Difference between revisions of "Template:Networking rutos configuration example l2tp over ipsec android"

From Teltonika Networks Wiki
(23 intermediate revisions by one other user not shown)
Line 3: Line 3:
 
         <th width=325; style="border-bottom: 1px solid white;></th>
 
         <th width=325; style="border-bottom: 1px solid white;></th>
 
         <th width=820; style="border-bottom: 1px solid white;" rowspan=2;>
 
         <th width=820; style="border-bottom: 1px solid white;" rowspan=2;>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_topology_v1.png|border|class=tlt-border|750px|right]]</th>
+
[[File:Networking_RUTX_VPN_between_HQ_topology_v3.png|border|class=tlt-border|750px|right]]</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
Line 21: Line 21:
 
* At least one Android device
 
* At least one Android device
  
−
The topology above depicts the L2TP/IPsec scheme. The router with the Public IP address ('''RUTX''') acts as the '''L2TP/IPsec server''' and the '''Android device''' acts as '''client'''. L2TP connects the networks of '''RUTX''' and '''Android client''', IPsec provides the encryption for the L2TP tunnel. Created VPN tunnel will allow Android device to reach home network behind the RUTX router, but the rest of Android device network traffic will not be redirected through VPN. This way the VPN tunnel will not be under a huge load and will provide greater speeds.
+
The topology above depicts the L2TP/IPsec scheme. - The router with the Public IP address ('''''RUTX11''''') acts as the '''L2TP/IPsec server''' and the '''Android device''' acts as '''client'''. L2TP connects the networks of '''RUTX11''' and '''Android client''', IPsec provides the encryption for the L2TP tunnel. Created VPN tunnel will allow Android device to reach home network behind the RUTX11 router, but the rest of Android device network traffic will not be redirected through VPN. This way the VPN tunnel will not be under a huge load and will provide greater speeds.
  
−
When the scheme is realized, you will be able to log on to your home network from anywhere - work, hotel, car. You will have access to all of your home resources, and your data will still be secure, even if you will be using public WiFi.
+
When the scheme is realized, you will be able to reach your home internal network with all internal systems, cameras, or other IOT devices, from anywhere in the world.
  
 
==Configuring home router (RUTX)==
 
==Configuring home router (RUTX)==
−
As mentioned in the prerequisites section, the router that acts as the server must have a Public Static or Public Dynamic IP address (more information on the subject can be found here). If that is in order, we should start configuring the server.
 
 
===L2TP===
 
===L2TP===
−
 
+
----
  
 
<table class="nd-othertables_2">
 
<table class="nd-othertables_2">
 
     <tr>
 
     <tr>
 
         <th width=355; style="border-bottom: 1px solid white;></th>
 
         <th width=355; style="border-bottom: 1px solid white;></th>
−
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2> [[File:RutOS_L2TP_IPsec_VPN_7,8_add_L2TP_Server.png|770px|right]]</th>
+
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>  
 +
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_1_v1.png|770px|right]]</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
Line 39: Line 39:
 
Login to the router's WebUI and navigate to the '''Services → VPN → L2TP''' page and do the following:
 
Login to the router's WebUI and navigate to the '''Services → VPN → L2TP''' page and do the following:
 
<ol>
 
<ol>
 +
    <li>Enter a '''custom configuration name'''.</li>
 
     <li>Select '''Role: Server'''.</li>
 
     <li>Select '''Role: Server'''.</li>
−
     <li>Enter a '''custom configuration name'''.</li>
+
     <li>Click the '''Add''' button.</li>
−
     <li>Click the '''Add''' button. You will be prompted to the configuration window</li>
+
     <li>Click the '''Edit''' button next to the newly created L2TP instance.</li>
 
</ol>
 
</ol>
 
         </td>
 
         </td>
Line 52: Line 53:
 
