# IoT IP Overlay Network Security Performance Analysis with Open Source Infrastructure Deployment
## 3 Components of Overlay Architecture
### LibreSwan  
LibreSwan [28] and StrongSwan [29] are open-source implementations of the IPsec protocol. They are derived from the FreeSwan project and are available as pre-packaged solutions on Linux distributions like RedHat. However, detailed instructions for compiling the software are provided within the project's code for use on non-packaged Linux platforms. Following installation and proper configuration, an IPsec VPN gateway is established to safeguard data transmission among network members. LibreSwan [28] and StrongSwan [29] are open-source implementations of the IPsec protocol, derived from the FreeSwan project, and are available as pre-packaged solutions on Linux distributions like RedHat. For non-packaged Linux platforms, detailed instructions for compiling the software are included within the project's code. After installation and proper configuration, an IPsec VPN gateway is established to secure data transmission among network members. Both StrongSwan and LibreSwan support policy-based and route-based VPN configurations. However, in the former case, they are used exclusively unless transitioning from the traditional IPsec.conf configuration to the newer swanctl.conf format. In the latter case, both policies are supported by default, with specific flags available to manage them. In this article, LibreSwan will be referenced. Table 1 provides a list of features of the LibreSwan suite. Although both use the same format for the IPsec.conf configuration file, LibreSwan's configuration files are not compatible with StrongSwan's due to differences in supported architectures and options. For example, LibreSwan does not support L2 TP IPsec for Android because it relies on the DH2 version (MODP1024), which is considered too weak and is disabled during compilation.  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Feature** & **LibreSwan** \\ \hline _Pre-shared key authentication_ & Yes \\ \hline _Public-key authentication_ & Yes \\ \hline _IKEv1 key exchange_ & Yes \\ \hline _IKEv2 key exchange_ & Yes \\ \hline _AH support_ & Yes \\ \hline _NSS compatibility_ & Yes \\ \hline _DnsSec/XAUTH_ & Yes \\ \hline _Network Manager compatibility_ & Yes \\ \hline _VIP (Virtual IP Pools)_ & Yes \\ \hline _NAT Traversal_ & Yes \\ \hline _MOBIKE_ & Yes \\ \hline _Route-based VPN_ & Yes \\ \hline _Policy-based VPN_ & Yes \\ \hline _Native [Policy/Route]–based VPN_ & Yes \\ \hline _HA (High Availability)_ & Yes \\ \hline _Legacy cipher suites backwards compatibility_ & No \\ \hline \hline \end{tabular}
\end{table}
Table 1: LibreSwan features table.  
OpenWrt  
OpenWrt [30] is a distribution that significantly boosts these devices' functionality beyond the default firmware provided by manufacturers. It includes a user-writable filesystem, which allows for the installation of third-party applications, thus expanding the device's capabilities. By incorporating the latest routing software, OpenWrt enhances security and reduces software bugs compared to the original manufacturer software, especially on older devices that no longer receive support. Furthermore, OpenWrt can be deployed on custom hardware, including specific boards. For x86-64 bits platforms, it supports virtualization, enabling the setup of small container networks for on-demand services and ensuring network access for all devices connected to the LAN.