# Refactoring the IPsec documentation **URL:** \ **Category:** Documentation\ **Created:** [21 July 2021 16:16 UTC](https://community.ipfire.org/t/refactoring-the-ipsec-documentation/5858 "2021-07-21T16:16:52Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![ms](https://community.ipfire.org/user_avatar/community.ipfire.org/ms/32/16615_2.png) [@ms](https://community.ipfire.org/u/ms)\ **Post date:** [21 July 2021 16:16 UTC](https://community.ipfire.org/t/refactoring-the-ipsec-documentation/5858/1 "2021-07-21T16:16:52Z")
Hello, the other day, I wanted to add some information about how to setup IPsec RW with Apple macOS & iOS. And I didn’t know where to start. The whole IPsec section was practically one laaaaarge page with lots and lots of stuff that didn’t have to be there and lots and lots of stuff that was repeating itself. In there was also a lot of information that I considered to be plain wrong. So I decided to bring some structure into it and I split the long page into multiple sub-pages. One for net-to-net connections and one for host-to-net connections. I summarised those pages and removed a lot of excess stuff which I do not like (we do not need to explain to people how to save a file) and added some more content. Especially about the difference of PSK vs. certificate (that section is probably not very good) and ciphers. I wanted to ask for a little review and about what is good or bad about this. > **[IPsec - The IPFire Wiki](https://wiki.ipfire.org/configuration/services/ipsec)** ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [21 July 2021 22:08 UTC](https://community.ipfire.org/t/refactoring-the-ipsec-documentation/5858/2 "2021-07-21T22:08:04Z")
Excellent! I had always wanted to give IPsec a try. Thank you! Yesterday I started to add an image and I got stuck at the **Host-to-Net Endpoint**. I saw the info on the **Global Configuration** wiki page but it did not click for me What info is added to this field? I’ll read through the wiki and give IPsec a try. ---
**Author:** ![ms](https://community.ipfire.org/user_avatar/community.ipfire.org/ms/32/16615_2.png) [@ms](https://community.ipfire.org/u/ms)\ **Post date:** [22 July 2021 20:24 UTC](https://community.ipfire.org/t/refactoring-the-ipsec-documentation/5858/3 "2021-07-22T20:24:23Z")
Split this topic on 22 July 2021 20:24 UTC A post was merged into an existing topic: [One-click VPNs for Apple iOS](https://community.ipfire.org/t/one-click-vpns-for-apple-ios/5847/13) ---
**Author:** ![ms](https://community.ipfire.org/user_avatar/community.ipfire.org/ms/32/16615_2.png) [@ms](https://community.ipfire.org/u/ms)\ **Post date:** [22 July 2021 20:23 UTC](https://community.ipfire.org/t/refactoring-the-ipsec-documentation/5858/4 "2021-07-22T20:23:59Z")
> [@jon](#): > > What info is added to this field? The FQDN is going in here. So usually that is the “DynDNS hostname”. Looks like this needs some more explanation in the documentation. ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [22 July 2021 21:30 UTC](https://community.ipfire.org/t/refactoring-the-ipsec-documentation/5858/5 "2021-07-22T21:30:22Z")
In OpenVPN it is known as a different name/description: **Local VPN Hostname/IP:** ![Screen Shot 2021-07-22 at 4.28.26 PM](https://community.ipfire.org/uploads/default/original/2X/b/bbdd15cbd3dde28db5b032c8373498b736a59b07.png) Thanks! ---
**Author:** ![r1200cl](https://community.ipfire.org/user_avatar/community.ipfire.org/r1200cl/32/7678_2.png) [@r1200cl](https://community.ipfire.org/u/r1200cl)\ **Post date:** [22 July 2021 23:49 UTC](https://community.ipfire.org/t/refactoring-the-ipsec-documentation/5858/6 "2021-07-22T23:49:39Z")
> [@ms](#): > > Looks like this needs some more explanation in the documentation. I think you may show the DNS page in iPfire. As my understanding is one must add the service here as well, or ? The explanation you gave me earlier that you must be able to ping your iPfire with the DNS name was very helpful to me. As an example, create a user at [noip.com](http://noip.com), and then create a name xxxx. So [xxxx.ddns.net](http://xxxx.ddns.net) will be the “public” name of your firewall. Your ISP can change your public ip, but the [xxxx.ddns.net](http://xxxx.ddns.net) will always point to your home address. ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [23 July 2021 03:28 UTC](https://community.ipfire.org/t/refactoring-the-ipsec-documentation/5858/7 "2021-07-23T03:28:53Z")
