Template:Networking rutos configuration example l2tp over ipsec android: Difference between revisions

From Teltonika Networks Wiki
VisualWikitext
(Created page with "<table class="nd-othertables_2"> <tr> <th width=325; style="border-bottom: 1px solid white;></th> <th width=820; style="border-bottom: 1px solid white;" ro...")
 
No edit summary
 
(60 intermediate revisions by one other user not shown)
Line 3: Line 3:
         <th width=325; style="border-bottom: 1px solid white;></th>
         <th width=325; style="border-bottom: 1px solid white;></th>
         <th width=820; style="border-bottom: 1px solid white;" rowspan=2;>
         <th width=820; style="border-bottom: 1px solid white;" rowspan=2;>
[[File:Networking_RUTX_VPN_between_HQ_topology_v3.png|border|class=tlt-border|750px|right]]</th>
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_topology_v1.png|border|class=tlt-border|750px|right]]</th>
     </tr>
     </tr>
     <tr>
     <tr>
Line 18: Line 18:
'''Prerequisites''':
'''Prerequisites''':
* One RUTX router of any type
* One RUTX router of any type
* A Public Static or Public Dynamic IP addresses
* A Public Static or Public Dynamic IP address
* At least one end device with Windows 10
* At least one Android device
<br>
 
The topology above depicts the L2TP/IPsec scheme. - The router with the Public IP address ('''''RUTX11''''') acts as the '''L2TP/IPsec server''' and the '''Windows 10 device''' acts as '''client'''. L2TP connects the networks of '''RUTX11''' and '''Windows 10 client''', IPsec provides the encryption for the L2TP tunnel. Only LAN traffic is going to go through that tunnel, any other WAN traffic won't go through it. This way the VPN tunnel will not be under a huge load and will provide greater speeds.
The topology above depicts the L2TP/IPsec scheme. The router with the Public IP address ('''RUTX''') acts as the '''L2TP/IPsec server''' and the '''Android device''' acts as '''client'''. L2TP connects the networks of '''RUTX''' and '''Android client''', IPsec provides the encryption for the L2TP tunnel. Created VPN tunnel will allow Android device to reach home network behind the RUTX router, but the rest of Android device network traffic will not be redirected through VPN. This way the VPN tunnel will not be under a huge load and will provide greater speeds.


When the scheme is realized, home workers will be able to reach corporation’s internal network with all internal systems, allowing working from home to be possible.
When the scheme is realized, you will be able to log on to your home network from anywhere - work, hotel, car. You will have access to all of your home resources, and your data will still be secure, even if you will be using public WiFi.


==Configuring HQ corporation router==
==Configuring home router (RUTX)==
As mentioned in the prerequisites section, the router that acts as the server must have a Public Static or Public Dynamic IP address (more information on the subject can be found here). If that is in order, we should start configuring the server.
===L2TP===
===L2TP===
----
 


