Difference between revisions of "Template:Networking rutos configuration example l2tp over ipsec android"

From Teltonika Networks Wiki
(57 intermediate revisions by the same user not shown)
Line 3: Line 3:
 
         <th width=325; style="border-bottom: 1px solid white;></th>
 
         <th width=325; style="border-bottom: 1px solid white;></th>
 
         <th width=820; style="border-bottom: 1px solid white;" rowspan=2;>
 
         <th width=820; style="border-bottom: 1px solid white;" rowspan=2;>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_topology_v1.png|border|class=tlt-border|750px|right]]</th>
+
[[File:Networking_RUTX_VPN_between_HQ_topology_v3.png|border|class=tlt-border|750px|right]]</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
Line 21: Line 21:
 
* At least one Android device
 
* At least one Android device
  
−
The topology above depicts the L2TP/IPsec scheme. The router with the Public IP address ('''RUTX''') acts as the '''L2TP/IPsec server''' and the '''Android device''' acts as '''client'''. L2TP connects the networks of '''RUTX''' and '''Android client''', IPsec provides the encryption for the L2TP tunnel. Created VPN tunnel will allow Android device to reach home network behind the RUTX router, but the rest of Android device network traffic will not be redirected through VPN. This way the VPN tunnel will not be under a huge load and will provide greater speeds.
+
The topology above depicts the L2TP/IPsec scheme. - The router with the Public IP address ('''''RUTX11''''') acts as the '''L2TP/IPsec server''' and the '''Android device''' acts as '''client'''. L2TP connects the networks of '''RUTX11''' and '''Android client''', IPsec provides the encryption for the L2TP tunnel. Only LAN traffic is going to go through that tunnel, any other WAN traffic won't go through it. This way the VPN tunnel will not be under a huge load and will provide greater speeds.
  
−
When the scheme is realized, you will be able to log on to your home network from anywhere - work, hotel, car. You will have access to all of your home resources, and your data will still be secure, even if you will be using public WiFi.
+
When the scheme is realized, you will be able to reach your home internal network with all internal systems, cameras, or other IOT devices, from anywhere in the world.
  
 
==Configuring home router (RUTX)==
 
==Configuring home router (RUTX)==
Line 32: Line 32:
 
     <tr>
 
     <tr>
 
         <th width=355; style="border-bottom: 1px solid white;></th>
 
         <th width=355; style="border-bottom: 1px solid white;></th>
−
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>  
+
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2> [[File:Networking_rutx_configuration_examples_l2tp_over_ipsec_windows_10_1_v1.png|770px|right]]</th>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_1_v1.png|770px|right]]</th>
 
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white;>
 
         <td style="border-bottom: 1px solid white;>
−
Login to the router's WebUI, navigate to the '''Services → VPN → L2TP''' page and do the following:
+
Login to the router's WebUI and navigate to the '''Services → VPN → L2TP''' page and do the following:
 
<ol>
 
<ol>
 +
    <li>Select '''Role: Server'''.</li>
 
     <li>Enter a '''custom configuration name'''.</li>
 
     <li>Enter a '''custom configuration name'''.</li>
−
    <li>Select '''Role: Server'''.</li>
 
 
     <li>Click the '''Add''' button.</li>
 
     <li>Click the '''Add''' button.</li>
 
     <li>Click the '''Edit''' button next to the newly created L2TP instance.</li>
 
     <li>Click the '''Edit''' button next to the newly created L2TP instance.</li>
Line 53: Line 52:
 
     <tr>
 
     <tr>
 
         <th width=355; style="border-bottom: 1px solid white;></th>
 
         <th width=355; style="border-bottom: 1px solid white;></th>
−
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>
+
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutx_configuration_examples_l2tp_over_ipsec_windows_10_2_v1.png|770px|right]]</th>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_2_v1.png|770px|right]]</th>
 
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
Line 60: Line 58:
 
<ol>
 
<ol>
 
     <li>'''Enable''' the L2TP instance.</li>
 
     <li>'''Enable''' the L2TP instance.</li>
−
     <li>Enter a '''Username''' and '''Password''' which later will be used for client authentication.</li>
+
     <li>Enter a '''User name''' and '''Password''' for authentication for the client.</li>
−
     <li>Optionally, set a fixed IP for this client (if left empty, client will receive first free IP from the IP range).</li>
+
     <li>Optionaly, set a fixed IP for this client (if left empty, client will receive first free IP from the IP range).</li>
 
     <li>Don't forget to '''Save''' the changes.</li>
 
     <li>Don't forget to '''Save''' the changes.</li>
 
</ol>
 
</ol>
Line 74: Line 72:
 
     <tr>
 
     <tr>
 
         <th width=355; style="border-bottom: 1px solid white;></th>
 
         <th width=355; style="border-bottom: 1px solid white;></th>
−
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>
+
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutx_configuration_examples_l2tp_over_ipsec_windows_10_3_v1.png|770px|right]]</th>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_3_v1.png|770px|right]]</th>
 
