From fc160003d868217aa4f7378c4e341c8d9d7cd2bc Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Thu, 23 Jul 2026 07:57:39 +0200
Subject: [PATCH 01/10] strongswan: reorder local var in config_child function

The local variables were completely jumbled. To keep track of them, they
have been sorted to the order in which the following 'config_get' calls
are made.

No functional change.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/swanctl.init | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 13a7a1278d6e2..a2b5a8a9c6992 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -225,26 +225,26 @@ config_child() {
 	local conf="$1"
 	local mode="$2"
 
-	local hw_offload
-	local interface
-	local ipcomp
-	local priority
-	local local_subnet
+	local startaction
 	local local_nat
 	local updown
 	local firewall
-	local remote_subnet
 	local lifetime
 	local dpdaction
 	local closeaction
-	local startaction
 	local if_id
 	local rekeytime
+	local ipcomp
+	local interface
+	local hw_offload
+	local priority
 	local rekeybytes
 	local lifebytes
 	local rekeypackets
 	local lifepackets
 	local replay_window
+	local local_subnet
+	local remote_subnet
 
 	config_get startaction "$conf" startaction "route"
 	config_get local_nat "$conf" local_nat ""

From 53ce496ee3e49a86798bfc6ecdacda765dbe15a4 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Thu, 23 Jul 2026 08:00:09 +0200
Subject: [PATCH 02/10] strongswan: reorder local var in config_remote function

The local variables were completely jumbled. To keep track of them, they
have been sorted in the order in which the following 'config_get' calls
are made.

No functional change.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/swanctl.init | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index a2b5a8a9c6992..6e345a4c1221c 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -441,13 +441,11 @@ config_remote() {
 
 	local enabled
 	local gateway
-	local local_sourceip
-	local local_ip
-	local local_identifier
-	local remote_gateway
-	local remote_identifier
 	local pre_shared_key
 	local auth_method
+	local local_identifier
+	local remote_identifier
+	local local_ip
 	local keyingtries
 	local dpddelay
 	local encap
@@ -462,9 +460,10 @@ config_remote() {
 	local overtime
 	local send_cert
 	local send_certreq
+	local eap_id
+	local local_sourceip
 	local remote_ca_certs
 	local pools
-	local eap_id
 
 	config_get_bool enabled "$conf" enabled 0
 	[ $enabled -eq 0 ] && return
@@ -509,6 +508,7 @@ config_remote() {
 		;;
 	esac
 
+	local remote_gateway
 	[ "$gateway" = "any" ] && remote_gateway="%any" || remote_gateway="$gateway"
 
 	if [ -n "$local_key" ]; then

From b3ab1718fa8ba1fa3757b9acbca34c00700966fd Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Thu, 23 Jul 2026 08:07:34 +0200
Subject: [PATCH 03/10] strongswan: replace indentation spaces with tabs in
 swanctl.init

For consistency, the remaining spaces used for indentation have been
replaced with tabs.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/swanctl.init | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 6e345a4c1221c..bca799103c7c8 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -374,7 +374,7 @@ config_child() {
 	[ -n "$dpdaction" ] && swanctl_xappend4 "dpd_action = $dpdaction"
 	[ -n "$replay_window" ] && swanctl_xappend4 "replay_window = $replay_window"
 
-        swanctl_xappend3 "}"
+	swanctl_xappend3 "}"
 }
 
 config_tunnel() {
@@ -513,9 +513,9 @@ config_remote() {
 
 	if [ -n "$local_key" ]; then
 		[ "$(dirname "$local_key")" != "." ] && \
-		   fatal "local_key $local_key can't be pathname"
+			fatal "local_key $local_key can't be pathname"
 		[ -f "/etc/swanctl/private/$local_key" ] || \
-		   fatal "local_key $local_key not found"
+			fatal "local_key $local_key not found"
 	fi
 
