Difference between revisions of "L2TP over IPsec RutOS"
(One intermediate revision by the same user not shown) | |||
Line 10: | Line 10: | ||
'''Prerequisites''': | '''Prerequisites''': | ||
− | * Two RUTxxx routers of any type | + | * Two RUTxxx routers of any type |
* At least one router with a Public Static or Public Dynamic IP addresses | * At least one router with a Public Static or Public Dynamic IP addresses | ||
* At least one end device (PC, Laptop, Tablet, Smartphone) to configure the routers | * At least one end device (PC, Laptop, Tablet, Smartphone) to configure the routers | ||
Line 18: | Line 18: | ||
[[File:Configuration examples l2tp over ipsec scheme.png]] | [[File:Configuration examples l2tp over ipsec scheme.png]] | ||
− | The figure above depicts the L2TP/IPsec scheme. It is fairly similar to the [[L2TP configuration examples RutOS#Configuration overview and prerequisites|L2TP]] and [[IPsec RUTOS configuration example#Configuration overview and prerequisites|IPsec]] configuration schemes - the router with the Public IP address (''RUT1'') acts as the L2TP/IPsec server and the other router ('' | + | The figure above depicts the L2TP/IPsec scheme. It is fairly similar to the [[L2TP configuration examples RutOS#Configuration overview and prerequisites|L2TP]] and [[IPsec RUTOS configuration example#Configuration overview and prerequisites|IPsec]] configuration schemes - the router with the Public IP address (''RUT1'') acts as the L2TP/IPsec server and the other router (''RUT2'') acts a client. L2TP connects the networks of ''RUT1'' and ''RUT2'' and IPsec provides the encryption for the L2TP tunnel. |
When the scheme is realized, L2TP packets between the endpoints are encapsulated by IPsec. Since the L2TP packet itself is wrapped and hidden within the IPsec packet, the original source and destination IP address is encrypted within the packet. | When the scheme is realized, L2TP packets between the endpoints are encapsulated by IPsec. Since the L2TP packet itself is wrapped and hidden within the IPsec packet, the original source and destination IP address is encrypted within the packet. | ||
− | == | + | ==RUT1 Configuration(Server)== |
+ | As mentioned in the prerequisites section, the router that acts as the server must have a Public Static or Public Dynamic IP address (more information on the subject can be found here). If that is in order, we should start configuring the server. | ||
+ | ===L2TP=== | ||
+ | |||
+ | |||
+ | <table class="nd-othertables_2"> | ||
+ | <tr> | ||
+ | <th width=355; style="border-bottom: 1px solid white;></th> | ||
+ | <th width=790; style="border-bottom: 1px solid white;" rowspan=2> [[File:RutOS_L2TP_IPsec_VPN_7,8_add_L2TP_Server.png|770px|right]]</th> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td style="border-bottom: 1px solid white;> | ||
+ | Login to the router's WebUI and navigate to the '''Services → VPN → L2TP''' page and do the following: | ||
+ | <ol> | ||
+ | <li>Select '''Role: Server'''.</li> | ||
+ | <li>Enter a '''custom configuration name'''.</li> | ||
+ | <li>Click the '''Add''' button. You will be prompted to the configuration window</li> | ||
+ | </ol> | ||
+ | </td> | ||
+ | </tr> | ||
+ | </table> | ||
+ | |||
+ | ---- | ||
− | + | <table class="nd-othertables_2"> | |
+ | <tr> | ||
+ | <th width=355; style="border-bottom: 1px solid white;></th> | ||
+ | <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:RutOS_L2TP_IPsec_VPN_7,8_add_L2TP_Server_config.png|770px|right]]</th> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td style="border-bottom: 1px solid white> | ||
+ | <ol> | ||
+ | <li>'''Enable''' the L2TP instance.</li> | ||
+ | <li>Click on the '''Add''' button to add a new user</li> | ||
+ | <li>Enter a '''User name''' and '''Password''' for authentication for the client.</li> | ||
