Template:Netoworking rutx configuration example mikrotik l2tp ipsec: Difference between revisions
No edit summary |
No edit summary |
||
| (3 intermediate revisions by the same user not shown) | |||
| Line 4: | Line 4: | ||
This article provides a guide on how to configure L2TP/IPsec tunnel between RUTXxx and Mikrotik routers. | This article provides a guide on how to configure L2TP/IPsec tunnel between RUTXxx and Mikrotik routers. | ||
==Prerequisites== | ==Prerequisites== | ||
| Line 19: | Line 15: | ||
==Configuration scheme== | ==Configuration scheme== | ||
[[File: | [[File:Networking_rutx_configuration_example_l2tp_ipsec_mikrotik_topology_v1.png|border|class=tlt-border|1100x1100px]] | ||
==Mikrotik configuration== | ==Mikrotik configuration== | ||
| Line 63: | Line 59: | ||
==RUT configuration== | ==RUT configuration== | ||
Access RUTXxx WebUI and go to '''Services > VPN > L2TP'''. There create a new configuration by selecting role '''Client'', writing '''New configuration name''' and pressing '''Add''' button. It should appear after a few seconds. Then press '''Edit'''. | Access RUTXxx WebUI and go to '''Services > VPN > L2TP'''. There create a new configuration by selecting role '''Client''', writing '''New configuration name''' and pressing '''Add''' button. It should appear after a few seconds. Then press '''Edit'''. | ||
[[File:Networking_rutx_configuration_example_l2tp_ipsec_mikrotik_3_v1.png|border|class=tlt-border|1100x1100px]] | [[File:Networking_rutx_configuration_example_l2tp_ipsec_mikrotik_3_v1.png|border|class=tlt-border|1100x1100px]] | ||
| Line 75: | Line 71: | ||
# Write '''Username''' (write the username which you created with this command /ppp secret add name="username" password="password" service=l2tp profile=ipsec_vpn remote-address=192.168.102.2). | # Write '''Username''' (write the username which you created with this command /ppp secret add name="username" password="password" service=l2tp profile=ipsec_vpn remote-address=192.168.102.2). | ||
# Write '''Password''' (write the password which you created with this command /ppp secret add name="username" password="password" service=l2tp profile=ipsec_vpn remote-address=192.168.102.2). | # Write '''Password''' (write the password which you created with this command /ppp secret add name="username" password="password" service=l2tp profile=ipsec_vpn remote-address=192.168.102.2). | ||
# Press '''Save'''. | # Press '''Save & Apply'''. | ||
Now go to '''Services > VPN > IPsec'''. | Now go to '''Services > VPN > IPsec'''. | ||
| Line 88: | Line 84: | ||
# '''Enable''' instance. | # '''Enable''' instance. | ||
# Write '''Remote endpoint''' (MikroTik public IP address). | |||
# Sellect '''Authentication method''' (Pre-shared key) | |||
# Write '''Pre-shared key''' (write the password which you created with this command /ip ipsec identity add generate-policy=port-override auth-method=pre-shared-key secret="password" peer=l2tpserver). | |||
# Select '''Type''' (Transport). | # Select '''Type''' (Transport). | ||
# | # Select '''Encryption algorithm, Authentication''' and '''DH group''' (sellect options that you set with command /ip ipsec proposal set default auth-algorithms=sha1 enc-algorithms=3des pfs-group=modp1024). | ||
# Set all of the settings in '''Phase 2''' to be exactly the same as in the '''Phase 1'''. | # Set all of the settings in '''Phase 2''' to be exactly the same as in the '''Phase 1'''. | ||
# Press '''Save'''. | # Press '''Save & Apply'''. | ||
==Testing configuration== | ==Testing configuration== | ||
Latest revision as of 10:18, 1 April 2020
Introduction
Because of the lack of confidentiality inherent in the Layer 2 Networking Protocol (L2TP) protocol, Internet Protocol Security (IPsec) is often used to secure L2TP packets by providing confidentiality, authentication and integrity. The combination of these two protocols is generally known as L2TP over IPsec (or simply L2TP/IPsec).
