To establish secure internal communication across distributed anvironments—such as on-premises data centers, public cloud instances, customer sites, or overseas locations—an IPsec-based virtual private network (VPN) provides a reliable tunneling solution. Using the hwdsl2/ipsec-vpn-server Docker image, you can deploy a fully functional IPsec/L2TP, Cisco IPsec (XAUTH), or IKEv2 VPN server with just one command.

Docker Deployment

First, create an environment file named vpn.env:

VPN_IPSEC_PSK=my_secret_psk
VPN_USER=vpnuser
VPN_PASSWORD=secure_password

Then launch the container:

docker run \
  --name vpn-server \
  --env-file ./vpn.env \
  --restart=always \
  -v ikev2-vpn-data:/etc/ipsec.d \
  -p 500:500/udp \
  -p 4500:4500/udp \
  -d --privileged \
  hwdsl2/ipsec-vpn-server

After startup, inspect the logs to retrieve connection details:

docker logs vpn-server

The output includes the server IP, pre-shared key (PSK), username, and password needed for client configuration.

Kubernetes Deployment

For Kubernetes, use the following manifest (ipsec-vpn.yaml):

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ipsec-vpn-server
  namespace: default
  labels:
    app: ipsec-vpn
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ipsec-vpn
  template:
    metadata:
      labels:
        app: ipsec-vpn
    spec:
      hostNetwork: true
      containers:
      - name: ipsec-vpn
        image: hwdsl2/ipsec-vpn-server
        imagePullPolicy: Always
        env:
        - name: VPN_IPSEC_PSK
          value: "my_secret_psk"
        - name: VPN_USER
          value: "vpnuser"
        - name: VPN_PASSWORD
          value: "secure_password"
        - name: VPN_SETUP_IKEV2
          value: "yes"
        securityContext:
          privileged: true
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "1Gi"
            cpu: "500m"

Apply the manifest:

kubectl apply -f ipsec-vpn.yaml

Retrieve connection parameters from the pod logs:

kubectl logs -l app=ipsec-vpn

Networking Considerations

The deployment uses hostNetwork: true because IPsec protocols (especially IKEv2) require fixed UDP ports (500 and 4500). Kubernetes Services perform port translasion, which breaks the IPsec handshake. While hostNetwork bypasses this issue, it reduces network isolation and should be used cautious in production.

Client Configuration

Clients on Windows, macOS, iOS, Android, Linux, and ChromeOS are supported. Official setup guides include:

• Native clients (no extra software)
• Cisco IPsec (XAUTH) for lower overhead

Ensure UDP ports 500 and 4500 are open on the host firewall and any upstream network ACLs.