+ | <li>Optionally, set a fixed IP for this client (if left empty, the client will receive the first free IP from the IP range).</li> | ||
+ | <li>Don't forget to '''Save''' the changes.</li> | ||
+ | </ol> | ||
+ | </td> | ||
+ | </tr> | ||
+ | </table> | ||
===IPsec=== | ===IPsec=== | ||
---- | ---- | ||
− | |||
− | ==== | + | <table class="nd-othertables_2"> |
+ | <tr> | ||
+ | <th width=355; style="border-bottom: 1px solid white;></th> | ||
+ | <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:RutOS_L2TP_IPsec_VPN_7,8_add_Ipsec_Server.png|770px|right]]</th> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td style="border-bottom: 1px solid white> | ||
+ | Go to the '''Services → VPN → IPsec''' page and do the following: | ||
+ | <ol> | ||
+ | <li>Enter a custom name for the IPsec instance.</li> | ||
+ | <li>Click the '''Add''' button. You will be prompted to the configuration window</li> | ||
+ | </ol> | ||
+ | </td> | ||
+ | </tr> | ||
+ | </table> | ||
+ | |||
---- | ---- | ||
− | |||
− | [[File: | + | <table class="nd-othertables_2"> |
+ | <tr> | ||
+ | <th width=355; style="border-bottom: 1px solid white;></th> | ||
+ | <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:RutOS_L2TP_IPsec_VPN_7,8_add_Ipsec_Server_config_instnace222.png|770px|right]]</th> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td style="border-bottom: 1px solid white> | ||
+ | In the '''IPsec Configuration''' page, do the following (and leave the rest as defaults, unless your specific configuration requires otherwise): | ||
+ | <ol> | ||
+ | <li>'''Enable''' the instance.</li> | ||
+ | <li>Enter your '''Pre-shared key'''.</li> | ||
+ | </ol> | ||
+ | </td> | ||
+ | </tr> | ||
+ | </table> | ||
+ | <table class="nd-othertables_2"> | ||
+ | <tr> | ||
+ | <th width=355; style="border-bottom: 1px solid white;></th> | ||
+ | <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:RutOS_L2TP_IPsec_VPN_7,8_add_Ipsec_Server_config_instance_connection.png|770px|right]]</th> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td style="border-bottom: 1px solid white> | ||
+ | <ol> | ||
+ | '''3.''' Select '''Type: Transport'''. | ||
+ | <br> | ||
+ | Do not forget to '''Save''' changes. | ||
+ | </ol> | ||
+ | </td> | ||
+ | </tr> | ||
+ | </table> | ||
+ | ---- | ||
+ | '''Note:''' ''This is only an example of a secure configuration. Other algorithms or even combinations of them could be used. However, we strongly recommend refraining from using older encryption and hashing algorithms unless support for certain legacy systems is required.'' | ||
− | + | Make the following changes: | |
− | # ''' | + | <table class="nd-othertables_2"> |
− | # ''' | + | <tr> |
− | + | <th width=330; style="border-bottom: 1px solid white;></th> | |
− | # | + | <th width=800; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_webui_manual_IPsec_configuration_proposal_phase1_settings_v1.png|border|class=tlt-border|671x336px|center]]</th> |
− | + | </tr> | |
− | + | <tr> | |
− | # | + | <td style="border-bottom: 4px solid white> |
+ | # Encryption - '''''AES256;''''' | ||
+ | # Authentication - '''''SHA512;''''' | ||
+ | # DH group - '''''MODP4096;''''' | ||
+ | # IKE lifetime - '''86400s'''. | ||
+ | </td> | ||
+ | </tr> | ||
+ | </table> | ||
− | |||
---- | ---- | ||
− | + | <table class="nd-othertables_2"> | |
+ | <tr> | ||
+ | <th width=330; style="border-bottom: 1px solid white;></th> | ||
+ | <th width=800; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_webui_manual_IPsec_configuration_proposal_phase2_settings_v1.png|border|class=tlt-border|644x331px|center]]</th> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td style="border-bottom: 4px solid white> | ||
+ | # Encryption - '''''AES256;''''' | ||
+ | # Authentication - '''''SHA512;''''' | ||
+ | # PFS group - '''''MODP4096;''''' | ||
+ | # Lifetime – '''''86400s;''''' | ||
+ | </td> | ||
+ | </tr> | ||
+ | </table> | ||
+ | ==RUT2 Configuration(client)== | ||
