Ubuntu 16.04 Client Support (or documentation for lack thereof)

[GMNGeoffrey]

OS / Environment

Ubuntu 16.04 LTS

Summary of the problem

I just set up an Algo VPN, but my computer runs Ubuntu 16.04 and I just discovered that it is not supported. Do you have any plan to support Ubuntu 16.04? The FAQ suggest upgrading to 17.10, but while this is a nice tool, there's a reason I'm on an LTS release and I'm unlikely to upgrade. Do you have plans to somehow work around network manager and offer another path for 16.04 clients?

If not, could you please update the documentation to reflect this more prominently? 16.04 is hardly an outdated OS and I was surprised to discover it was not supported, especially since algo seems to use a 16.04 server...

[defunctio]

Right now Ubuntu 16.04 is supported but only via the ipsec CLI interface not through the NM GUI. You can find the issue regarding the underlying issues here #263. I have submitted a few PR's to strongswan to address these issues and hopefully will be merged soon (5.5.3?).

• charon-nm IKE/ESP proposal support strongswan/strongswan#69
• network manager strongswan IKE/ESP proposal support strongswan/strongswan#70

We are also attempting to file an SRU with ubuntu for strongswan #494. This all really depends on release timing and if the SRU is approved. If not maybe we can get backported patches into downstream packages in the future. We really don't want to resort to providing a PPA.

Unfortunately that means an ugly process or custom builds for now but I'm actively engaged in improving the user experience on this front and there is more to come. In fact several of the core Algo team have taken a stance to improve client side user experience and support all around as of recently.

[GMNGeoffrey]

Ah excellent! I was hoping that I was mistaken. I'm fine using a CLI. I was having an issue setting up my client using the instructions here and while troubleshooting found what looked like lack of support for 16.04. I'll peck around a bit more, but I may be back shortly for help debugging :-)

You might want to clarify that in the documentation. e.g. in contributing and troubleshooting where it suggests 16.04 is not suported at all.

Thanks!

[defunctio]

I'm not really sure why contributing states only 17.04 it may be because of issues with networkmanager. Though technically 16.04 should still be supported as a client via ipsec cli and helper playbooks exist like deploy_client.yml.

@dguido was this intentional or should we update documentation?

[dguido]

You might want to clarify that in the documentation. e.g. in contributing and troubleshooting where it suggests 16.04 is not supported at all.

There is no section in troubleshooting where it says that Ubuntu 16.04 is not supported at all.

In contributing, we are referring to Network Manager clients which are the vast majority of Algo users. I'd rather not put in more complicated language to address the < 1% of people who configure ipsec outside of Network Manager.

Do you have any plan to support Ubuntu 16.04?

Don't try and blame this problem on us!

[GMNGeoffrey]

You might want to clarify that in the documentation. e.g. in contributing and troubleshooting where it suggests 16.04 is not supported at all.

There is no section in troubleshooting where it says that Ubuntu 16.04 is not supported at all.

No it certainly doesn't say that explicitly, but it does say "You must upgrade to Ubuntu 17.04", which rather implies that 16.04 isn't supported at all. I'm just letting you know that I found the existing documentation misleading. Take it as you will.

Do you have any plan to support Ubuntu 16.04?

Don't try and blame this problem on us!

I'm not trying to blame any problem on anyone. I think "no we don't have any plan because Ubuntu 16.04 comes with a totally borked network manager" would be a totally reasonable answer. It turns out that there is existing support and plans to make it better as outlined above by Defunctio, so that's great! I'm glad I asked instead of looking for another VPN solution.