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
Line 81: Line 78:
 
Go to the '''Services → VPN → IPsec''' page and do the following:
 
Go to the '''Services → VPN → IPsec''' page and do the following:
 
<ol>     
 
<ol>     
−
       <li>Enter a custom '''Name''' for the IPsec instance.</li>
+
       <li>Enter a custom name for the IPsec instance.</li>
 
       <li>Click the '''Add''' button.</li>
 
       <li>Click the '''Add''' button.</li>
 
       <li>Click the '''Edit''' button next to the newly created instance.</li>
 
       <li>Click the '''Edit''' button next to the newly created instance.</li>
Line 94: Line 91:
 
     <tr>
 
     <tr>
 
         <th width=355; style="border-bottom: 1px solid white;></th>
 
         <th width=355; style="border-bottom: 1px solid white;></th>
−
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>
+
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutx_configuration_examples_l2tp_over_ipsec_windows_10_4_v1.png|770px|right]]</th>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_4_v1.png|770px|right]]</th>
 
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
Line 104: Line 100:
 
       <li>Enter your '''Pre-shared key'''.</li>
 
       <li>Enter your '''Pre-shared key'''.</li>
 
       <li>Select '''Type: Transport'''.</li>
 
       <li>Select '''Type: Transport'''.</li>
−
      <li>Set '''DH group''' to '''MODP1024'''.</li>
 
−
      <li>Go to '''Phase 2''' settings and also set '''DH group''' to '''MODP1024'''.</li>
 
 
       <li>'''Save''' changes.</li>
 
       <li>'''Save''' changes.</li>
 
</ol>
 
</ol>
Line 112: Line 106:
 
</table>
 
</table>
  
−
===Firewall===
+
==Android phone==
 +
 
 +
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=525; style="border-bottom: 1px solid white;"></th>
 +
        <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_6_v2.png|border|class=tlt-border|550px|right]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 1px solid white>
 +
Type '''VPN settings''' in the Windows search bar:
 +
        </td>
 +
    </tr>
 +
</table>
 +
 
 +
----
 +
 
 +
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=525; style="border-bottom: 1px solid white;"></th>
 +
        <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_7_v2.png|border|class=tlt-border|550px|right]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 1px solid white>
 +
Click the '''Add a VPN connection''' button:
 +
        </td>
 +
    </tr>
 +
</table>
 +
 
 
----
 
----
  
 
<table class="nd-othertables_2">
 
<table class="nd-othertables_2">
 
     <tr>
 
     <tr>
−
         <th width=355; style="border-bottom: 1px solid white;></th>
+
         <th width=525; style="border-bottom: 1px solid white;"></th>
−
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>
+
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_8_v2.png|border|class=tlt-border|550px|right]]</th>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_11_v1.png|770px|right]]</th>
 
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white>
 
         <td style="border-bottom: 1px solid white>
−
Now go to the '''Network → Firewall → General Settings''' page and press '''Edit''' button next to the L2TP forward rule:
+
Configure the following parameters:
 +
        <ol>
 +
            <li>Select '''VPN provider: Windows (built-in)'''.</li>
 +
            <li>Enter a custom '''Connection name'''.</li>
 +
            <li>Enter the router's WAN IP address into the '''Server name or address''' field.</li>
 +
            <li>Select '''VPN type: L2TP/IPsec with pre-shared key'''.</li>
 +
            <li>Enter the '''Pre-shared key''' exactly as it was specified on the router.</li>
 +
            <li>Select '''Type of sign-in info: User name and password'''.</li>
 +
            <li>Enter the '''User name''' and '''Password''' exactly as they were specified on the router.</li>
 +
            <li>Click '''Save'''</li>
 +
        </ol>
 
         </td>
 
         </td>
 
     </tr>
 
     </tr>
Line 132: Line 162:
 
<table class="nd-othertables_2">
 
<table class="nd-othertables_2">
 
     <tr>
 
     <tr>
−
         <th width=355; style="border-bottom: 1px solid white;></th>
+
         <th width=525; style="border-bottom: 1px solid white;"></th>
−
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>
+
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_11_v2.png|border|class=tlt-border|550px|right]]</th>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_12_v1.png|770px|right]]</th>
 
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white>
 
         <td style="border-bottom: 1px solid white>
−
<ol>   
+
Type '''Network Connections''' in the Windows search bar:
−
      <li>Set '''Forward: accept'''.</li>
 