 	local ike_proposal
@@ -526,16 +526,16 @@ config_remote() {
 	if [ "$auth_method" = pubkey ]; then
 		if [ -n "$ca_cert" ]; then
 			[ "$(dirname "$ca_cert")" != "." ] && \
-			    fatal "ca_cert $ca_cert can't be pathname"
+				fatal "ca_cert $ca_cert can't be pathname"
 			[ -f "/etc/swanctl/x509ca/$ca_cert" ] || \
-			    fatal "ca_cert $ca_cert not found"
+				fatal "ca_cert $ca_cert not found"
 		fi
 
 		if [ -n "$local_cert" ]; then
 			[ "$(dirname "$local_cert")" != "." ] && \
-			    fatal "local_cert $local_cert can't be pathname"
+				fatal "local_cert $local_cert can't be pathname"
 			[ -f "/etc/swanctl/x509/$local_cert" ] || \
-			    fatal "local_cert $local_cert not found"
+				fatal "local_cert $local_cert not found"
 		fi
 	fi
 
@@ -559,7 +559,7 @@ config_remote() {
 
 	[ -n "$local_identifier" ] && swanctl_xappend3 "id = \"$local_identifier\""
 	[ "$local_auth_method" = pubkey ] && [ -n "$local_cert" ] && \
-	    swanctl_xappend3 "certs = $local_cert"
+		swanctl_xappend3 "certs = $local_cert"
 	swanctl_xappend2 "}"
 
 	swanctl_xappend2 "remote {"

From 93ed5e133bf71d050f7783fb4881bddfce196df6 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Thu, 23 Jul 2026 13:02:19 +0200
Subject: [PATCH 04/10] strongswan: migration and merge local_nat into
 local_subnet

The UCI option 'local_nat' was a misleading legacy name for the
option that actually specifies the local traffic selector(s) used
by strongSwan/swanctl for a connection, i.e. the local subnet(s)
matched by the IPsec SA. It has nothing to do with NAT-T or NAT
detection, and the name repeatedly caused confusion when writing
or reviewing configs.

Merge it to 'local_subnet' to match its actual purpose and to
align with the naming already used for the corresponding
'local_subnet' option and with swanctl.conf's own 'local_ts/remote_ts'
terminology.

Add a uci-defaults migration script so existing installations are
upgraded automatically. It reads any existing 'local_nat' values
(whether stored as a plain option or as a list) and rewrites them
as a 'local_subnet' list.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 .../files/etc/uci-defaults/strongswan         | 27 +++++++++++++++++++
 net/strongswan/files/swanctl.init             |  4 ---
 2 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index b2e2d6f9ac137..e83669be7d8fb 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -26,9 +26,36 @@ migrate_ignore_routing_tables() {
 	uci commit ipsec
 }
 
+migrate_local_nat_child() {
+	local cfg="$1"
+
+	local local_nat value
+
+	config_get local_nat "$cfg" local_nat ""
+	[ -z "$local_nat" ] && return
+
+	uci -q delete "ipsec.${cfg}.local_nat"
+
+	# Replace 'local_subnet' with 'local_nat' and do not append.
+	# That's how it was previously done in the swanctl start script.
+	uci -q delete "ipsec.${cfg}.local_subnet"
+
+	for value in $local_nat; do
+		uci add_list "ipsec.${cfg}.local_subnet=${value}"
+	done
+}
+
+migrate_local_nat() {
+	config_load ipsec
+	config_foreach migrate_local_nat_child tunnel
+	config_foreach migrate_local_nat_child transport
+	uci commit ipsec
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
+	migrate_local_nat
 }
 
 main
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index bca799103c7c8..3aa63a645adda 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -226,7 +226,6 @@ config_child() {
 	local mode="$2"
 
 	local startaction
-	local local_nat
 	local updown
 	local firewall
 	local lifetime
@@ -247,7 +246,6 @@ config_child() {
 	local remote_subnet
 
 	config_get startaction "$conf" startaction "route"
-	config_get local_nat "$conf" local_nat ""
 	config_get updown "$conf" updown ""
 	config_get firewall "$conf" firewall ""
 	config_get lifetime "$conf" lifetime ""
@@ -333,8 +331,6 @@ config_child() {
 		;;
 	esac
 
-	[ -n "$local_nat" ] && local_subnet="$local_nat"
-
 	swanctl_xappend3 "$conf {"
 
 	[ -n "$local_subnet" ] && swanctl_xappend4 "local_ts = $local_subnet"

From d1054cc80bf3c408b47dd98b222e15dbe4f569c3 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Thu, 23 Jul 2026 14:25:53 +0200
Subject: [PATCH 05/10] strongswan: rename 'gateway' to 'remote_gateway'

The UCI option 'gateway' in the ipsec config (consumed by
/etc/init.d/swanctl) is ambiguous. It is not clear from the name
alone whether it refers to the local or the remote IKE/IPsec
peer address, which has repeatedly led to misconfiguration.

