ss -lunp | grep -E ':(500|4500)\b'

（无输出，说明 UDP 500/4500 均未被占用）

lsmod | grep xfrm_user

xfrm_user              61440  1
xfrm_algo              16384  1 xfrm_user

apt-cache policy strongswan

strongswan:
  Installed: 5.9.5-2ubuntu2.8
  Candidate: 5.9.5-2ubuntu2.8
  Version table:
 *** 5.9.5-2ubuntu2.8 500
        500 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     5.9.5-2ubuntu3.2 500
        500 http://archive.ubuntu.com/ubuntu jammy-proposed/main amd64 Packages
     5.9.5-2ubuntu1.2 500
        500 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages

sudo apt update
sudo apt install -y strongswan strongswan-swanctl

Reading package lists...
Building dependency tree...
Reading state information...
The following additional packages will be installed:
  libcharon-extauth-plugins libip4tc2 libstrongswan
  libstrongswan-standard-plugins strongswan-charon strongswan-libcharon
  strongswan-starter
Suggested packages:
  libstrongswan-extra-plugins libcharon-extra-plugins
The following NEW packages will be installed:
  libcharon-extauth-plugins libip4tc2 libstrongswan
  libstrongswan-standard-plugins strongswan strongswan-charon
  strongswan-libcharon strongswan-starter strongswan-swanctl
0 upgraded, 9 newly installed, 0 to remove and 3 not upgraded.
Need to get 1098 kB of archives.
...
Setting up strongswan-starter (5.9.5-2ubuntu2.8) ...
invoke-rc.d: policy-rc.d denied execution of start.
invoke-rc.d: policy-rc.d denied execution of start.

sudo apt install -y strongswan-pki

The following NEW packages will be installed:
  strongswan-pki
0 upgraded, 1 newly installed, 0 to remove and 3 not upgraded.
Need to get 57.9 kB of archives.
After this operation, 303 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu jammy-updates/universe amd64 strongswan-pki amd64 5.9.5-2ubuntu2.8 [57.9 kB]
Fetched 57.9 kB in 2s (23.9 kB/s)
Selecting previously unselected package strongswan-pki.

ipsec version

Linux strongSwan U5.9.5/K6.8.0-138-generic
University of Applied Sciences Rapperswil, Switzerland
See 'ipsec --copyright' for copyright information.

/lib/systemd/system/strongswan-starter.service

lrwxrwxrwx 1 root root 26 Sep 10 12:38 /lib/systemd/system/ipsec.service -> strongswan-starter.service

systemctl status strongswan-starter.service --no-pager

○ strongswan-starter.service - strongSwan IPsec IKEv1/IKEv2 daemon using ipsec.conf
     Loaded: loaded (/lib/systemd/system/strongswan-starter.service; enabled; vendor preset: enabled)
     Active: inactive (dead)

sudo systemctl start strongswan-starter.service
sudo systemctl enable strongswan-starter.service

● strongswan-starter.service - strongSwan IPsec IKEv1/IKEv2 daemon using ipsec.conf
     Loaded: loaded (/lib/systemd/system/strongswan-starter.service; enabled; vendor preset: enabled)
     Active: active (running) since Tue 2026-10-20 11:17:56 UTC; 5ms ago
   Main PID: 599 (starter)
      Tasks: 2 (limit: 5753)
     Memory: 368.0K
        CPU: 4ms
     CGroup: （CGroup 层级路径与宿主环境相关，此处省略）
             └─599 /usr/lib/ipsec/starter --daemon charon --nofork

[Unit]
Description=strongSwan IPsec IKEv1/IKEv2 daemon using ipsec.conf
After=network-online.target

[Service]
ExecStart=/usr/sbin/ipsec start --nofork
ExecReload=/usr/sbin/ipsec reload
Restart=on-abnormal

[Install]
WantedBy=multi-user.target

sudo systemctl start|stop|restart|reload strongswan-starter.service
sudo systemctl status strongswan-starter.service

ipsec version && systemctl is-active strongswan-starter.service && swanctl --version

Linux strongSwan U5.9.5/K6.8.0-138-generic
Copyright (C) 2006-2022 Andreas Steffen.
Copyright (C) 2006-2022 strongSwan project. All rights reserved.
University of Applied Sciences Rapperswil, Switzerland
active
strongSwan swanctl 5.9.5

ss -lunp | grep -E ':(500|4500)\b'

UNCONN 0      0            0.0.0.0:4500       0.0.0.0:*    users:(("charon",pid=553,fd=12))
UNCONN 0      0            0.0.0.0:500        0.0.0.0:*    users:(("charon",pid=553,fd=11))
UNCONN 0      0                  *:4500             *:*    users:(("charon",pid=553,fd=10))
UNCONN 0      0                  *:500              *:*    users:(("charon",pid=553,fd=9))

sudo apt install -y build-essential libgmp-dev libssl-dev libcurl4-openssl-dev \
  wget gperf bison flex pkg-config libsystemd-dev

cd /root
wget https://download.strongswan.org/strongswan-6.1.0.tar.bz2
sha256sum strongswan-6.1.0.tar.bz2

ls -la strongswan-6.1.0.tar.bz2
sha256sum strongswan-6.1.0.tar.bz2

-rw-r--r-- 1 root root 4620545 Sep  7 12:04 strongswan-6.1.0.tar.bz2
fe6c97481298767213cfc2e9a1da29fdd8018d481ff4cb9cf0283099654f20d4  strongswan-6.1.0.tar.bz2

