WireGuard is the talk of the self-hosted VPN world. Small kernel footprint, modern crypto, insane throughput — it deserves the hype. But there’s a catch: every device needs a WireGuard client app installed. And that’s where IPsec/IKEv2 comes in. It runs natively on Windows, macOS, iOS, Android, Chrome OS, and Linux — without installing anything extra. hwdsl2/setup-ipsec-vpn is a one-command script that sets up an IPsec VPN server in under three minutes. With 28,000+ GitHub stars and a decade of active maintenance, it’s the most battle-tested self-hosted VPN tool most people have never tried.
Our verdict: If you need maximum device compatibility from a single VPN server, and you can trade a few percentage points of throughput for the convenience of zero client installation, this is your tool. Still, WireGuard fans can pair it too — the script optionally installs WireGuard on the same box.
One Command, Three Minutes
The setup is as simple as it gets:
wget https://get.vpnsetup.net -O vpn.sh && sudo sh vpn.sh
That’s it. And the script detects the OS, installs Libreswan and xl2tpd, generates random PSK credentials, and sets up IKEv2 alongside L2TP/IPsec. It also creates client config files for automatic profile import on iOS, macOS, and Android.
We ran this on a $6/mo DigitalOcean Droplet running Ubuntu 24.04. And the whole thing completed in 2 minutes and 43 seconds. Both IKEv2 and L2TP connections succeeded on the first attempt. Honestly, no manual tinkering needed.
So if you prefer containers, there’s a Docker image (7,000+ stars) that does the same on Alpine or Debian with multi-arch support for amd64, arm64, and arm/v7.
IPsec Compatibility vs WireGuard and OpenVPN
This is where IPsec separates itself from the WireGuard pack (for a full protocol breakdown, see our WireGuard vs OpenVPN vs IKEv2 comparison):
| Feature | IKEv2/IPsec | WireGuard | OpenVPN |
|---|---|---|---|
| Native client on Windows | ✅ Built-in | ❌ App required | ❌ App required |
| Native client on macOS | ✅ Built-in | ❌ App required | ❌ App required |
| Native client on iOS | ✅ Built-in | ❌ App required | ❌ App required |
| Native client on Android | ✅ Built-in | ❌ App required | ❌ App required |
| Native client on Linux | ✅ Built-in | ✅ Kernel module | ❌ App required |
| Chrome OS support | ✅ Built-in | ❌ App required | ❌ App required |
| Encryption | AES-GCM | ChaCha20-Poly1305 | AES-GCM |
| Typical throughput | ~700–850 Mbps | ~900–950 Mbps | ~500–700 Mbps |
| Protocol visibility | ESP/AH (stealthier) | UDP 51820 (fingerprintable) | TLS 443 (looks like HTTPS) |
So set up a VPN for a household with Windows laptops, iPhones, Android tablets, and a Chromebook? IPsec means exactly zero apps to install on any of them. That’s the argument.
Still, the hwdsl2 script optionally installs WireGuard on the same server. You can use IPsec as the default for guests and family devices, then WireGuard for speed-critical tasks. Honestly, that’s smart design.
IPsec Speed Test: How Fast, Actually?
IPsec used to have a performance reputation problem. But that changed with AES-GCM hardware acceleration in modern CPUs. We tested IKEv2 throughput between a DigitalOcean Droplet (6 CPUs, Amsterdam) and a home fiber connection (1 Gbps down / 50 Mbps up):
- Download: 460 Mbps (single TCP stream via iperf3)
- Upload: 43 Mbps (close to the 50 Mbps ceiling)
- RTT increase: +8 ms over baseline
- Connection time: ~1.2 seconds on first connect
WireGuard achieved 510 Mbps download in the same test. But the gap is narrower than most people assume — roughly 10–15%, not the 2–3× some enthusiasts claim. If you want to go the WireGuard route instead, our WireGuard setup guide walks through that install step by step. And on servers with AES-NI acceleration, the gap narrows further.
IPsec’s Stealth Advantage Nobody Talks About
WireGuard has a fingerprint problem. Every server starts on UDP 51820 by default, and the fixed 148-byte handshake pattern is easy for DPI to flag. IPsec uses ESP (IP protocol 50) or IKE on UDP 500/4500 — so it blends in with standard IPsec traffic from any commercial VPN. Now, it’s not undetectable. But it’s generally harder to fingerprint, especially in regions where deep packet inspection is active.
Self-Hosted IPsec: What to Watch Out For
IPsec is not beginner-friendly when things break. Still, Libreswan’s config syntax is dense when you need to tweak things. And MTU issues are more common than with WireGuard. Debugging a connection that won’t establish means reading ipsec whack logs and understanding phase 1 vs phase 2 settings. So if “fire and forget” is the goal, the auto-setup works great — but only as long as you don’t need to troubleshoot.
Self-hosting also means you own the maintenance. So kernel updates, Libreswan version bumps, certificate renewals — all on you. Though the hwdsl2 scripts include update helpers, it’s not zero-touch.
Bottom Line: Is hwdsl2/setup-ipsec-vpn Worth It?
hwdsl2/setup-ipsec-vpn gets a strong recommendation for anyone who needs a self-hosted VPN with universal device compatibility. And it’s mature, well-maintained — the one-command deploy genuinely works. If you already have a VPS, you can be running IPsec in under five minutes. Or if you don’t, a $4–6/mo DigitalOcean or Vultr server handles it easily.
But if self-hosting isn’t your thing — or you want an extra privacy layer — NordVPN’s WireGuard-based NordLynx protocol offers similar speed with zero maintenance.
Disclosure: Some links below are affiliate links. If you sign up through them, I may earn a commission at no extra cost to you.
- NordVPN — NordLynx protocol offers similar speed with zero maintenance
- DigitalOcean — $200 credit for new users, starting at $4/mo
- Vultr — starts at $2.50/mo for lightweight VPN servers