Rename it to "remote_gateway" to make the direction explicit and
to match the existing "remote_subnet" naming. If the option is
unset, the init script now falls back to the strongSwan default
of '%any', so connections that accept any remote peer no longer
require an explicit placeholder value.

Add a uci-defaults migration script to rename existing 'gateway'
entries to 'remote_gateway' and remove the value 'any' on upgrade. This
is new default if 'remote_gateway' is not set.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 .../files/etc/uci-defaults/strongswan         | 24 +++++++++++++++++++
 net/strongswan/files/swanctl.init             |  6 ++---
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index e83669be7d8fb..44adcf906b2ad 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -52,10 +52,34 @@ migrate_local_nat() {
 	uci commit ipsec
 }
 
+migrate_gateway_remote() {
+	local cfg="$1"
+
+	local gateway
+
+	config_get gateway "$cfg" gateway ""
+	[ -z "$gateway" ] && return
+
+	# The option 'any' is default for the 'remote_gateway' option if not set
+	# and does not need to be saved.
+	[ "$gateway" = "any" ] || {
+		uci -q set "ipsec.${cfg}.remote_gateway=${gateway}"
+	}
+
+	uci -q delete "ipsec.${cfg}.gateway"
+	uci commit ipsec
+}
+
+migrate_gateway() {
+	config_load ipsec
+	config_foreach migrate_gateway_remote remote
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
 	migrate_local_nat
+	migrate_gateway
 }
 
 main
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 3aa63a645adda..5a67eca8ea30c 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -436,7 +436,7 @@ config_remote() {
 	local conf="$1"
 
 	local enabled
-	local gateway
+	local remote_gateway
 	local pre_shared_key
 	local auth_method
 	local local_identifier
@@ -464,7 +464,7 @@ config_remote() {
 	config_get_bool enabled "$conf" enabled 0
 	[ $enabled -eq 0 ] && return
 
-	config_get gateway "$conf" gateway
+	config_get remote_gateway "$conf" remote_gateway '%any'
 	config_get pre_shared_key "$conf" pre_shared_key
 	config_get auth_method "$conf" authentication_method
 	config_get local_identifier "$conf" local_identifier ""
@@ -504,8 +504,6 @@ config_remote() {
 		;;
 	esac
 
-	local remote_gateway
-	[ "$gateway" = "any" ] && remote_gateway="%any" || remote_gateway="$gateway"
 
 	if [ -n "$local_key" ]; then
 		[ "$(dirname "$local_key")" != "." ] && \

From bd73a6602901a7e297585fb72917cc9fa67eff91 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Thu, 23 Jul 2026 15:30:23 +0200
Subject: [PATCH 06/10] strongswan: rename 'remote_gateway' to 'remote_addrs'

Rename the 'remote_gateway' UCI option to 'remote_addrs' to match
the 'swanctl.conf' 'remote_addrs' directive, which accepts one or
more peer addresses rather than a single gateway. The previous
name implied a single value and did not reflect that multiple
remote addresses can be configured for a connection.

Store the option as a UCI list to allow specifying multiple
remote addresses, consistent with how 'local_subnet' and
'remote_subnet' are already handled.

Add a uci-defaults migration script to convert existing
'remote_gateway' entries (whether stored as a plain option or as
a list) to a 'remote_addrs' list on upgrade.