<table class="nd-othertables_2">
<table class="nd-othertables_2">
     <tr>
     <tr>
         <th width=355; style="border-bottom: 1px solid white;></th>
         <th width=355; style="border-bottom: 1px solid white;></th>
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2> [[File:Networking_rutx_configuration_examples_l2tp_over_ipsec_windows_10_1_v1.png|770px|right]]</th>
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2> [[File:RutOS_L2TP_IPsec_VPN_7,8_add_L2TP_Server.png|770px|right]]</th>
     </tr>
     </tr>
     <tr>
     <tr>
Line 40: Line 41:
     <li>Select '''Role: Server'''.</li>
     <li>Select '''Role: Server'''.</li>
     <li>Enter a '''custom configuration name'''.</li>
     <li>Enter a '''custom configuration name'''.</li>
     <li>Click the '''Add''' button.</li>
     <li>Click the '''Add''' button. You will be prompted to the configuration window</li>
    <li>Click the '''Edit''' button next to the newly created L2TP instance.</li>
</ol>
</ol>
         </td>
         </td>
Line 52: Line 52:
     <tr>
     <tr>
         <th width=355; style="border-bottom: 1px solid white;></th>
         <th width=355; style="border-bottom: 1px solid white;></th>
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutx_configuration_examples_l2tp_over_ipsec_windows_10_2_v1.png|770px|right]]</th>
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:RutOS_L2TP_IPsec_VPN_7,8_add_L2TP_Server_config.png|770px|right]]</th>
     </tr>
     </tr>
     <tr>
     <tr>
Line 58: Line 58:
<ol>
<ol>
     <li>'''Enable''' the L2TP instance.</li>
     <li>'''Enable''' the L2TP instance.</li>
    <li>Click on the '''Add''' button to add a new user</li>
     <li>Enter a '''User name''' and '''Password''' for authentication for the client.</li>
     <li>Enter a '''User name''' and '''Password''' for authentication for the client.</li>
     <li>Optionaly, set a fixed IP for this client (if left empty, client will receive first free IP from the IP range).</li>
     <li>Optionally, set a fixed IP for this client (if left empty, the client will receive the first free IP from the IP range).</li>
     <li>Don't forget to '''Save''' the changes.</li>
     <li>Don't forget to '''Save''' the changes.</li>
</ol>
</ol>
Line 72: Line 73:
     <tr>
     <tr>
         <th width=355; style="border-bottom: 1px solid white;></th>
         <th width=355; style="border-bottom: 1px solid white;></th>
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutx_configuration_examples_l2tp_over_ipsec_windows_10_3_v1.png|770px|right]]</th>
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:RutOS_L2TP_IPsec_VPN_7,8_add_Ipsec_Server.png|770px|right]]</th>
     </tr>
     </tr>
     <tr>
     <tr>
Line 79: Line 80:
<ol>     
<ol>     
       <li>Enter a custom name for the IPsec instance.</li>
       <li>Enter a custom name for the IPsec instance.</li>
       <li>Click the '''Add''' button.</li>
       <li>Click the '''Add''' button. You will be prompted to the configuration window</li>
      <li>Click the '''Edit''' button next to the newly created instance.</li>
</ol>
</ol>
         </td>
         </td>
Line 91: Line 91:
     <tr>
     <tr>
         <th width=355; style="border-bottom: 1px solid white;></th>
         <th width=355; style="border-bottom: 1px solid white;></th>
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutx_configuration_examples_l2tp_over_ipsec_windows_10_4_v1.png|770px|right]]</th>
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:RutOS_L2TP_IPsec_VPN_7,8_add_Ipsec_Server_config_instnace222.png|770px|right]]</th>
    </tr>
  </tr>
     <tr>
     <tr>
         <td style="border-bottom: 1px solid white>
         <td style="border-bottom: 1px solid white>
Line 99: Line 99:
       <li>'''Enable''' the instance.</li>
       <li>'''Enable''' the instance.</li>
       <li>Enter your '''Pre-shared key'''.</li>
       <li>Enter your '''Pre-shared key'''.</li>
      <li>Select '''Type: Transport'''.</li>
      <li>'''Save''' changes.</li>
</ol>
</ol>
         </td>
         </td>
     </tr>
     </tr>
</table>
</table>
==Android phone==
<table class="nd-othertables_2">
<table class="nd-othertables_2">
     <tr>
     <tr>
         <th width=525; style="border-bottom: 1px solid white;"></th>
         <th width=355; style="border-bottom: 1px solid white;></th>
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_6_v2.png|border|class=tlt-border|550px|right]]</th>
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:RutOS_L2TP_IPsec_VPN_7,8_add_Ipsec_Server_config_instance_connection.png|770px|right]]</th>
    </tr>
  </tr>
     <tr>
     <tr>
         <td style="border-bottom: 1px solid white>
         <td style="border-bottom: 1px solid white>
Type '''VPN settings''' in the Windows search bar:
<ol>   
'''3.''' Select '''Type: Transport'''.
<br>
Do not forget to '''Save''' changes.
</ol>
         </td>
         </td>
     </tr>
     </tr>
</table>
</table>
----
----
'''Note:''' ''This is only an example of a secure configuration. Other algorithms or even combinations of them could be used. However, we strongly recommend refraining from using older encryption and hashing algorithms unless support for certain legacy systems is required.''


