NetBSD's racoon2 IKE daemon learns to handle NAT and IPv6 without hacks
Improving and Stabilizing the Racoon2 IKE Daemon in NetBSD
As part of Google Summer of Code 2026, Artem Belan overhauled the racoon2 IKE daemon in NetBSD. The project implemented RFC 7383 fragmentation, NAT-OA payloads, and address substitution for NAT-T, fixed long-broken IPv6 support, and added a unit test framework. Now the daemon can serve as a reliable L2TP/IPsec or IKEv2 VPN server behind NAT, working with built-in Windows, iOS, and Android clients out of the box.
The daemon can sit behind a NAT device and serve modern VPN clients without any workaround selectors in its configuration, IPv6 works out of the box, and the changes are protected by an automated test suite.