'
<6>[80585] ipsec1: changing name to 'ipsec20'
<6>[84757] ipsec10: promiscuous mode enabled
<6>[84774] ipsec10: promiscuous mode disabled
<6>[85026] ipsec10: promiscuous mode enabled
kern.features.ipsec_natt: 1
kern.features.ipsec: 1
net.inet.ipsec.def_policy: 1
net.inet.ipsec.esp_trans_deflev: 1
net.inet.ipsec.esp_net_deflev: 1
net.inet.ipsec.ah_trans_deflev: 1
net.inet.ipsec.ah_net_deflev: 1
net.inet.ipsec.ah_cleartos: 1
net.inet.ipsec.dfbit: 0
net.inet.ipsec.ecn: 0
net.inet.ipsec.debug: 0
net.inet.ipsec.min_pmtu: 576
net.inet.ipsec.random_id: 0
net.inet.ipsec.offload.verbose: 0
net.inet.ipsec.filtertunnel: 1
net.inet.ipsec.natt_cksum_policy: 0
net.inet.ipsec.check_policy_history: 0
net.inet.ipsec.async_crypto: 0
net.inet.ipsec.crypto_support: 50331648
net.inet6.ipsec6.def_policy: 1
net.inet6.ipsec6.esp_trans_deflev: 1
net.inet6.ipsec6.esp_net_deflev: 1
net.inet6.ipsec6.ah_trans_deflev: 1
net.inet6.ipsec6.ah_net_deflev: 1
net.inet6.ipsec6.ecn: 0
net.inet6.ipsec6.debug: 0
net.inet6.ipsec6.filtertunnel: 1
net.enc.out.ipsec_bpf_mask: 1
net.enc.out.ipsec_filter_mask: 0
net.enc.in.ipsec_bpf_mask: 2
net.enc.in.ipsec_filter_mask: 0
root@fw01:~ #
root@fw01:~ # swanctl --list-sas
no files found matching '/usr/local/etc/strongswan.opnsense.d/*.conf'
da254f91-ea8e-49ef-b1ba-c1727fa06ec9: #10, ESTABLISHED, IKEv2, e1c7516a937db119_i 30276a85361654fa_r*
local 'local pub ip' @ local pub ip[500]
remote 'remote pub ip' @ remote pub ip[500]
AES_GCM_16-256/PRF_HMAC_SHA2_384/MODP_2048
established 2319s ago, rekeying in 11528s
a9d737db-caa5-46a3-abd7-23b4a655c683: #8, reqid 10, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
installed 2319s ago, rekeying in 966s, expires in 1641s
in c46dd99b, 0 bytes, 0 packets
out c56e5526, 0 bytes, 0 packets
local 0.0.0.0/0
remote 0.0.0.0/0
bf665be7-7931-4993-9c03-50d54c1f5c6a: #13, ESTABLISHED, IKEv2, b4c20eab1d170db2_i 7e733c1ad763743a_r*
local 'local pub ip' @ local pub ip[500]
remote 'remote pub ip' @ remote pub ip[500]
AES_GCM_16-256/PRF_HMAC_SHA2_256/ECP_521
established 988s ago, rekeying in 13095s
2c9e658d-075b-478d-832e-118dfc95d592: #11, reqid 20, INSTALLED, TUNNEL, ESP:AES_CBC-256/HMAC_SHA2_256_128
installed 988s ago, rekeying in 2397s, expires in 2972s
in c93e99c6, 0 bytes, 0 packets
out c9a00496, 0 bytes, 0 packets
local 0.0.0.0/0
remote 0.0.0.0/0
root@fw01:~ #
ipsec10: flags=1008051<UP,POINTOPOINT,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 1400
description: IPSECVTI1 (ipsec10)
options=0
tunnel inet local pub ip --> remote pub ip
inet 10.0.31.1 --> 10.0.31.2 netmask 0xfffffffc
groups: ipsec
reqid: 10
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
ipsec20: flags=1008051<UP,POINTOPOINT,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 1400
options=0
tunnel inet local pub ip --> remote pub ip
inet 192.41.100.1 --> 192.41.100.2 netmask 0xfffffffc
groups: ipsec
reqid: 20
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
Quote from: Monviech (Cedrik) on August 25, 2026, 04:22:41 PMI know I could download the package and extract it but not having the source code browsable (since its in a private repo) is a bit meh.