Make the following changes:
<table class="nd-othertables_2">
<table class="nd-othertables_2">
     <tr>
     <tr>
         <th width=525; style="border-bottom: 1px solid white;"></th>
         <th width=330; style="border-bottom: 1px solid white;></th>
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_7_v2.png|border|class=tlt-border|550px|right]]</th>
         <th width=800; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_webui_manual_IPsec_configuration_proposal_phase1_settings_v1.png|border|class=tlt-border|671x336px|center]]</th>
     </tr>
     </tr>
     <tr>
     <tr>
         <td style="border-bottom: 1px solid white>
         <td style="border-bottom: 4px solid white>
Click the '''Add a VPN connection''' button:
# Encryption - '''''AES256;'''''
# Authentication - '''''SHA512;'''''
# DH group - '''''MODP4096;'''''
# IKE lifetime - '''86400s'''.
         </td>
         </td>
     </tr>
     </tr>
Line 135: Line 138:


----
----
<table class="nd-othertables_2">
<table class="nd-othertables_2">
     <tr>
     <tr>
         <th width=525; style="border-bottom: 1px solid white;"></th>
         <th width=330; style="border-bottom: 1px solid white;></th>
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_8_v2.png|border|class=tlt-border|550px|right]]</th>
         <th width=800; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_webui_manual_IPsec_configuration_proposal_phase2_settings_v1.png|border|class=tlt-border|644x331px|center]]</th>
     </tr>
     </tr>
     <tr>
     <tr>
         <td style="border-bottom: 1px solid white>
         <td style="border-bottom: 4px solid white>
Configure the following parameters:
# Encryption - '''''AES256;'''''
        <ol>
# Authentication - '''''SHA512;'''''
            <li>Select '''VPN provider: Windows (built-in)'''.</li>
# PFS group - '''''MODP4096;'''''
            <li>Enter a custom '''Connection name'''.</li>
# Lifetime – '''''86400s;'''''
            <li>Enter the router's WAN IP address into the '''Server name or address''' field.</li>
            <li>Select '''VPN type: L2TP/IPsec with pre-shared key'''.</li>
            <li>Enter the '''Pre-shared key''' exactly as it was specified on the router.</li>
            <li>Select '''Type of sign-in info: User name and password'''.</li>
            <li>Enter the '''User name''' and '''Password''' exactly as they were specified on the router.</li>
            <li>Click '''Save'''</li>
        </ol>
         </td>
         </td>
     </tr>
     </tr>
</table>
</table>
===Firewall===
----
Now go to the '''Network → Firewall → General Settings''' page


----
----
Line 162: Line 161:
<table class="nd-othertables_2">
<table class="nd-othertables_2">
     <tr>
     <tr>
         <th width=525; style="border-bottom: 1px solid white;"></th>
         <th width=355; style="border-bottom: 1px solid white;></th>
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_11_v2.png|border|class=tlt-border|550px|right]]</th>
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>
[[File:RutOS_L2TP_IPsec_android_7.8_1.png|770px|right]]</th>
     </tr>
     </tr>
     <tr>
     <tr>
         <td style="border-bottom: 1px solid white>
         <td style="border-bottom: 1px solid white>
Type '''Network Connections''' in the Windows search bar:
<ol>   
      <li>Set '''Forward: accept'''.</li>
      <li>'''Save''' changes.</li>
</ol>
         </td>
         </td>
     </tr>
     </tr>
</table>
</table>