−
      <li>Select '''Covered networks: LAN'''.</li>
 
−
      <li>'''Save''' changes.</li>
 
−
</ol>
 
 
         </td>
 
         </td>
 
     </tr>
 
     </tr>
 
</table>
 
</table>
  
−
==Android phone==
+
----
  
 
<table class="nd-othertables_2">
 
<table class="nd-othertables_2">
 
     <tr>
 
     <tr>
 
         <th width=525; style="border-bottom: 1px solid white;"></th>
 
         <th width=525; style="border-bottom: 1px solid white;"></th>
−
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
+
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_12_v2.png|border|class=tlt-border|550px|right]]</th>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_5_v2.png|border|class=tlt-border|300px|center]]</th>
 
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white>
 
         <td style="border-bottom: 1px solid white>
−
Go to your Android device '''VPN settings''' and create a new VPN network:
+
Press right mouse click on your newly created VPN instance and select '''Properties''':
 
         </td>
 
         </td>
 
     </tr>
 
     </tr>
Line 167: Line 191:
 
     <tr>
 
     <tr>
 
         <th width=525; style="border-bottom: 1px solid white;"></th>
 
         <th width=525; style="border-bottom: 1px solid white;"></th>
−
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
+
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_13_v2.png|border|class=tlt-border|550px|right]]</th>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_6_v3.png|border|class=tlt-border|300px|center]]</th>
 
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white>
 
         <td style="border-bottom: 1px solid white>
−
Apply the following configuration:
+
Navigate to '''Networking''' section and double click '''Internet Protocol Version 4 (TCP/IPv4)''':
−
        <ol>
 
−
            <li>Select '''Type: L2TP/IPsec PSK'''.</li>
 
−
            <li>Enter the router's WAN IP address into the '''Server''' field.</li>
 
−
            <li>Enter the '''Pre-shared key''' exactly as it was specified in the router's IPsec settings.</li>
 
−
            <li>Press '''Show advanced options'''</li>
 
−
        </ol>
 
 
         </td>
 
         </td>
 
     </tr>
 
     </tr>
Line 188: Line 205:
 
     <tr>
 
     <tr>
 
         <th width=525; style="border-bottom: 1px solid white;"></th>
 
         <th width=525; style="border-bottom: 1px solid white;"></th>
−
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
+
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_14_v2.png|border|class=tlt-border|550px|right]]</th>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_7_v3.png|border|class=tlt-border|300px|center]]</th>
 
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white>
 
         <td style="border-bottom: 1px solid white>
−
        <ol>
+
Go to '''Advanced''' settings:
−
            <li>Write the '''DNS servers''' you are planning to use (in this example we used google DNS servers).</li>
 
−
            <li>Add '''Forwarding routes''' (RUTX LAN network).</li>
 
−
            <li>'''Save''' settings.</li>
 
−
        </ol>
 
 
         </td>
 
         </td>
 
     </tr>
 
     </tr>
Line 207: Line 219:
 
     <tr>
 
     <tr>
 
         <th width=525; style="border-bottom: 1px solid white;"></th>
 
         <th width=525; style="border-bottom: 1px solid white;"></th>
−
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
+
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_15_v2.png|border|class=tlt-border|550px|right]]</th>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_8_v2.png|border|class=tlt-border|300px|center]]</th>
 
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white>
 
         <td style="border-bottom: 1px solid white>
−
Now open your newly created VPN instance and connect to it:
+
Now disable '''Use default gateway on remote network''' and save settings:
−
        <ol>
 
−
            <li>Write the '''Username''' you created in router's L2TP settings.</li>
 
−
            <li>Write the '''Password''' you created in router's L2TP settings.</li>
 
−
            <li>Press '''Connect'''.</li>
 
−
        </ol>
 
 
         </td>
 
         </td>
 
     </tr>
 
     </tr>
Line 227: Line 233:
 
     <tr>
 
     <tr>
 
         <th width=525; style="border-bottom: 1px solid white;"></th>
 
         <th width=525; style="border-bottom: 1px solid white;"></th>
−
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
+
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_9_v2.png|border|class=tlt-border|550px|right]]</th>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_9_v2.png|border|class=tlt-border|300px|center]]</th>
 
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white>
 
         <td style="border-bottom: 1px solid white>
−
If you applied the configuration correctly, after a moment it should indicate '''Connected''':
+
Go back to the VPN settings page, locate your new connection and click the '''Connect''' button. If the connection was successful, you should see the word '''"Connected"''' appear under the connection name:
 
         </td>
 
         </td>
 
     </tr>
 
     </tr>
Line 242: Line 247:
 
     <tr>
 
     <tr>
 
         <th width=525; style="border-bottom: 1px solid white;></th>
 
         <th width=525; style="border-bottom: 1px solid white;></th>
−
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_10_v1.png|border|class=tlt-border|300px|center]]</th>
+
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_10_v2.png|border|class=tlt-border|550px|right]]</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white>
 
         <td style="border-bottom: 1px solid white>
−
Now you should be able to access your home network resources.  
+
Home worker should now be able to access HQ network resources.  
−
To verify the connection you can try accessing your router's WebUI without being connected to it in any way. If you are able to do that, you have successfully connected to your home network.
+
To verify the connection you can ping some internal HQ server and if you get a reply, you have successfully connected to HQ‘s internal network.
  