+ | Now let's configure the L2TP/IPsec Client. | ||
+ | ===L2TP=== | ||
− | |||
− | + | <table class="nd-othertables_2"> | |
− | + | <tr> | |
− | + | <th width=355; style="border-bottom: 1px solid white;></th> | |
− | + | <th width=790; style="border-bottom: 1px solid white;" rowspan=2> [[File:RutOS_L2TP_IPsec_VPN_7,8_1.png|770px|right]]</th> | |
− | + | </tr> | |
− | + | <tr> | |
− | + | <td style="border-bottom: 1px solid white;> | |
− | + | Login to the router's WebUI and navigate to the '''Services → VPN → L2TP''' page and do the following: | |
+ | <ol> | ||
+ | <li>Select '''Role: Client'''.</li> | ||
+ | <li>Enter a '''custom configuration name'''.</li> | ||
+ | <li>Click the '''Add''' button. You will be prompted to the configuration window</li> | ||
+ | </ol> | ||
+ | </td> | ||
+ | </tr> | ||
+ | </table> | ||
− | |||
---- | ---- | ||
− | |||
− | [[File: | + | <table class="nd-othertables_2"> |
+ | <tr> | ||
+ | <th width=355; style="border-bottom: 1px solid white;></th> | ||
+ | <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:RutOS_L2TP_IPsec_VPN_7,8_2.png|770px|right]]</th> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td style="border-bottom: 1px solid white> | ||
+ | <ol> | ||
+ | <li>'''Enable''' the L2TP instance.</li> | ||
+ | <li>Enter the '''Public IP''' of RUT1</li> | ||
+ | <li>Enter the '''Username''' that we created on RUT1</li> | ||
+ | <li>Enter the '''Password''' that we created on RUT1</li> | ||
+ | <li>Don't forget to '''Save''' the changes.</li> | ||
+ | </ol> | ||
+ | </td> | ||
+ | </tr> | ||
+ | </table> | ||
− | + | ===IPsec=== | |
− | |||
− | === | ||
---- | ---- | ||
− | |||
− | + | <table class="nd-othertables_2"> | |
+ | <tr> | ||
+ | <th width=355; style="border-bottom: 1px solid white;></th> | ||
+ | <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:RutOS_L2TP_IPsec_VPN_7,8_add_Ipsec_Server.png|770px|right]]</th> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td style="border-bottom: 1px solid white> | ||
+ | Go to the '''Services → VPN → IPsec''' page and do the following: | ||
+ | <ol> | ||
+ | <li>Enter a custom name for the IPsec instance.</li> | ||
+ | <li>Click the '''Add''' button. You will be prompted to the configuration window</li> | ||
+ | </ol> | ||
+ | </td> | ||
+ | </tr> | ||
+ | </table> | ||
− | |||
---- | ---- | ||
− | |||
− | |||
− | + | <table class="nd-othertables_2"> | |
− | + | <tr> | |
− | + | <th width=355; style="border-bottom: 1px solid white;></th> | |
− | + | <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:RutOS_L2TP_IPsec_VPN_7,8_3.png|770px|right]]</th> | |
+ | </tr> | ||
+ | <tr> | ||
+ | <td style="border-bottom: 1px solid white> | ||
+ | In the '''IPsec Configuration''' page, do the following (and leave the rest as defaults, unless your specific configuration requires otherwise): | ||
+ | <ol> | ||
+ | <li>'''Enable''' the instance.</li> | ||
+ | <li>Enter the '''Public IP''' of RUT1</li> | ||
+ | <li>Enter your '''Pre-shared key'''.</li> | ||
+ | </ol> | ||
+ | </td> | ||
+ | </tr> | ||
+ | </table> | ||
+ | <table class="nd-othertables_2"> | ||
+ | <tr> | ||
+ | <th width=355; style="border-bottom: 1px solid white;></th> | ||
+ | <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:RutOS_L2TP_IPsec_VPN_7,8_add_Ipsec_Server_config_instance_connection.png|770px|right]]</th> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td style="border-bottom: 1px solid white> | ||
+ | <ol> | ||
+ | '''4.''' Select '''Type: Transport'''. | ||
+ | <br> | ||
+ | Do not forget to '''Save''' changes. | ||
+ | </ol> | ||
+ | </td> | ||
+ | </tr> | ||
+ | </table> | ||
---- | ---- | ||
− | + | '''Note:''' ''This is only an example of a secure configuration. Other algorithms or even combinations of them could be used. However, we strongly recommend refraining from using older encryption and hashing algorithms unless support for certain legacy systems is required.'' | |