If the 'remote_addrs' option is empty, strongswan implicitly uses the value
'%any'. In the `swanctl.conf` documentation, '%any' is already the default
value for 'remote_addrs' if the directive is not specified at all.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 .../files/etc/uci-defaults/strongswan         | 22 +++++++++++++++++++
 net/strongswan/files/swanctl.init             |  7 +++---
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index 44adcf906b2ad..625ca8fd99208 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -75,11 +75,33 @@ migrate_gateway() {
 	config_foreach migrate_gateway_remote remote
 }
 
+migrate_remote_gateway_remote() {
+	local cfg="$1"
+
+	local remote_gateway value
+
+	config_get remote_gateway "$cfg" remote_gateway ""
+	[ -z "$remote_gateway" ] && return
+
+	for value in $remote_gateway; do
+		uci add_list "ipsec.${cfg}.remote_addrs=${value}"
+	done
+
+	uci -q delete "ipsec.${cfg}.remote_gateway"
+	uci commit ipsec
+}
+
+migrate_remote_gateway() {
+	config_load ipsec
+	config_foreach migrate_remote_gateway_remote remote
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
 	migrate_local_nat
 	migrate_gateway
+	migrate_remote_gateway
 }
 
 main
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 5a67eca8ea30c..4ffbea5753951 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -436,7 +436,6 @@ config_remote() {
 	local conf="$1"
 
 	local enabled
-	local remote_gateway
 	local pre_shared_key
 	local auth_method
 	local local_identifier
@@ -457,6 +456,7 @@ config_remote() {
 	local send_cert
 	local send_certreq
 	local eap_id
+	local remote_addrs
 	local local_sourceip
 	local remote_ca_certs
 	local pools
@@ -464,7 +464,6 @@ config_remote() {
 	config_get_bool enabled "$conf" enabled 0
 	[ $enabled -eq 0 ] && return
 
-	config_get remote_gateway "$conf" remote_gateway '%any'
 	config_get pre_shared_key "$conf" pre_shared_key
 	config_get auth_method "$conf" authentication_method
 	config_get local_identifier "$conf" local_identifier ""
@@ -486,6 +485,7 @@ config_remote() {
 	config_get_bool send_certreq "$conf" send_certreq 1
 	config_get eap_id "$conf" eap_id "%any"
 
+	config_list_foreach "$conf" remote_addrs append_var remote_addrs ","
 	config_list_foreach "$conf" local_sourceip append_var local_sourceip ","
 	config_list_foreach "$conf" remote_ca_certs append_var remote_ca_certs ","
 	config_list_foreach "$conf" pools append_var pools ","
@@ -537,8 +537,7 @@ config_remote() {
 	swanctl_xappend0 "connections {"
 	swanctl_xappend1 "$conf {"
 	swanctl_xappend2 "local_addrs = $local_ip"
-	swanctl_xappend2 "remote_addrs = $remote_gateway"
-
+	[ -n "$remote_addrs" ] && swanctl_xappend2 "remote_addrs = $remote_addrs"
 	[ -n "$local_sourceip" ] && swanctl_xappend2 "vips = $local_sourceip"
 	[ -n "$fragmentation" ] && swanctl_xappend2 "fragmentation = $fragmentation"
 	[ -n "$pools" ] && swanctl_xappend2 "pools = $pools"

From 016a37b45a2485b7018ff5fd646ed5d5d585d5b1 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Thu, 23 Jul 2026 16:18:18 +0200
Subject: [PATCH 07/10] strongswan: rename 'local_ip' to 'local_addrs'

Rename the 'local_ip' UCI option to 'local_addrs' to match the
'swanctl.conf' 'local_addrs' directive, which accepts one or more
local addresses rather than implying a single fixed IP. The
previous name suggested only one address could be configured.

Store the option as a UCI list to allow specifying multiple local
addresses, consistent with how 'remote_addrs' is already handled.
If left empty, no 'local_addrs' line is written to 'swanctl.conf',
so strongswan falls back to its own default of '%any'.