----
==Android phone==


<table class="nd-othertables_2">
<table class="nd-othertables_2">
     <tr>
     <tr>
         <th width=525; style="border-bottom: 1px solid white;"></th>
         <th width=525; style="border-bottom: 1px solid white;"></th>
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_12_v2.png|border|class=tlt-border|550px|right]]</th>
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_5_v2.png|border|class=tlt-border|300px|center]]</th>
     </tr>
     </tr>
     <tr>
     <tr>
         <td style="border-bottom: 1px solid white>
         <td style="border-bottom: 1px solid white>
Press right mouse click on your newly created VPN instance and select '''Properties''':
Go to your Android device '''VPN settings''' and create a new VPN network:
         </td>
         </td>
     </tr>
     </tr>
Line 191: Line 195:
     <tr>
     <tr>
         <th width=525; style="border-bottom: 1px solid white;"></th>
         <th width=525; style="border-bottom: 1px solid white;"></th>
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_13_v2.png|border|class=tlt-border|550px|right]]</th>
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_6_v3.png|border|class=tlt-border|300px|center]]</th>
     </tr>
     </tr>
     <tr>
     <tr>
         <td style="border-bottom: 1px solid white>
         <td style="border-bottom: 1px solid white>
Navigate to '''Networking''' section and double click '''Internet Protocol Version 4 (TCP/IPv4)''':
Apply the following configuration:
        <ol>
            <li>Select '''Type: L2TP/IPsec PSK'''.</li>
            <li>Enter the router's WAN IP address into the '''Server''' field.</li>
            <li>Enter the '''Pre-shared key''' exactly as it was specified in the router's IPsec settings.</li>
            <li>Press '''Show advanced options'''</li>
        </ol>
         </td>
         </td>
     </tr>
     </tr>
Line 205: Line 216:
     <tr>
     <tr>
         <th width=525; style="border-bottom: 1px solid white;"></th>
         <th width=525; style="border-bottom: 1px solid white;"></th>
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_14_v2.png|border|class=tlt-border|550px|right]]</th>
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_7_v3.png|border|class=tlt-border|300px|center]]</th>
     </tr>
     </tr>
     <tr>
     <tr>
         <td style="border-bottom: 1px solid white>
         <td style="border-bottom: 1px solid white>
Go to '''Advanced''' settings:
        <ol>
            <li>Write the '''DNS servers''' you are planning to use (in this example we used google DNS servers).</li>
            <li>Add '''Forwarding routes''' (RUTX LAN network).</li>
            <li>'''Save''' settings.</li>
        </ol>
         </td>
         </td>
     </tr>
     </tr>
Line 219: Line 235:
     <tr>
     <tr>
         <th width=525; style="border-bottom: 1px solid white;"></th>
         <th width=525; style="border-bottom: 1px solid white;"></th>
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_15_v2.png|border|class=tlt-border|550px|right]]</th>
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_8_v2.png|border|class=tlt-border|300px|center]]</th>
     </tr>
     </tr>
     <tr>
     <tr>
         <td style="border-bottom: 1px solid white>
         <td style="border-bottom: 1px solid white>
Now disable '''Use default gateway on remote network''' and save settings:
Now open your newly created VPN instance and connect to it:
        <ol>
            <li>Write the '''Username''' you created in router's L2TP settings.</li>
            <li>Write the '''Password''' you created in router's L2TP settings.</li>
            <li>Press '''Connect'''.</li>
        </ol>
         </td>
         </td>
     </tr>
     </tr>
Line 233: Line 255:
     <tr>
     <tr>
         <th width=525; style="border-bottom: 1px solid white;"></th>
         <th width=525; style="border-bottom: 1px solid white;"></th>
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_9_v2.png|border|class=tlt-border|550px|right]]</th>
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_9_v2.png|border|class=tlt-border|300px|center]]</th>
     </tr>
     </tr>
     <tr>
     <tr>
         <td style="border-bottom: 1px solid white>
         <td style="border-bottom: 1px solid white>
Go back to the VPN settings page, locate your new connection and click the '''Connect''' button. If the connection was successful, you should see the word '''"Connected"''' appear under the connection name:
If you applied the configuration correctly, after a moment it should indicate '''Connected''':
         </td>
         </td>
     </tr>
     </tr>
Line 247: Line 270:
     <tr>
     <tr>
         <th width=525; style="border-bottom: 1px solid white;></th>
         <th width=525; style="border-bottom: 1px solid white;></th>
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_10_v2.png|border|class=tlt-border|550px|right]]</th>
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_10_v1.png|border|class=tlt-border|300px|center]]</th>
     </tr>
     </tr>
     <tr>
     <tr>
         <td style="border-bottom: 1px solid white>
         <td style="border-bottom: 1px solid white>
Home worker should now be able to access HQ network resources.  
Now you should be able to access your home network resources.  
To verify the connection you can ping some internal HQ server and if you get a reply, you have successfully connected to HQ‘s internal network.
To verify the connection you can try accessing your router's WebUI without being connected to it in any way. If you are able to do that, you have successfully connected to your home network.