 
         </td>
 
         </td>
 
     </tr>
 
     </tr>
 
</table>
 
</table>
−
 
−
----
 
−
 
−
'''Disclaimer:'''
 
−
 
−
This configuration example was created by using Android version 10. The IPsec '''Phase 1''' and '''Phase 2''' settings, which were used in this configuration example, might not work with other Android versions and might require adjustment.
 

Revision as of 15:35, 22 May 2020

Networking RUTX VPN between HQ topology v3.png

Configuration overview and prerequisites

Prerequisites:

  • One RUTX router of any type
  • A Public Static or Public Dynamic IP address
  • At least one Android device

The topology above depicts the L2TP/IPsec scheme. - The router with the Public IP address (RUTX11) acts as the L2TP/IPsec server and the Android device acts as client. L2TP connects the networks of RUTX11 and Android client, IPsec provides the encryption for the L2TP tunnel. Only LAN traffic is going to go through that tunnel, any other WAN traffic won't go through it. This way the VPN tunnel will not be under a huge load and will provide greater speeds.

When the scheme is realized, you will be able to reach your home internal network with all internal systems, cameras, or other IOT devices, from anywhere in the world.

Configuring home router (RUTX)

L2TP

Networking rutx configuration examples l2tp over ipsec windows 10 1 v1.png

Login to the router's WebUI and navigate to the Services → VPN → L2TP page and do the following:

  1. Select Role: Server.
  2. Enter a custom configuration name.
  3. Click the Add button.
  4. Click the Edit button next to the newly created L2TP instance.
Networking rutx configuration examples l2tp over ipsec windows 10 2 v1.png
  1. Enable the L2TP instance.
  2. Enter a User name and Password for authentication for the client.
  3. Optionaly, set a fixed IP for this client (if left empty, client will receive first free IP from the IP range).
  4. Don't forget to Save the changes.

IPsec

Networking rutx configuration examples l2tp over ipsec windows 10 3 v1.png

Go to the Services → VPN → IPsec page and do the following:

  1. Enter a custom name for the IPsec instance.
  2. Click the Add button.
  3. Click the Edit button next to the newly created instance.
Networking rutx configuration examples l2tp over ipsec windows 10 4 v1.png

In the IPsec Configuration page, do the following (and leave the rest as defaults, unless your specific configuration requires otherwise):

  1. Enable the instance.
  2. Enter your Pre-shared key.
  3. Select Type: Transport.
  4. Save changes.

Android phone

Networking rutxxx configuration examples l2tp over ipsec windows 10 6 v2.png

Type VPN settings in the Windows search bar:

Networking rutxxx configuration examples l2tp over ipsec windows 10 7 v2.png

Click the Add a VPN connection button:

Networking rutxxx configuration examples l2tp over ipsec windows 10 8 v2.png

Configure the following parameters:

  1. Select VPN provider: Windows (built-in).
  2. Enter a custom Connection name.
  3. Enter the router's WAN IP address into the Server name or address field.
  4. Select VPN type: L2TP/IPsec with pre-shared key.
  5. Enter the Pre-shared key exactly as it was specified on the router.
  6. Select Type of sign-in info: User name and password.
  7. Enter the User name and Password exactly as they were specified on the router.
  8. Click Save
Networking rutxxx configuration examples l2tp over ipsec windows 10 11 v2.png

Type Network Connections in the Windows search bar:

Networking rutxxx configuration examples l2tp over ipsec windows 10 12 v2.png

Press right mouse click on your newly created VPN instance and select Properties:

Networking rutxxx configuration examples l2tp over ipsec windows 10 13 v2.png

Navigate to Networking section and double click Internet Protocol Version 4 (TCP/IPv4):

Networking rutxxx configuration examples l2tp over ipsec windows 10 14 v2.png

Go to Advanced settings:

Networking rutxxx configuration examples l2tp over ipsec windows 10 15 v2.png

Now disable Use default gateway on remote network and save settings:

Networking rutxxx configuration examples l2tp over ipsec windows 10 9 v2.png

Go back to the VPN settings page, locate your new connection and click the Connect button. If the connection was successful, you should see the word "Connected" appear under the connection name:

Results

Networking rutxxx configuration examples l2tp over ipsec windows 10 10 v2.png

Home worker should now be able to access HQ network resources. To verify the connection you can ping some internal HQ server and if you get a reply, you have successfully connected to HQ‘s internal network.

Retrieved from "https://wiki.teltonika-networks.com/index.php?title=Template:Networking_rutos_configuration_example_l2tp_over_ipsec_android&oldid=63372"