connections {
    ikev2-eap {
        version = 2
        # iOS/macOS/Android 互換の暗号スイート
        proposals = aes256gcm16-prfsha256-ecp256,aes256-sha256-ecp256,aes256gcm16-prfsha384-ecp384,aes256-sha256-modp2048,aes256-sha1-modp2048

        local {
            auth = pubkey
            certs = server.crt
            id = ${VPN_DOMAIN}
        }

        remote {
            auth = eap-mschapv2
            eap_id = %any
        }

        children {
            vpn {
                local_ts = 0.0.0.0/0
                esp_proposals = aes256gcm16,aes256-sha256,aes256-sha1
                dpd_action = clear
            }
        }

        pools = pool4
        send_certreq = no
        dpd_delay = 30s
    }
}

pools {
    pool4 {
        addrs = 10.10.0.0/24
        dns = 1.1.1.1,8.8.8.8
    }
}

secrets {
${VPN_SECRETS}
}