         </td>
         </td>
     </tr>
     </tr>
</table>
</table>
----
'''Disclaimer:'''
This configuration example was created by using Android version 10. The IPsec '''Phase 1''' and '''Phase 2''' settings, which were used in this configuration example, might not work with other Android versions and might require adjustment.

Latest revision as of 11:51, 22 August 2024

Configuration overview and prerequisites

Prerequisites:

  • One RUTX router of any type
  • A Public Static or Public Dynamic IP address
  • At least one Android device

The topology above depicts the L2TP/IPsec scheme. The router with the Public IP address (RUTX) acts as the L2TP/IPsec server and the Android device acts as client. L2TP connects the networks of RUTX and Android client, IPsec provides the encryption for the L2TP tunnel. Created VPN tunnel will allow Android device to reach home network behind the RUTX router, but the rest of Android device network traffic will not be redirected through VPN. This way the VPN tunnel will not be under a huge load and will provide greater speeds.

When the scheme is realized, you will be able to log on to your home network from anywhere - work, hotel, car. You will have access to all of your home resources, and your data will still be secure, even if you will be using public WiFi.

Configuring home router (RUTX)

As mentioned in the prerequisites section, the router that acts as the server must have a Public Static or Public Dynamic IP address (more information on the subject can be found here). If that is in order, we should start configuring the server.

L2TP

Login to the router's WebUI and navigate to the Services → VPN → L2TP page and do the following:

  1. Select Role: Server.
  2. Enter a custom configuration name.
  3. Click the Add button. You will be prompted to the configuration window
  1. Enable the L2TP instance.
  2. Click on the Add button to add a new user
  3. Enter a User name and Password for authentication for the client.
  4. Optionally, set a fixed IP for this client (if left empty, the client will receive the first free IP from the IP range).
  5. Don't forget to Save the changes.

IPsec

Go to the Services → VPN → IPsec page and do the following:

  1. Enter a custom name for the IPsec instance.
  2. Click the Add button. You will be prompted to the configuration window

In the IPsec Configuration page, do the following (and leave the rest as defaults, unless your specific configuration requires otherwise):

  1. Enable the instance.
  2. Enter your Pre-shared key.
    3. Select Type: Transport.
    Do not forget to Save changes.

Note: This is only an example of a secure configuration. Other algorithms or even combinations of them could be used. However, we strongly recommend refraining from using older encryption and hashing algorithms unless support for certain legacy systems is required.

Make the following changes:

  1. Encryption - AES256;
  2. Authentication - SHA512;
  3. DH group - MODP4096;
  4. IKE lifetime - 86400s.
  1. Encryption - AES256;
  2. Authentication - SHA512;
  3. PFS group - MODP4096;
  4. Lifetime – 86400s;

Firewall

Now go to the Network → Firewall → General Settings page

  1. Set Forward: accept.
  2. Save changes.

Android phone

Go to your Android device VPN settings and create a new VPN network:

Apply the following configuration:

  1. Select Type: L2TP/IPsec PSK.
  2. Enter the router's WAN IP address into the Server field.
  3. Enter the Pre-shared key exactly as it was specified in the router's IPsec settings.
  4. Press Show advanced options
  1. Write the DNS servers you are planning to use (in this example we used google DNS servers).
  2. Add Forwarding routes (RUTX LAN network).
  3. Save settings.

Now open your newly created VPN instance and connect to it:

  1. Write the Username you created in router's L2TP settings.
  2. Write the Password you created in router's L2TP settings.
  3. Press Connect.

If you applied the configuration correctly, after a moment it should indicate Connected:

Results

Now you should be able to access your home network resources. To verify the connection you can try accessing your router's WebUI without being connected to it in any way. If you are able to do that, you have successfully connected to your home network.

Disclaimer:

This configuration example was created by using Android version 10. The IPsec Phase 1 and Phase 2 settings, which were used in this configuration example, might not work with other Android versions and might require adjustment.

Retrieved from "https://wiki.teltonika-networks.com/index.php?title=Template:Networking_rutos_configuration_example_l2tp_over_ipsec_android&oldid=131128"