This article provides a guide on how to configure L2TP/IPsec tunnel between RUTXxx and Mikrotik routers.
Prerequisites
- One RUTXxx router of any type
- One Mikrotik router (this configuration example was created using Mikrotik rb750gr3)
- Server must have a Public Static or Public Dynamic IP address (client can have private or public IP address)
- At least one end device (PC, Laptop) to configure the routers
- WinBox application
Configuration scheme
Mikrotik configuration
Connect to MikroTik by using WinBox application and press New Terminal.
The first step is to create a PPP Profile on the MikroTik. Use a 192.168.102.1 for the local address (the VPN Gateway), assuming this is not already in use. You will also need to add a DNS Server. Use this command:
/ppp profile add name=ipsec_vpn local-address=192.168.102.1 dns-server=1.1.1.1
Next, you need to add an L2TP-server interface and set the allowed authentication methods, mschap1 and mschap2. Use this command:
/interface l2tp-server server set enabled=yes default-profile=ipsec_vpn authentication=mschap1,mschap2
Then you need to define the peering of IPSec and also the default IPsec policy. You will also set the pre-shared-key secret in the process. Use these commands to do so:
/ip ipsec policy set [ find default=yes ] src-address=0.0.0.0/0 dst-address=0.0.0.0/0 protocol=all proposal=default template=yes
/ip ipsec peer add exchange-mode=main passive=yes name=l2tpserver
/ip ipsec identity add generate-policy=port-override auth-method=pre-shared-key secret="password" peer=l2tpserver
Next, set the default encryption algorithms:
/ip ipsec proposal set default auth-algorithms=sha1 enc-algorithms=3des pfs-group=modp1024
Now, add a user and allocate an IP Address:
/ppp secret add name="username" password="password" service=l2tp profile=ipsec_vpn remote-address=192.168.102.2
Open the IPSec ports from the WAN:
/ip firewall filter add chain=input action=accept protocol=udp port=1701,500,4500
/ip firewall filter add chain=input action=accept protocol=ipsec-esp
Now go to IP > Firewall and change positions of the 2 Firewall rules you just created (drag it to the top like in the example) in order to move them, press # sign.
RUT configuration
Access RUTXxx WebUI and go to Services > VPN > L2TP. There create a new configuration by selecting role Client, writing New configuration name and pressing Add button. It should appear after a few seconds. Then press Edit.
Then apply the following configuration.
- Enable instance.
- Write Server IP address (MikroTik public IP address).
- Write Username (write the username which you created with this command /ppp secret add name="username" password="password" service=l2tp profile=ipsec_vpn remote-address=192.168.102.2).
- Write Password (write the password which you created with this command /ppp secret add name="username" password="password" service=l2tp profile=ipsec_vpn remote-address=192.168.102.2).
- Press Save & Apply.
Now go to Services > VPN > IPsec.
- Write IPsec interface name.
- Press Add.
- When the interface appears like in the example, press Edit.
- Enable instance.
- Write Remote endpoint (MikroTik public IP address).
- Sellect Authentication method (Pre-shared key)
- Write Pre-shared key (write the password which you created with this command /ip ipsec identity add generate-policy=port-override auth-method=pre-shared-key secret="password" peer=l2tpserver).
- Select Type (Transport).
- Select Encryption algorithm, Authentication and DH group (sellect options that you set with command /ip ipsec proposal set default auth-algorithms=sha1 enc-algorithms=3des pfs-group=modp1024).
- Set all of the settings in Phase 2 to be exactly the same as in the Phase 1.
- Press Save & Apply.
Testing configuration
Try to ping the remote VPN endpoint via CLI or SSH using this command:
ping 192.168.102.1
