IPsec Subnet Helper

Computes IPsec traffic selectors from a local and a remote subnet list, and prints them as strongSwan swanctl.conf local_ts / remote_ts and as legacy ipsec.conf leftsubnet / rightsubnet. Both sides are aggregated first: adjacent or nested entries cover exactly the same addresses as one shorter prefix, so merging them is safe and reduces the number of traffic selector combinations. Under IKEv1 that reduction carries straight through to the SA count, because one SA carries one subnet pair. Under IKEv2 it does not follow that the CHILD_SA count drops by the same amount, so this tool does not claim one. In policy-based mode the tool enumerates the local x remote combinations, because that product is what the kernel installs as policies. The count is reported as traffic selector combinations rather than as a CHILD_SA count, and the difference matters. Under IKEv1 the two are the same: one SA carries one subnet pair, which is why a handful of subnets on each side turns into dozens of SAs. Under IKEv2 a single CHILD_SA can carry several traffic selectors, so the number of SAs depends on what the peer proposes and how it narrows the selectors during negotiation; some implementations still split to one pair per SA and some do not. This tool cannot know which, so it reports the combinations and leaves the SA count to be confirmed against the peer. In route-based mode the selectors are deliberately 0.0.0.0/0 and ::/0, one combination per address family: the SA carries everything and the routing table, through an XFRM or VTI interface, decides what enters the tunnel. Your declared subnets are still listed so you know what to route. Overlapping local and remote selectors are reported because no selector configuration resolves them; that case needs NAT on one side. Address families are never paired across each other, and a family present on only one side is flagged rather than silently dropped. This tool does not speak IKE, contact a gateway, or read an existing configuration, and it does not claim equivalence with vendors other than the two strongSwan syntaxes it prints.