     <tr>
 
     <tr>
 
         <th width=355; style="border-bottom: 1px solid white;></th>
 
         <th width=355; style="border-bottom: 1px solid white;></th>
−
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:RutOS_L2TP_IPsec_VPN_7,8_add_L2TP_Server_config.png|770px|right]]</th>
+
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>
 +
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_2_v1.png|770px|right]]</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
Line 58: Line 60:
 
<ol>
 
<ol>
 
     <li>'''Enable''' the L2TP instance.</li>
 
     <li>'''Enable''' the L2TP instance.</li>
−
    <li>Click on the '''Add''' button to add a new user</li>
+
     <li>Enter a '''Username''' and '''Password''' which later will be used for client authentication.</li>
−
     <li>Enter a '''User name''' and '''Password''' for authentication for the client.</li>
+
     <li>Optionally, set a fixed IP for this client (if left empty, client will receive first free IP from the IP range).</li>
−
     <li>Optionally, set a fixed IP for this client (if left empty, the client will receive the first free IP from the IP range).</li>
 
 
     <li>Don't forget to '''Save''' the changes.</li>
 
     <li>Don't forget to '''Save''' the changes.</li>
 
</ol>
 
</ol>
Line 73: Line 74:
 
     <tr>
 
     <tr>
 
         <th width=355; style="border-bottom: 1px solid white;></th>
 
         <th width=355; style="border-bottom: 1px solid white;></th>
−
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:RutOS_L2TP_IPsec_VPN_7,8_add_Ipsec_Server.png|770px|right]]</th>
+
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>
 +
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_3_v1.png|770px|right]]</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
Line 79: Line 81:
 
Go to the '''Services → VPN → IPsec''' page and do the following:
 
Go to the '''Services → VPN → IPsec''' page and do the following:
 
<ol>     
 
<ol>     
−
       <li>Enter a custom name for the IPsec instance.</li>
+
       <li>Enter a custom '''Name''' for the IPsec instance.</li>
−
       <li>Click the '''Add''' button. You will be prompted to the configuration window</li>
+
       <li>Click the '''Add''' button.</li>
 +
      <li>Click the '''Edit''' button next to the newly created instance.</li>
 
</ol>
 
</ol>
 
         </td>
 
         </td>
Line 91: Line 94:
 
     <tr>
 
     <tr>
 
         <th width=355; style="border-bottom: 1px solid white;></th>
 
         <th width=355; style="border-bottom: 1px solid white;></th>
−
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:RutOS_L2TP_IPsec_VPN_7,8_add_Ipsec_Server_config_instnace222.png|770px|right]]</th>
+
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>
−
  </tr>
+
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_4_v1.png|770px|right]]</th>
 +
    </tr>
 
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white>
 
         <td style="border-bottom: 1px solid white>
Line 99: Line 103:
 
       <li>'''Enable''' the instance.</li>
 
       <li>'''Enable''' the instance.</li>
 
       <li>Enter your '''Pre-shared key'''.</li>
 
       <li>Enter your '''Pre-shared key'''.</li>
−
</ol>
+
      <li>Select '''Type: Transport'''.</li>
−
        </td>
+
      <li>Set '''DH group''' to '''MODP1024'''.</li>
−
    </tr>
+
      <li>Go to '''Phase 2''' settings and also set '''DH group''' to '''MODP1024'''.</li>
−
</table>
 
−
<table class="nd-othertables_2">
 
−
    <tr>
 
−
        <th width=355; style="border-bottom: 1px solid white;></th>
 
−
        <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:RutOS_L2TP_IPsec_VPN_7,8_add_Ipsec_Server_config_instance_connection.png|770px|right]]</th>
 
−
  </tr>
 
−
    <tr>
 
−
        <td style="border-bottom: 1px solid white>
 
−
<ol>   
 
−
'''3.''' Select '''Type: Transport'''.
 
−
<br>
 
−
Do not forget to '''Save''' changes.
 
−
</ol>
 
−
        </td>
 
−
    </tr>
 
−
</table>
 
−
----
 
−
'''Note:''' ''This is only an example of a secure configuration. Other algorithms or even combinations of them could be used. However, we strongly recommend refraining from using older encryption and hashing algorithms unless support for certain legacy systems is required.''
 
−
 
 
−
Make the following changes:
 
−
<table class="nd-othertables_2">
 
−
    <tr>
 
−
        <th width=330; style="border-bottom: 1px solid white;></th>
 
−
        <th width=800; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_webui_manual_IPsec_configuration_proposal_phase1_settings_v1.png|border|class=tlt-border|671x336px|center]]</th>
 
−
    </tr>
 
−
    <tr>
 
−
        <td style="border-bottom: 4px solid white>
 
−
# Encryption - '''''AES256;'''''
 
−
# Authentication - '''''SHA512;'''''
 
−
# DH group - '''''MODP4096;'''''
 
−
# IKE lifetime - '''86400s'''.
 
−
        </td>
 
−
    </tr>
 
−
</table>
 
−
 
 
−
----
 
−
<table class="nd-othertables_2">
 
−
    <tr>
 
−
        <th width=330; style="border-bottom: 1px solid white;></th>
 
−
        <th width=800; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_webui_manual_IPsec_configuration_proposal_phase2_settings_v1.png|border|class=tlt-border|644x331px|center]]</th>
 
−
    </tr>
 
−
    <tr>
 
−
        <td style="border-bottom: 4px solid white>
 
−
# Encryption - '''''AES256;'''''
 
−
# Authentication - '''''SHA512;'''''
 
−
# PFS group - '''''MODP4096;'''''
 
−
# Lifetime – '''''86400s;'''''
 
−
        </td>
 
−
    </tr>
 
−
</table>
 
−
 
 
−
===Firewall===
 
−
----
 
−
Now go to the '''Network → Firewall → General Settings''' page
 
−
 
 
−
----
 
−
 
 
−
<table class="nd-othertables_2">
 
−
    <tr>
 
−
        <th width=355; style="border-bottom: 1px solid white;></th>
 
−
        <th width=790; style="border-bottom: 1px solid white;" rowspan=2>
 
−
[[File:RutOS_L2TP_IPsec_android_7.8_1.png|770px|right]]</th>
 
−
    </tr>
 
−
    <tr>
 
−
        <td style="border-bottom: 1px solid white>
 
−
<ol>   
 
−
      <li>Set '''Forward: accept'''.</li>
 
 
       <li>'''Save''' changes.</li>
 
       <li>'''Save''' changes.</li>
 
</ol>
 
</ol>
Line 196: Line 133:
 
         <th width=525; style="border-bottom: 1px solid white;"></th>
 
         <th width=525; style="border-bottom: 1px solid white;"></th>
 
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
 
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_6_v3.png|border|class=tlt-border|300px|center]]</th>
+
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_6_v2.png|border|class=tlt-border|300px|center]]</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
Line 217: Line 154:
 
         <th width=525; style="border-bottom: 1px solid white;"></th>
 
         <th width=525; style="border-bottom: 1px solid white;"></th>
 
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
 
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_7_v3.png|border|class=tlt-border|300px|center]]</th>
+
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_7_v2.png|border|class=tlt-border|300px|center]]</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
Line 223: Line 160:
 
         <ol>
 
         <ol>
 
             <li>Write the '''DNS servers''' you are planning to use (in this example we used google DNS servers).</li>
 
             <li>Write the '''DNS servers''' you are planning to use (in this example we used google DNS servers).</li>
−
             <li>Add '''Forwarding routes''' (RUTX LAN network).</li>
+
             <li>Add '''Forwarding routes''' (RUTX11 LAN network).</li>
 
             <li>'''Save''' settings.</li>
 
             <li>'''Save''' settings.</li>
 
         </ol>
 
         </ol>
Line 280: Line 217:
 
     </tr>
 
     </tr>
 
</table>
 
</table>
−
 
−
----
 
  
 
'''Disclaimer:'''
 
'''Disclaimer:'''
  
−
This configuration example was created by using Android version 10. The IPsec '''Phase 1''' and '''Phase 2''' settings, which were used in this configuration example, might not work with other Android versions and might require adjustment.
+
This configuration example was created by using Android version 10. IPsec '''Phase 1''' and '''Phase 2''' settings might not work with other Android versions.

Revision as of 10:45, 25 May 2020

Networking RUTX VPN between HQ topology v3.png

Configuration overview and prerequisites

Prerequisites:

  • One RUTX router of any type
  • A Public Static or Public Dynamic IP address
  • At least one Android device

The topology above depicts the L2TP/IPsec scheme. - The router with the Public IP address (RUTX11) acts as the L2TP/IPsec server and the Android device acts as client. L2TP connects the networks of RUTX11 and Android client, IPsec provides the encryption for the L2TP tunnel. Created VPN tunnel will allow Android device to reach home network behind the RUTX11 router, but the rest of Android device network traffic will not be redirected through VPN. This way the VPN tunnel will not be under a huge load and will provide greater speeds.

When the scheme is realized, you will be able to reach your home internal network with all internal systems, cameras, or other IOT devices, from anywhere in the world.

Configuring home router (RUTX)

L2TP

Networking rutos configuration example l2tp over ipsec android 1 v1.png

Login to the router's WebUI and navigate to the Services → VPN → L2TP page and do the following:

  1. Enter a custom configuration name.
  2. Select Role: Server.
  3. Click the Add button.
  4. Click the Edit button next to the newly created L2TP instance.
Networking rutos configuration example l2tp over ipsec android 2 v1.png
  1. Enable the L2TP instance.
  2. Enter a Username and Password which later will be used for client authentication.
  3. Optionally, set a fixed IP for this client (if left empty, client will receive first free IP from the IP range).
  4. Don't forget to Save the changes.

IPsec

Networking rutos configuration example l2tp over ipsec android 3 v1.png

Go to the Services → VPN → IPsec page and do the following:

  1. Enter a custom Name for the IPsec instance.
  2. Click the Add button.
  3. Click the Edit button next to the newly created instance.
Networking rutos configuration example l2tp over ipsec android 4 v1.png

In the IPsec Configuration page, do the following (and leave the rest as defaults, unless your specific configuration requires otherwise):

  1. Enable the instance.
  2. Enter your Pre-shared key.
  3. Select Type: Transport.
  4. Set DH group to MODP1024.
  5. Go to Phase 2 settings and also set DH group to MODP1024.
  6. Save changes.

Android phone

Networking rutos configuration example l2tp over ipsec android 5 v2.png

Go to your Android device VPN settings and create a new VPN network:

Networking rutos configuration example l2tp over ipsec android 6 v2.png

Apply the following configuration:

  1. Select Type: L2TP/IPsec PSK.
  2. Enter the router's WAN IP address into the Server field.
  3. Enter the Pre-shared key exactly as it was specified in the router's IPsec settings.
  4. Press Show advanced options
Networking rutos configuration example l2tp over ipsec android 7 v2.png
  1. Write the DNS servers you are planning to use (in this example we used google DNS servers).
  2. Add Forwarding routes (RUTX11 LAN network).
  3. Save settings.
Networking rutos configuration example l2tp over ipsec android 8 v2.png

Now open your newly created VPN instance and connect to it:

  1. Write the Username you created in router's L2TP settings.
  2. Write the Password you created in router's L2TP settings.
  3. Press Connect.
Networking rutos configuration example l2tp over ipsec android 9 v2.png

If you applied the configuration correctly, after a moment it should indicate Connected:

Results

Networking rutos configuration example l2tp over ipsec android 10 v1.png

Now you should be able to access your home network resources. To verify the connection you can try accessing your router's WebUI without being connected to it in any way. If you are able to do that, you have successfully connected to your home network.

Disclaimer:

This configuration example was created by using Android version 10. IPsec Phase 1 and Phase 2 settings might not work with other Android versions.

Retrieved from "https://wiki.teltonika-networks.com/index.php?title=Template:Networking_rutos_configuration_example_l2tp_over_ipsec_android&oldid=63429"