swanctl.conf.j2

connections {
    ikev2-eap {
        version = 2
        pools = primary-pool-ipv4
        dpd_delay = 30s
        send_cert = always
        local-1 {
            auth = pubkey
            certs = fullchain.pem
            id = {{ domain }}
        }
        remote-1 {
            auth = eap-mschapv2
            # go ask the client for its eap identity.
            eap_id = %any
        }
        children {
            ikev2-eap {
                local_ts = {{ vpn_local_ts }}
            }
        }
    }
}

pools {
    primary-pool-ipv4 {
        addrs = 172.16.252.0/24
        dns = 8.8.8.8, 8.8.4.4
        split_exclude = 172.16.0.0/12
    }
}

secrets {
  {% for user in vpn_users %}
    eap-{{ user.username }} {
        id = {{ user.username }}
        secret = "{{ user.password }}"
    }
  {% endfor %}
}