Add a uci-defaults migration script to convert existing 'local_ip'
entries (whether stored as a plain option or as a list) to a
'local_addrs' list on upgrade.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 .../files/etc/uci-defaults/strongswan         | 23 +++++++++++++++++++
 net/strongswan/files/swanctl.init             |  6 ++---
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index 625ca8fd99208..9e5628acb0ba7 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -1,5 +1,6 @@
 #!/bin/sh
 
+. /lib/functions.sh
 migrate_ipsec() {
 	# Skip migration if the 'globals' section already exists
 	uci show ipsec.globals 1>/dev/null 2>/dev/null
@@ -96,12 +97,34 @@ migrate_remote_gateway() {
 	config_foreach migrate_remote_gateway_remote remote
 }
 
+migrate_local_ip_local() {
+	local cfg="$1"
+
+	local local_ip value
+
+	config_get local_ip "$cfg" local_ip ""
+	[ -z "$local_ip" ] && return
+
+	for value in $local_ip; do
+		uci add_list "ipsec.${cfg}.local_addrs=${value}"
+	done
+
+	uci -q delete "ipsec.${cfg}.local_ip"
+	uci commit ipsec
+}
+
+migrate_local_ip() {
+	config_load ipsec
+	config_foreach migrate_local_ip_local remote
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
 	migrate_local_nat
 	migrate_gateway
 	migrate_remote_gateway
+	migrate_local_ip
 }
 
 main
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 4ffbea5753951..1673c5a1f2f8d 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -440,7 +440,6 @@ config_remote() {
 	local auth_method
 	local local_identifier
 	local remote_identifier
-	local local_ip
 	local keyingtries
 	local dpddelay
 	local encap
@@ -456,6 +455,7 @@ config_remote() {
 	local send_cert
 	local send_certreq
 	local eap_id
+	local local_addrs
 	local remote_addrs
 	local local_sourceip
 	local remote_ca_certs
@@ -468,7 +468,6 @@ config_remote() {
 	config_get auth_method "$conf" authentication_method
 	config_get local_identifier "$conf" local_identifier ""
 	config_get remote_identifier "$conf" remote_identifier ""
-	config_get local_ip "$conf" local_ip "%any"
 	config_get keyingtries "$conf" keyingtries "3"
 	config_get dpddelay "$conf" dpddelay "30s"
 	config_get_bool encap "$conf" encap 0
@@ -485,6 +484,7 @@ config_remote() {
 	config_get_bool send_certreq "$conf" send_certreq 1
 	config_get eap_id "$conf" eap_id "%any"
 
+	config_list_foreach "$conf" local_addrs append_var local_addrs ","
 	config_list_foreach "$conf" remote_addrs append_var remote_addrs ","
 	config_list_foreach "$conf" local_sourceip append_var local_sourceip ","
 	config_list_foreach "$conf" remote_ca_certs append_var remote_ca_certs ","
@@ -536,7 +536,7 @@ config_remote() {
 	swanctl_xappend0 "# config for $conf"
 	swanctl_xappend0 "connections {"
 	swanctl_xappend1 "$conf {"
-	swanctl_xappend2 "local_addrs = $local_ip"
+	[ -n "$local_addrs" ] && swanctl_xappend2 "local_addrs = $local_addrs"
 	[ -n "$remote_addrs" ] && swanctl_xappend2 "remote_addrs = $remote_addrs"
 	[ -n "$local_sourceip" ] && swanctl_xappend2 "vips = $local_sourceip"
 	[ -n "$fragmentation" ] && swanctl_xappend2 "fragmentation = $fragmentation"

From ee2373a3c6ed223d03587b1cbd5a9bee6265a286 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Mon, 27 Jul 2026 14:00:24 +0200
Subject: [PATCH 08/10] strongswan: rename 'local_sourceip' to 'vips'

The name 'local_sourceip' was misleading, since the option actually
refers to virtual IP addresses (VIPs) used for routing/binding,
not just a single local source IP. Renaming it to 'vips' better
reflects its purpose and makes the configuration more intuitive
for users, especially in setups with multiple virtual IPs.