+ | |||
+ | Make the following changes: | ||
+ | <table class="nd-othertables_2"> | ||
+ | <tr> | ||
+ | <th width=330; style="border-bottom: 1px solid white;></th> | ||
+ | <th width=800; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_webui_manual_IPsec_configuration_proposal_phase1_settings_v1.png|border|class=tlt-border|671x336px|center]]</th> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td style="border-bottom: 4px solid white> | ||
+ | # Encryption - '''''AES256;''''' | ||
+ | # Authentication - '''''SHA512;''''' | ||
+ | # DH group - '''''MODP4096;''''' | ||
+ | # IKE lifetime - '''86400s'''. | ||
+ | </td> | ||
+ | </tr> | ||
+ | </table> | ||
− | [[File: | + | ---- |
+ | <table class="nd-othertables_2"> | ||
+ | <tr> | ||
+ | <th width=330; style="border-bottom: 1px solid white;></th> | ||
+ | <th width=800; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_webui_manual_IPsec_configuration_proposal_phase2_settings_v1.png|border|class=tlt-border|644x331px|center]]</th> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td style="border-bottom: 4px solid white> | ||
+ | # Encryption - '''''AES256;''''' | ||
+ | # Authentication - '''''SHA512;''''' | ||
+ | # PFS group - '''''MODP4096;''''' | ||
+ | # Lifetime – '''''86400s;''''' | ||
+ | </td> | ||
+ | </tr> | ||
+ | </table> | ||
+ | ==Testing the setup== | ||
− | + | If you've followed all the steps presented above, your configuration should be finished. But as with any other configuration, it is always wise to test the setup in order to make sure that it works properly. | |
− | |||
− | |||
− | + | To test an L2TP connection, login to one of the routers' WebUIs and go to '''Services → CLI'''. Login with user name: '''root''' and the router's admin password. You should then be able to '''ping''' the opposite instance, i.e., if you logged in to the server's CLI, you should be able to ping the client's virtual IP address, and vice versa. To use a ping command, type '''ping <ip_address>''' and press the "Enter" key on your keyboard: | |
− | + | [[File:RutOS_L2TP_IPsec_VPN_7,8_5.png|border|class=tlt-border|500px]] | |
− | + | ---- | |
+ | Using the <code><span class="highlight">'''ipsec status'''</span></code> or we can use <code><span class="highlight">'''ipsec statusall'''</span></code> command for a more verbose output. With these commands we can see that the IPsec tunnel is successfully established on RUT router. The command output on a '''RUT''' device: | ||
− | + | [[File:RutOS_L2TP_IPsec_VPN_7,8_4.png|border|class=tlt-border]] | |
− | + | If the ping requests are successful and ipsec status shows information, congratulations, your setup works! If not, we suggest that you review all steps once more. | |
==See also== | ==See also== | ||
Line 108: | Line 298: | ||
** [[IPsec RUTOS configuration example|IPsec configuration examples]] | ** [[IPsec RUTOS configuration example|IPsec configuration examples]] | ||
** [[GRE Tunnel configuration examples RutOS|GRE Tunnel configuration examples]] | ** [[GRE Tunnel configuration examples RutOS|GRE Tunnel configuration examples]] | ||
− | ** [[ | + | ** [[OpenVPN_configuration_examples|OpenVPN configuration examples]] |
** [[PPTP configuration examples RutOS|PPTP configuration examples]] | ** [[PPTP configuration examples RutOS|PPTP configuration examples]] | ||
[[Category:VPN]] | [[Category:VPN]] |
Latest revision as of 12:13, 20 August 2024
Main Page > General Information > Configuration Examples > VPN > L2TP over IPsec RutOSIntroduction
Because of the lack of confidentiality inherent in the Layer 2 Networking Protocol (L2TP) protocol, Internet Protocol Security (IPsec) is often used to secure L2TP packets by providing confidentiality, authentication and integrity. The combination of these two protocols is generally known as L2TP over IPsec (or simply L2TP/IPsec).