> [@ms](#): > > Looks like this needs some more explanation in the documentation. on this page: [https://wiki.ipfire.org/configuration/services/ipsec/host-to-net/apple](https://wiki.ipfire.org/configuration/services/ipsec/host-to-net/apple) Under **Create a new Roadwarrior connection** I am stuck at: > - The IPFire system should have a FQDN which resolves from the public Internet > - The CA certificate must contain a subjectAlternativeName with the system’s FQDN which must be used for IPsec, too. How is the first bullet different from the second bullet? Is the second bullet a local FQDN? (e.g. **ipfire.localdomain** ) ---
**Author:** ![ms](https://community.ipfire.org/user_avatar/community.ipfire.org/ms/32/16615_2.png) [@ms](https://community.ipfire.org/u/ms)\ **Post date:** [27 July 2021 14:12 UTC](https://community.ipfire.org/t/refactoring-the-ipsec-documentation/5858/8 "2021-07-27T14:12:58Z")
Split this topic on 27 July 2021 14:12 UTC 3 posts were merged into an existing topic: [One-click IPsec VPNs for Apple iOS](https://community.ipfire.org/t/one-click-ipsec-vpns-for-apple-ios/5847/36) ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [24 July 2021 14:21 UTC](https://community.ipfire.org/t/refactoring-the-ipsec-documentation/5858/11 "2021-07-24T14:21:57Z")
Split this topic on 24 July 2021 14:21 UTC 7 posts were merged into an existing topic: [One-click VPNs for Apple iOS](https://community.ipfire.org/t/one-click-vpns-for-apple-ios/5847/16) ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [26 July 2021 17:19 UTC](https://community.ipfire.org/t/refactoring-the-ipsec-documentation/5858/12 "2021-07-26T17:19:02Z")
Michael - I added a few items to the Global Config page. > **[Global Configuration - The IPFire Wiki](https://wiki.ipfire.org/configuration/services/ipsec/init)** If I over-stepped or made an error please let me know. (I seem to remember you are not shy!) ---
**Author:** ![ms](https://community.ipfire.org/user_avatar/community.ipfire.org/ms/32/16615_2.png) [@ms](https://community.ipfire.org/u/ms)\ **Post date:** [27 July 2021 14:19 UTC](https://community.ipfire.org/t/refactoring-the-ipsec-documentation/5858/13 "2021-07-27T14:19:37Z")
> [@jon](#): > > If I over-stepped or made an error please let me know. (I seem to remember you are not shy!) LOL, no I am not shy to point out any technical errors, because we can all learn from that. You definitely didn’t overreach. This is a wiki and it should be edited. It is never done 🙂 I have a couple of remarks/ideas though. There is a part of the page that now reads like this: > [@](#): > > The FQDN of your IPFire system (e.g. [trucking.ipfire-at-home.com](http://trucking.ipfire-at-home.com)). Can be the DynDNS hostname - e.g., [example.ddns.org](http://example.ddns.org). This has to resolve to the public IP address of your IPFire system and will become the Common Name of the host certificate To me this reads like there are two examples now which is probably more confusing. Should we generally make up a company that we constantly use throughout the wiki so that examples are consistent across all pages of the wiki? I sometimes use “ABC Trucking PLC”, but this could be of course anything that is generic. I changed that star to actual footnotes, just because they disappear at the end of the page and clicking on the little number takes you straight there. ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [27 July 2021 18:51 UTC](https://community.ipfire.org/t/refactoring-the-ipsec-documentation/5858/14 "2021-07-27T18:51:04Z")
> [@ms](#): > > > [@](#): > > > > The FQDN of your IPFire system (e.g. [trucking.ipfire-at-home.com](http://trucking.ipfire-at-home.com)). Can be the DynDNS hostname - e.g., [example.ddns.org](http://example.ddns.org). This has to resolve to the public IP address of your IPFire system and will become the Common Name of the host certificate > > To me this reads like there are two examples now which is probably more confusing. Yes - two examples. To me the two examples made it less confusing. The company example made perfect sense. - as a VERY picky item I’d stick with the company theme and make the FQDN something like `ABCTruckingExample.com`. I’d removed the `ipfire-at-home` reference. Like I said ‘very picky’! The second example is for the Home user that doesn’t have a static IP and has (or needs) a dynamic DNS hostname. If OK with two examples, I’ll re-word that paragraph and hopefully it will be less confusing! > [@ms](#): > > I changed that star to actual footnotes, just because they disappear at the end of the page and clicking on the little number takes you straight there. Looks good!