Add a uci-defaults migration script to convert existing 'local_sourceip'
entries (whether stored as a plain option or as a list) to a
'vips' list on upgrade.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 .../files/etc/uci-defaults/strongswan         | 22 +++++++++++++++++++
 net/strongswan/files/swanctl.init             |  6 ++---
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index 9e5628acb0ba7..894806daee3de 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -118,6 +118,27 @@ migrate_local_ip() {
 	config_foreach migrate_local_ip_local remote
 }
 
+migrate_local_sourceip_vips() {
+	local cfg="$1"
+
+	local local_sourceip value
+
+	config_get local_sourceip "$cfg" local_sourceip ""
+	[ -z "$local_sourceip" ] && return
+
+	for value in $local_sourceip; do
+		uci add_list "ipsec.${cfg}.vips=${value}"
+	done
+
+	uci -q delete "ipsec.${cfg}.local_sourceip"
+	uci commit ipsec
+}
+
+migrate_local_sourceip() {
+	config_load ipsec
+	config_foreach migrate_local_sourceip_vips remote
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
@@ -125,6 +146,7 @@ main() {
 	migrate_gateway
 	migrate_remote_gateway
 	migrate_local_ip
+	migrate_local_sourceip
 }
 
 main
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 1673c5a1f2f8d..92916c962510c 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -457,7 +457,7 @@ config_remote() {
 	local eap_id
 	local local_addrs
 	local remote_addrs
-	local local_sourceip
+	local vips
 	local remote_ca_certs
 	local pools
 
@@ -486,7 +486,7 @@ config_remote() {
 
 	config_list_foreach "$conf" local_addrs append_var local_addrs ","
 	config_list_foreach "$conf" remote_addrs append_var remote_addrs ","
-	config_list_foreach "$conf" local_sourceip append_var local_sourceip ","
+	config_list_foreach "$conf" vips append_var vips ","
 	config_list_foreach "$conf" remote_ca_certs append_var remote_ca_certs ","
 	config_list_foreach "$conf" pools append_var pools ","
 
@@ -538,7 +538,7 @@ config_remote() {
 	swanctl_xappend1 "$conf {"
 	[ -n "$local_addrs" ] && swanctl_xappend2 "local_addrs = $local_addrs"
 	[ -n "$remote_addrs" ] && swanctl_xappend2 "remote_addrs = $remote_addrs"
-	[ -n "$local_sourceip" ] && swanctl_xappend2 "vips = $local_sourceip"
+	[ -n "$vips" ] && swanctl_xappend2 "vips = $vips"
 	[ -n "$fragmentation" ] && swanctl_xappend2 "fragmentation = $fragmentation"
 	[ -n "$pools" ] && swanctl_xappend2 "pools = $pools"
 

From 32207e790fb18cb766329eb0d3844260ba4f8ace Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Mon, 27 Jul 2026 15:47:59 +0200
Subject: [PATCH 09/10] strongswan: write local_key to swanctl.conf

The 'local_key' UCI option was validated (checked for existence
under /etc/swanctl/private/) but never written to the generated
'swanctl.conf'. As a result, setting 'local_key' had no actual effect
on which private key was used for local authentication.

Add the corresponding "privkeys" line to the local{} section,
mirroring how local_cert is already written as "certs", so that
swanctl explicitly uses the configured private key.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/swanctl.init | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 92916c962510c..a7b1e11d84c92 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -553,6 +553,8 @@ config_remote() {
 	[ -n "$local_identifier" ] && swanctl_xappend3 "id = \"$local_identifier\""
 	[ "$local_auth_method" = pubkey ] && [ -n "$local_cert" ] && \
 		swanctl_xappend3 "certs = $local_cert"
+	[ "$local_auth_method" = pubkey ] && [ -n "$local_key" ] && \
+		swanctl_xappend3 "privkeys = $local_key"
 	swanctl_xappend2 "}"
 
 	swanctl_xappend2 "remote {"

From d9e1e99124cfadbe4bb3cdfb9cb47192485eb78b Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Mon, 27 Jul 2026 10:43:22 +0200
Subject: [PATCH 10/10] strongswan: bump PKG_RELEASE by one

Update 'PKG_RELEASE'.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/strongswan/Makefile b/net/strongswan/Makefile
index cb283dd6bb418..a40d2decb2aa8 100644
--- a/net/strongswan/Makefile
+++ b/net/strongswan/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=strongswan
 PKG_VERSION:=6.0.7
-PKG_RELEASE:=4
+PKG_RELEASE:=5
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://download.strongswan.org/ https://download2.strongswan.org/