tar xf strongswan-6.1.0.tar.bz2
cd strongswan-6.1.0
./configure --prefix=/usr/local --sysconfdir=/etc \
  --enable-swanctl --enable-openssl --enable-systemd \
  --with-systemdsystemunitdir=/usr/local/lib/systemd/system
make -j$(nproc)

 strongSwan will be built with the following plugins
-----------------------------------------------------
libstrongswan: random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pgp dnskey sshkey pem openssl pkcs8 xcbc cmac kdf drbg
libcharon:     attr kernel-netlink resolve socket-default vici updown counters
libtnccs:
libtpmtss:

make[2]: Entering directory '/root/strongswan-6.1.0'
make[2]: Leaving directory '/root/strongswan-6.1.0'
make[1]: Leaving directory '/root/strongswan-6.1.0'

sudo make install

/usr/local/sbin:
charon-systemd
swanctl

/usr/local/libexec/ipsec:
_updown
charon
xfrmi

/usr/local/libexec/ipsec/charon --version | head -1

strongSwan 6.1.0

[Unit]
Description=strongSwan IPsec IKEv1/IKEv2 daemon using swanctl
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
ExecStart=/usr/local/sbin/charon-systemd
ExecStartPost=/usr/local/sbin/swanctl --load-all --noprompt
ExecReload=/usr/local/sbin/swanctl --reload
ExecReload=/usr/local/sbin/swanctl --load-all --noprompt
Restart=on-abnormal

[Install]
WantedBy=multi-user.target
Alias=strongswan-swanctl.service

sudo systemctl daemon-reload
sudo systemctl enable --now strongswan.service

mkdir -p /root/debs && cd /root/debs
apt-get download strongswan strongswan-swanctl strongswan-starter

ls -la /root/debs/

-rw-r--r-- 1 root root 155826 Sep 21 12:26 strongswan-starter_5.9.5-2ubuntu2.8_amd64.deb
-rw-r--r-- 1 root root 119006 Sep 21 12:26 strongswan-swanctl_5.9.5-2ubuntu2.8_amd64.deb
-rw-r--r-- 1 root root  18704 Sep 21 12:26 strongswan_5.9.5-2ubuntu2.8_all.deb

Fetched 294 kB in 2s (138 kB/s)

cd /root/debs
dpkg -i strongswan_5.9.5-2ubuntu2.8_all.deb

Preparing to unpack strongswan_5.9.5-2ubuntu2.8_all.deb ...
Unpacking strongswan (5.9.5-2ubuntu2.8) over (5.9.5-2ubuntu2.8) ...
Setting up strongswan (5.9.5-2ubuntu2.8) ...

# moon:/etc/swanctl/conf.d/site2site.conf（sun 侧对称互换地址与身份）
connections {
    net-30-40 {
        version = 2
        local_addrs = 10.89.57.11
        remote_addrs = 10.89.57.12
        proposals = aes256-sha384-modp2048
        send_cert = always
        dpd_delay = 30s
        local {
            auth = pubkey
            id = moon.quzuo.lab
            certs = moon-cert.pem
        }
        remote {
            auth = pubkey
            id = sun.quzuo.lab
        }
        children {
            net-30-40 {
                local_ts = 192.168.30.0/24
                remote_ts = 192.168.40.0/24
                esp_proposals = aes256gcm16-prfsha384-modp2048
                start_action = start
                dpd_action = restart
                rekey_time = 60m
            }
        }
    }
}

sudo ufw allow 500/udp
sudo ufw allow 4500/udp
sudo ufw allow proto esp from any to any

Rules updated
Rules updated (v6)
Rules updated
Rules updated (v6)

sudo apt update && sudo apt upgrade strongswan

sudo apt-mark hold strongswan

strongswan set on hold.

$ apt-mark showhold
strongswan
$ apt-mark unhold strongswan
Canceled hold on strongswan.

sudo apt install strongswan=5.9.5-2ubuntu1.2 strongswan-charon=5.9.5-2ubuntu1.2

charon {
    filelog {
        charon-file {                 # 段名自取，合法字符集内
            path = /var/log/strongswan-charon.log
            time_format = %T
            default = 1
        }
    }
}

Starting strongSwan 5.9.5 IPsec [starter]...
initiate completed successfully
-rw-r--r-- 1 root root 4096 Oct 20 11:36 /var/log/strongswan-charon.log
11:36:50 15[IKE] IKE_SA net-30-40[1] established between 10.89.57.11[moon.quzuo.lab]...10.89.57.12[sun.quzuo.lab]

# 1. 停止并禁用服务（若存在）
sudo systemctl stop strongswan-starter.service 2>/dev/null
sudo systemctl disable strongswan-starter.service 2>/dev/null

# 2. purge 全家（元包+工具+库+插件）
sudo apt-get purge -y strongswan strongswan-swanctl strongswan-pki \
  "strongswan-*" "libcharon-*" "libstrongswan*"
sudo apt-get autoremove -y

# 3. 清理配置残留
sudo rm -rf /etc/swanctl /etc/strongswan.d /etc/strongswan.conf \
  /etc/ipsec.conf /etc/ipsec.secrets /etc/ipsec.d

# 4. 终验
dpkg -l | grep -i strongswan; echo "dpkg_grep_exit=$?"
pgrep -a charon; echo "pgrep_exit=$?"
ss -lunp | grep -E ':(500|4500)\b'

dpkg_grep_exit=1
pgrep_exit=1
ls: cannot access '/etc/strongswan.conf': No such file or directory
ls: cannot access '/etc/strongswan.d': No such file or directory
（ss 无输出，UDP 500/4500 已无监听）