This article provides a guide on how to configure L2TP/IPsec on RUTxxx routers. It should also be noted that this guide is aimed at more advanced users and, therefore, skips some of the more self-explanatory steps in order to preserve the overall coherence of the article. For example, instead of showing how to add new instances step by step, it is only mentioned in a short sentence. If you feel this lack of information impedes your ability to configure the setup, we suggest you check out our separate configuration guides on IPsec and L2TP for reference.
Configuration overview and prerequisites
Before we begin, let's overview the configuration that we are attempting to achieve and the prerequisites that make it possible.
Prerequisites:
- Two RUTxxx routers of any type
- At least one router with a Public Static or Public Dynamic IP addresses
- At least one end device (PC, Laptop, Tablet, Smartphone) to configure the routers
Configuration scheme:
The figure above depicts the L2TP/IPsec scheme. It is fairly similar to the L2TP and IPsec configuration schemes - the router with the Public IP address (RUT1) acts as the L2TP/IPsec server and the other router (RUT2) acts a client. L2TP connects the networks of RUT1 and RUT2 and IPsec provides the encryption for the L2TP tunnel.
When the scheme is realized, L2TP packets between the endpoints are encapsulated by IPsec. Since the L2TP packet itself is wrapped and hidden within the IPsec packet, the original source and destination IP address is encrypted within the packet.
RUT1 Configuration(Server)
As mentioned in the prerequisites section, the router that acts as the server must have a Public Static or Public Dynamic IP address (more information on the subject can be found here). If that is in order, we should start configuring the server.
L2TP
Login to the router's WebUI and navigate to the Services → VPN → L2TP page and do the following:
|
|
IPsec
Go to the Services → VPN → IPsec page and do the following:
|
In the IPsec Configuration page, do the following (and leave the rest as defaults, unless your specific configuration requires otherwise):
|
Do not forget to Save changes. |
Note: This is only an example of a secure configuration. Other algorithms or even combinations of them could be used. However, we strongly recommend refraining from using older encryption and hashing algorithms unless support for certain legacy systems is required.
Make the following changes:
|
|
RUT2 Configuration(client)
Now let's configure the L2TP/IPsec Client.
L2TP
Login to the router's WebUI and navigate to the Services → VPN → L2TP page and do the following:
|
|
IPsec
Go to the Services → VPN → IPsec page and do the following:
|
In the IPsec Configuration page, do the following (and leave the rest as defaults, unless your specific configuration requires otherwise):
|
Do not forget to Save changes. |
Note: This is only an example of a secure configuration. Other algorithms or even combinations of them could be used. However, we strongly recommend refraining from using older encryption and hashing algorithms unless support for certain legacy systems is required.
Make the following changes:
|
|
Testing the setup
If you've followed all the steps presented above, your configuration should be finished. But as with any other configuration, it is always wise to test the setup in order to make sure that it works properly.
To test an L2TP connection, login to one of the routers' WebUIs and go to Services → CLI. Login with user name: root and the router's admin password. You should then be able to ping the opposite instance, i.e., if you logged in to the server's CLI, you should be able to ping the client's virtual IP address, and vice versa. To use a ping command, type ping <ip_address> and press the "Enter" key on your keyboard:
Using the ipsec status
or we can use ipsec statusall
command for a more verbose output. With these commands we can see that the IPsec tunnel is successfully established on RUT router. The command output on a RUT device:
If the ping requests are successful and ipsec status shows information, congratulations, your setup works! If not, we suggest that you review all steps once more.
See also
- Other types of VPNs suported by RUTxxx devices: