VPN: Difference between revisions

From Teltonika Networks Wiki
VisualWikitext
No edit summary
 
(34 intermediate revisions by 5 users not shown)
Line 1: Line 1:
==Summary==


'''Virtual Private Network''' ('''VPN''') is a method for secure data transfer through unsafe public networks. This page is an overview of different types of VPNs that can be used with RUT routers.
==VPN==


==OpenVPN==
* [[DMVPN_with_IPsec_Phase_3 | DMVPN]]
 
* [[OpenVPN configuration examples|OpenVPN configuration example]]
'''OpenVPN''' is an open-source software application that implements virtual private network (VPN) techniques for creating secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. This section is an overview of the OpenVPN section of RUTxxx routers. For a more in depth guide refer to our '''[[OpenVPN configuration examples]]''' page.
* [[IPsec_RUTOS_configuration_example|IPsec cofiguration example]]
 
* [[ZeroTier One VPN configuration RutOS|ZeroTier One VPN configuration example]]
The default OpenVPN Configuration list is empty, so you have to define your own configuration to establish any sort of OpenVPN connection. OpenVPN configurations can have one of two roles: '''client''' or '''server'''. Let’s start with an OpenVPN client. To create it, enter the desired instance name in the '''New configuration name''' field, select the instance’s role from the '''Role''' list and press the '''Add New''' button.
* [[ZeroTier Configuration|ZeroTier]]
 
* [[L2TP configuration examples RutOS| L2TP configuration examples]]
[[Image:Services vpn openvpn creation.PNG]]
* [[Overlapping subnets with IPsec solution]]
 
* [[Setting up a GRE over IPsec tunnel between RUTOS devices|GRE over IPsec Tunnel]]
Once you’ve added a new OpenVPN instance there is no need to press the '''Save''' button, since the '''Add New''' button both creates and saves the new instance. By default the instance will be disabled and unconfigured. In order to establish an OpenVPN connection you must Enable your instance, enter an OpenVPN server address, choose an authentication method and a few other things, all of which can be configured in the '''Settings''' window, which can reached by pressing the '''Edit''' button next to your OpenVPN instance (as shown in the figure above).
* [[L2TP over IPsec RutOS| L2TP over IPsec RutOS]]
 
* [[Setting up an IPsec tunnel between Teltonika Networks and Cisco devices|Cisco IPsec]]
===OpenVPN Client===
* [[Setting up a GRE tunnel between Teltonika Networks and Cisco devices| Cisco GRE]]
----
* [[Setting up a GRE over IPsec tunnel between Teltonika Networks and Cisco devices]]
This section is overview of OpenVPN Client configuration.
* [[Setting up a GRE over IPsec tunnel between Teltonika Networks and Mikrotik devices|Mikrotik GRE over IPsec Tunnel]]
 
* [[Setting up a SSTP tunnel between Teltonika Networks and Mikrotik devices|Mikrotik SSTP]]
[[File:Services vpn openvpn client v 2.png]]
* [[Setting up an OpenVPN tunnel between Teltonika Neworks and Mikrotik devices|Mikrotik OpenVPN]]
 
* [[Setting up a L2TP over IPsec tunnel between Teltonika Networks and Mikrotik devices|Mikrotik L2TP over IPsec]]
The figure above is an example of a configured OpenVPN Client instance that uses the UDP protocol and TLS/Password authentication. Comprehensible explanations on how to configure each field are presented in the table below.
* [[Creating OpenVPN access server and connecting it to a Teltonika Networks router|OpenVPN Access Server]]
 
* [[Setting up an IPsec tunnel between RUT and Android phone]]
{| class="wikitable"
* [[Tinc VPN configuration examples]]
|+
* [[L2TP over IPsec PC|L2TP over IPsec VPN to a PC configuration example]]
! style="width: 250px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | FIELD NAME
* [[OpenVPN traffic split]]
! style="width: 250px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | VALUE
* [[Default_IPsec_route_configuration_between_Teltonika_Networks_devices | Default IPsec route configuration between Teltonika Networks devices]]
! style="width: 579px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | DESCRIPTION
* [[OpenVPN over Stunnel RutOS|OpenVPN over Stunnel]]
|-
* [[DMVPN with IPsec Phase 3]]
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Enable
* [[L2 LAN bridging over internet using L2TPv2+EoIP]]
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''no'''
* [[1NCE Configuration]]
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Enables the OpenVPN instance
* [[RutOS ExpressVPN configuration example|ExpressVPN]]
|-
* [[RutOS NordVPN configuration example|NordVPN]]
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | TUN/TAP
[[Category:Configuration Examples]]
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | TUN (tunnel) {{!}} TAP (bridged); Default: '''TUN (tunnel)'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | OpenVPN interface type. '''TUN''' is most often in typical VPN connections, however, '''TAP''' is required in some Ethernet bridging configurations
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Protocol
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | UDP {{!}} TCP; Default: '''UDP'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | The transfer protocol used by the OpenVPN connection. '''TCP''' is connection oriented – once a connection is established, data can be sent bidirectionally. '''UDP''' is a simpler, connectionless Internet protocol. '''UDP''' is usually faster but '''TCP''' has more security features. Choose the connection protocol according to your needs.
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Port
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | integer [0..65535]; Default: '''1194'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | With LZO compression, your VPN connection will generate less network traffic. However, enabling this causes a higher CPU load. Use it carefully with a high traffic rate or low CPU resources
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | LZO
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''no'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | With LZO compression, your VPN connection will generate less network traffic. However, enabling this causes a higher CPU load. Use it carefully with a high traffic rate or low CPU resources
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Encryption
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | DES-CBC 64 {{!}} RC2-CBC 128 {{!}} DES-EDE-CBC 128 {{!}} DES-EDE3-CBC 192 {{!}} DESX-CBC 192 {{!}} BF-CBC 128 {{!}} RC2-40-CBC 40 {{!}} CAST5-CBC 128 {{!}} RC2-40CBC 40 {{!}} CAST5-CBC 128 {{!}} RC2-64-CBC 64{{!}} AES-128-CBC 128 {{!}} AES-192-CBC 192 {{!}} AES-256-CBC 256 {{!}} none; Default: '''BF-CBC 128'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Packet encryption algorithm
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Authentication
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | TLS {{!}} Static Key {{!}} Password {{!}} TLS/Password; Default: '''TLS'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Authentication mode, used to secure data sessions.
'''Static key''' is a secret key used for server–client authentication.
 
'''TLS''' authentication mode uses X.509 type certificates:
 
'''Certificate Authority (CA)''', '''Client certificate''', '''Client key'''.
 
All mentioned certificates can be generated using OpenVPN or Open SSL utilities on any type of host machine.
 
'''Password''' is a simple username/password based authentication where the owner of the OpenVPN server provides the login data.
 
'''TLS/Password''' uses both TLS and Password authentication
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | TLS cipher
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | all {{!}} DHE+RSA {{!}} custom; Default: '''all'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Packet encryption algorithm cipher
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Remote host / IP address
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | ip; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | IP address or hostname of an OpenVPN server
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Resolve retry
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | integer {{!}} infinite; Default: '''infinite'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Time in seconds to resolve server hostname periodically in case of first resolve failure before generating service exception
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Keep alive
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | integer *space* integer; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" |  Defines two time intervals: one is used to periodically send ICMP request to the OpenVPN server, the other defines a time window, which is used to restart the OpenVPN service, if no ICMP response is received during the window time slice.
'''Example:''' 10 60
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Remote network IP address
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | ip; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | LAN IP address of the remote network (server)
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Remote network IP netmask
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | ip; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | LAN IP subnet mask of the remote network (server)
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Username
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | string; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | User name used for authentication
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Password
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | string; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Password name used for authentication
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Extra options
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | string; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Extra options to be used by the OpenVPN instance
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | HMAC authentication algorithm
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | none {{!}} SHA1 {{!}} SHA256 {{!}} SHA384 {{!}} SHA512; Default: '''SHA1'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | HMAC authentication algorithm type
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Additional HMAC authentication
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''no'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | An additional layer of HMAC authentication on top of the TLS control channel to protect against DoS attacks
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Certificate authority
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | .ca file; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Certificate authority is an entity that issues digital certificates. A digital certificate certifies the ownership of a public key by the named subject of the certificate
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Client certificate
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | .crt file; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Client certificate is a type of digital certificate that is used by client systems to make authenticated requests to a remote server. Client certificates play a key role in many mutual authentication designs, providing strong assurances of a requester's identity
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Client key
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | .key file; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Authenticates the client to the server and establishes precisely who they are
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Private key decryption password (optional)
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | string; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Decrypts server private key password. Use only if server's .key file is encrypted with a password
|-
|}
 
After setting any of these parameters press the '''Save''' button or else the changes will not be applied. Some of the selected parameters will be shown in the configuration list table. You should also be aware of the fact that the router will launch a separate OpenVPN service for every configuration entry (if it is defined as active at the time, of course) so the router has the ability to act as server and client at the same time.
 
===OpenVPN Server===
----
This section is an overview of OpenVPN Server configuration.
 
[[Image:Services vpn openvpn server.PNG]]
 
The figure above is an example of a configured OpenVPN Server instance that uses the UDP protocol and TLS authentication. As you can see, the configuration is similar to OpenVPN Client but with a few key differences. Comprehensible explanations on each field are presented in the table below:
 
{| class="wikitable"
|+
! style="width: 250px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | FIELD NAME
! style="width: 250px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | VALUE
! style="width: 579px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | DESCRIPTION
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Enable
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''no''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Enables the OpenVPN instance
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | TUN/TAP
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | TUN (tunnel) {{!}} TAP (bridged); Default: '''TUN (tunnel)'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | OpenVPN interface type. '''TUN''' is most often in typical VPN connections, however, '''TAP''' is required in some Ethernet bridging configurations
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Protocol
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | UDP {{!}} TCP; Default: '''UDP'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | The transfer protocol used by the OpenVPN connection. '''TCP''' is connection oriented – once a connection is established, data can be sent bidirectionally. '''UDP''' is a simpler, connectionless Internet protocol. '''UDP''' is usually faster but '''TCP''' has more security features. Choose the connection protocol according to your needs.
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Port
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | integer [0..65535]; Default: '''1194'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | TCP/UDP Port number for both local and remote endpoints (make sure that the chosen port is allowed by firewall)
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | LZO
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''no'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | With LZO compression, your VPN connection will generate less network traffic. However, enabling this causes a higher CPU load. Use it carefully with a high traffic rate or low CPU resources
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Encryption
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | DES-CBC 64 {{!}} RC2-CBC 128 {{!}} DES-EDE-CBC 128 {{!}} DES-EDE3-CBC 192 {{!}} DESX-CBC 192 {{!}} BF-CBC 128 {{!}} RC2-40-CBC 40 {{!}} CAST5-CBC 128 {{!}} RC2-40CBC 40 {{!}} CAST5-CBC 128 {{!}} RC2-64-CBC 64{{!}} AES-128-CBC 128 {{!}} AES-192-CBC 192 {{!}} AES-256-CBC 256 {{!}} none; Default: '''BF-CBC 128'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Packet encryption algorithm
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Authentication
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | TLS'''*''' {{!}} Static Key {{!}} Password {{!}} TLS/Password; Default: '''TLS'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Authentication mode, used to secure data sessions.
'''Static key''' is a secret key used for server–client authentication.
 
'''TLS''' authentication mode uses X.509 type certificates:
 
'''Certificate Authority (CA)''', '''Client certificate''', '''Client key'''.
 
All mentioned certificates can be generated using OpenVPN or Open SSL utilities on any type of host machine.
 
'''Password''' is a simple username/password based authentication where the owner of the OpenVPN server provides the login data.
 
'''TLS/Password''' uses both TLS and Password authentication
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | TLS cipher
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | all {{!}} DHE+RSA {{!}} custom; Default: '''all'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Packet encryption algorithm cipher
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Client to client
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''no'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Enables client to client communication in the Virtual network. In order for Client to client to work, the TLS Clients section most be utilized
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Keep alive
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | integer *space* integer; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Defines two time intervals: one is used to periodically send ICMP request to the OpenVPN server, the other defines a time window, which is used to restart the OpenVPN service, if no ICMP response is received during the window time slice.
'''Example:''' 10 60
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Virtual network IP address
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | ip; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | IP address of the Virtual network, e.g., '''10.0.8.0'''
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Virtual network IP netmask
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | ip; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Subnet mask of the Virtual network
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Push option
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | string; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Push options are a way to “push” user defined routes to connecting clients’ routing tables. In the example above, the server will push the route of 192.168.1.0 network with the 255.255.255.0 netmask to connecting clients. Therefore, the client will be able to reach devices in the 192.168.1.0 network. This is useful when a client needs to reach devices located in the OpenVPN server’s LAN.
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Allow duplicate certificates
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''no'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | If checked, the server allows clients to connect with identical certificates
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Certificate authority
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | .ca file; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Server certificate is a type of digital certificate that is used to identify the OpenVPN server
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Server certificate
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | .crt file; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Server certificate is a type of digital certificate that is used to identify the OpenVPN server
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Server key
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | .key file; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Authenticates clients to the server
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Diffie Hellman parameters
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | .pem file; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" |  DH parameters define how OpenSSL performs the Diffie-Hellman (DH) key-exchange.
|-
|}
 
'''*''' You can find detailed instructions on how to generate your own TLS certificates '''[[How to generate TLS certificates (Windows)?|here]]'''.
 
===TLS Clients===
----
TLS Clients is a way to more specifically differentiate clients by their '''Common Name (CN)''' found in the client certificate file. It can be used to assign specific VPN addresses to specific clients and bind them to their LAN addresses so that other device‘s in the client‘s LAN can be reached from the server or other clients.
 
The TLS Clients section can be found in the OpenVPN Server configuration window, provided that the OpenVPN server uses TLS or TLS/Password authentication methods. To create a new TLS client, type in the new client‘s name in the text field found bellow the TLS Clients tab and press the '''Add''' button.
 
[[Image:Services vpn openvpn tlsclients.PNG]]
 
{| class="wikitable"
|+
! style="width: 250px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | FIELD NAME
! style="width: 250px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | VALUE
! style="width: 579px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | DESCRIPTION
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | VPN instance name
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | string; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | With what VPN instance should the TLS Client be associated with
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Endpoint name
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | string; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Your endpoint name
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Common name (CN)
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | string; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Client’s Common Name (CN) found in the client’s certificate file
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Virtual local endpoint
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | ip; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Client’s virtual local address in the virtual network
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Virtual remote endpoint
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | ip; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Client’s virtual remote address in the virtual network
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Private network
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | ip; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Client’s private network (LAN) IP address
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Private netmask
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | ip; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Client’s private network (LAN) IP netmask
|-
|}
 
==IPsec==
 
The IPsec protocol client enables the router to establish a secure connection to an IPsec peer via the Internet. IPsec is supported in two modes - transport and tunnel. Transport mode creates a secure point to point channel between two hosts. Tunnel mode can be used to build a secure connection between two remote LANs serving as a VPN solution.
 
IPsec system maintains two databases: Security Policy Database (SPD) which defines whether to apply IPsec to a packet or not and specify which/how IPsec-SA is applied and Security Association Database (SAD), which contains a Key of each IPsec-SA.
 
The establishment of the Security Association (IPsec-SA) between two peers is needed for IPsec communication. It can be done by using manual or automated configuration.
 
'''NOTE''': the router starts establishing a tunnel when data is sent from the router to a remote site over the tunnel. The Keep Alive feature is used for automatic tunnel establishment.
----
For a more in-depth configuration example, visit the '''[[IPsec configuration examples]]''' page.
----
To create a new IPsec instance, go to the IPsec tab, type in a name for your new instance in the text field below the IPsec tab and press the '''Add''' button next to it.
 
'''NOTE''': You can create a maximum of 5 IPsec instances.
 
 
[[File:Services vpn ipsec v 2.png]]
 
{| class="wikitable"
|+
! style="width: 250px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | FIELD NAME
! style="width: 250px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | VALUE
! style="width: 579px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | DESCRIPTION
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Enable
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''no'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Toggles the IPsec instance ON or OFF
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | IKE version
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | IKEv1 {{!}} IKEv2; Default: '''IKEv1'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Method of key exchange
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Mode
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Main {{!}} Aggressive; Default: '''Main'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | ISAKMP phase 1 exchange mode
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Type
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Tunnel {{!}} Transport; Default: '''Tunnel'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Type of connection. <br> '''Tunnel''': protects the internal routing information by encrypting the IP header of the original packet. The original packet is encapsulated by a another set of IP headers. NAT traversal is supported with the tunnel mode. <br> '''Transport''': encrypts only the payload and Encapsulating Security Payload (ESP) trailer; so the IP header of the original packet is not encrypted. Transport mode is usually used when another tunneling protocol (such as [[VPN#GRE_Tunnel|GRE]], [[VPN#L2TP|L2TP]] (click '''[[L2TP over IPsec|here]]''' for a configuration example on '''L2TP over IPsec''')) is used to first encapsulate the IP data packet, then IPsec is used to protect the GRE/L2TP tunnel packets. NAT traversal is not supported with the transport mode.
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | My identifier type
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Address {{!}} FQDN {{!}} User FQDN; Default: '''FQDN'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Type of connection
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | My identifier
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | string; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | In case RUT has a Private IP, its identifier should be its own LAN network address. In this way, the Road Warrior approach is possible
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Local IP address/Subnet mask
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | ip/netmask {{!}} Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Local network secure group IP address and mask used to determine at what subnet an IP address can be accessed. Netmask range [0 - 32]. If left empty IP address will be selected automatically
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Left firewall
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''yes'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Excludes IPsec tunnel from firewall rules
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Force encapsulation
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''no'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Forces UDP encapsulation for ESP packets even if no NAT situation is detected
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Dead Peer Detection
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''no'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | The values 'clear', 'hold' and 'restart' all activate DPD
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Pre-shared key
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | string; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | A shared password used for authentication between the peers
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Remote VPN endpoint
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | host {{!}} ip; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | IP address or hostname of the remote IPsec instance
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Remote IP address/subnet mask
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | ip/integer [0..32]; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Remote network secure group IP address and mask used to determine to what subnet an IP address belongs to. Should differ from device’s LAN IP
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Right firewall
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''yes'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Excludes remote side IPsec tunnel from firewall rules
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Enable keep alive
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''no'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Toggles the tunnel's keep alive function ON or OFF. When enabled, the instance sends ICMP packets to the specified host at the specified frequency. If no response is received, the instance attempts to restart the connection
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Host
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | host {{!}} ip; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Hostname or IP address to which ICMP packets will be sent to. Best to use a hostname/IP address belonging to the opposite instance's LAN
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Ping period (sec)
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | integer [0..9999999]; Default: " "
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | The period (in seconds) at which ICMP packets will be sent to the specified keep alive host
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Allow WebUI access
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''no'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Allows WebUI access for hosts from the opposite instance
|-
|}
 
===Phase 1/Phase 2===
----
'''Phase''' 1 and '''Phase 2''' must be configured in accordance with the IPSec server configuration, thus algorithms, authentication and lifetimes of each phase must be identical.
 
 
[[Image:Services vpn ipsec phase.PNG]]
 
{| class="wikitable"
|+
! style="width: 250px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | FIELD NAME
! style="width: 250px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | VALUE
! style="width: 579px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | DESCRIPTION
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Encryption algorithm
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | DES {{!}} 3DES {{!}} AES 128 {{!}} AES 192 {{!}} AES256; Default: '''3DES'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | The encryption algorithm must match with another incoming connection
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Authentication
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | MD5 {{!}} SHA1 {{!}} SHA256 {{!}} SHA384 {{!}} SHA512; Default: '''SHA1'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | The authentication algorithm must match with another incoming connection
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Has algorithm
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | MD5 {{!}} SHA1 {{!}} SHA256 {{!}} SHA384 {{!}} SHA512; Default: '''SHA1'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | The hash algorithm must match with another incoming connection
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | DH group
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | MODP768 {{!}} MODP1024 {{!}} MODP1536 {{!}} MODP2048 {{!}} MODP3072 {{!}} MODP4096; Default: '''MODP1536'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | The DH (Diffie-Helman) group must match with another incoming connection
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | PFS group
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | MODP768 {{!}} MODP1024 {{!}} MODP1536 {{!}} MODP2048 {{!}} MODP3072 {{!}} MODP4096 {{!}} No PFS; Default: '''MODP1536'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | The PFS (Perfect Forward Secrecy) group must match with another incoming connection
|-
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Lifetime
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | time; Default: '''8 hours'''
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Duration for the phase
|-
|}
 
==GRE Tunnel==
 
'''GRE''' (Generic Routing Encapsulation RFC2784) is a solution for tunneling RFC1812 private address-space traffic over an intermediate TCP/IP network such as the Internet. GRE tunneling does not use encryption it simply encapsulates data and sends it over the wide area network (WAN).
 
 
[[Image:Services vpn gre tunnel scheme.PNG]]
 
In the example network diagram two distant networks LAN1 and LAN2 are connected. To create A GRE tunnel the user must know the following parameters:
 
* Source and destination IP addresses
* Tunnel’s local IP address
* Distant network’s IP address and Subnet mask
 
To create a new GRE instance, go to the GRE Tunnel tab, type in a name for your new instance in the text field below the GRE Tunnel tab and press the '''Add New''' button next to it.
The newly created instance will be disabled and unconfigured. To configure it press the '''Edit''' button located next to it. This action will redirect you to the instance’s GRE Tunnel Configuration window.
 
 
[[Image:Services vpn gre tunnel configuration.PNG]]
 
{| class="wikitable"
|+
! style="width: 250px; background: black; color: white;"  | Field name
! style="width: 250px; background: black; color: white;"  | Value
! style="width: 1200px; background: black; color: white;" | Description
|-
! style="text-align: left; vertical-align: top;" | Enabled
| style="text-align: left; vertical-align: top;" | yes {{!}} no; Default: '''no'''
| style="text-align: left; vertical-align: top;" | Toggles GRE Tunnel ON or OFF
|-
! style="text-align: left; vertical-align: top;" | Remote endpoint IP address
| style="text-align: left; vertical-align: top;" | host {{!}} ip; Default: " "
| style="text-align: left; vertical-align: top;" | WAN IP address or hostname of the remote GRE Tunnel instance
|-
! style="text-align: left; vertical-align: top;" | Remote network
| style="text-align: left; vertical-align: top;" | ip; Default: " "
| style="text-align: left; vertical-align: top;" | LAN IP address of the remote device
|-
! style="text-align: left; vertical-align: top;" | Remote network netmask
| style="text-align: left; vertical-align: top;" | integer [0..32]; Default: " "
| style="text-align: left; vertical-align: top;" | LAN netmask of the remote device
|-
! style="text-align: left; vertical-align: top;" | Local tunnel IP
| style="text-align: left; vertical-align: top;" | ip; Default: " "
| style="text-align: left; vertical-align: top;" | Local virtual IP address. Can’t be in the same subnet as LAN network
|-
! style="text-align: left; vertical-align: top;" | MTU
| style="text-align: left; vertical-align: top;" | integer [0..1500]; Default: '''1476'''
| style="text-align: left; vertical-align: top;" | The maximum transmission unit in bytes
|-
! style="text-align: left; vertical-align: top;" | TTL
| style="text-align: left; vertical-align: top;" | integer [0..255]; Default: '''255'''
| style="text-align: left; vertical-align: top;" | Fixed time-to-live (TTL) value on tunneled packets. The 0 is a special value meaning that packets inherit the TTL value
|-
! style="text-align: left; vertical-align: top;" | PMTUD
| style="text-align: left; vertical-align: top;" | yes {{!}} no; Default: '''no'''
| style="text-align: left; vertical-align: top;" | Toggles the Path Maximum Transmission Unit Discovery (PMTUD) status on this tunnel ON or OFF
|-
! style="text-align: left; vertical-align: top;" | Redirect LAN to GRE
| style="text-align: left; vertical-align: top;" | yes {{!}} no; Default: '''no'''
| style="text-align: left; vertical-align: top;" | Redirects LAN traffic to the GRE interface
|-
! style="text-align: left; vertical-align: top;" | Enable Keep alive
| style="text-align: left; vertical-align: top;" |  yes {{!}} no; Default: '''no'''
| style="text-align: left; vertical-align: top;" | Gives the ability for one side to originate and receive keep alive packets to and from a remote router
|-
! style="text-align: left; vertical-align: top;" | Keep Alive host
| style="text-align: left; vertical-align: top;" | host {{!}} ip; Default: " "
| style="text-align: left; vertical-align: top;" | Keep Alive IP address to send pings to. Preferably this should be an IP address which belongs to the LAN network on the remote device
|-
! style="text-align: left; vertical-align: top;" | Keep alive interval
| style="text-align: left; vertical-align: top;" | integer [0..255]; Default: " "
| style="text-align: left; vertical-align: top;" | Frequency at which ICMP packets are sent by the Keep Alive function (in seconds)
|-
|}
 
To find a more in-depth GRE Tunnel configuration example, visit '''[[GRE Tunnel configuration examples|this page]]
 
==PPTP==
 
'''Point-to-Point Tunneling Protocol (PPTP)''' is a protocol (set of communication rules) that allows corporations to extend their own corporate network through private "tunnels" over the public Internet. Effectively, a corporation uses a wide-area network as a single large local area network. A company no longer needs to lease its own lines for wide-area communication but can securely use the public networks.
 
For a more in-depth configuration example, visit the '''[[PPTP configuration examples]]''' page.
 
===PPTP Client===
----
To create a new PPTP instance, go to the PPTP tab, select the Role (server or client) of your instance, type in a name in the '''New configuration name''' field and press the '''Add''' button next to it. The newly created instance will be disabled and unconfigured. To configure it click the '''Edit''' button located next to it. This action will redirect you to the instance’s PPTP Configuration window.
 
 
[[Image:Services vpn pptp client.PNG]]
 
{| class="wikitable"
|+
! style="width: 250px; background: black; color: white;"  | Field name
! style="width: 250px; background: black; color: white;"  | Value
! style="width: 1200px; background: black; color: white;" | Description
|-
! style="text-align: left; vertical-align: top;" | Enable
| style="text-align: left; vertical-align: top;" | yes {{!}} no; Default: '''no'''
| style="text-align: left; vertical-align: top;" | Toggles PPTP Client ON or OFF
|-
! style="text-align: left; vertical-align: top;" | Use as default gateway
| style="text-align: left; vertical-align: top;" | yes {{!}} no; Default: '''no'''
| style="text-align: left; vertical-align: top;" | Use this PPTP instance as default gateway
|-
! style="text-align: left; vertical-align: top;" | Client to client
| style="text-align: left; vertical-align: top;" | yes {{!}} no; Default: '''no'''
| style="text-align: left; vertical-align: top;" | Toggles client to client on the PPTP tunnel ON or OFF
|-
! style="text-align: left; vertical-align: top;" | Server
| style="text-align: left; vertical-align: top;" | host {{!}} ip; Default: " "
| style="text-align: left; vertical-align: top;" | PPTP server's IP address or hostname
|-
! style="text-align: left; vertical-align: top;" | Username
| style="text-align: left; vertical-align: top;" | string; Default: " "
| style="text-align: left; vertical-align: top;" | User name for authorization with the server
|-
! style="text-align: left; vertical-align: top;" | Password
| style="text-align: left; vertical-align: top;" | string; Default: " "
| style="text-align: left; vertical-align: top;" | Password used for authorization with the server
|-
|}
 
===PPTP Server===
----
[[Image:Services vpn pptp server.PNG]]
 
{| class="wikitable"
|+
! style="width: 250px; background: black; color: white;"  | Field name
! style="width: 250px; background: black; color: white;"  | Value
! style="width: 1200px; background: black; color: white;" | Description
|-
! style="text-align: left; vertical-align: top;" | Enable
| style="text-align: left; vertical-align: top;" | yes {{!}} no; Default: '''no'''
| style="text-align: left; vertical-align: top;" | Toggles PPTP Server ON or OFF
|-
! style="text-align: left; vertical-align: top;" | Local IP
| style="text-align: left; vertical-align: top;" | ip; Default: '''192.168.0.1'''
| style="text-align: left; vertical-align: top;" | Virtual IP Address of this PPTP server
|-
! style="text-align: left; vertical-align: top;" | Remote IP range begin
| style="text-align: left; vertical-align: top;" | ip; Default: '''192.168.0.20'''
| style="text-align: left; vertical-align: top;" | Client IP address leases beginning
|-
! style="text-align: left; vertical-align: top;" | Remote IP range end
| style="text-align: left; vertical-align: top;" | ip; Default: '''192.168.0.30'''
| style="text-align: left; vertical-align: top;" | Client IP address leases end
|-
! style="text-align: left; vertical-align: top;" | User name
| style="text-align: left; vertical-align: top;" | string; Default: '''youruser'''
| style="text-align: left; vertical-align: top;" | Client's user name used for authentication with this server
|-
! style="text-align: left; vertical-align: top;" | Password
| style="text-align: left; vertical-align: top;" | string; Default: '''yourpass'''
| style="text-align: left; vertical-align: top;" | Client's password used for authentication with this server
|-
! style="text-align: left; vertical-align: top;" | PPTP Client's IP
| style="text-align: left; vertical-align: top;" | ip; Default: " "
| style="text-align: left; vertical-align: top;" | Client’s IP address. Leave empty to assign a random IP from the IP range specified above
|-
|}
 
==L2TP==
 
In computer networking, '''Layer 2 Tunneling Protocol (L2TP)''' is a tunneling protocol used to support virtual private networks (VPNs). It is more secure than PPTP but, because it encapsulates the transferred date twice, but it is slower and uses more CPU power.
 
For a more in-depth configuration example, visit the '''[[L2TP configuration examples]]''' page.
 
===L2TP Client===
----
To create a new L2TP instance, go to the L2TP tab, select the Role (server or client) of your instance, type in a name in the '''New configuration name''' field and press the '''Add''' button next to it. The newly created instance will be disabled and unconfigured. To configure it press the '''Edit''' button located next to it. This action will redirect you to the instance’s L2TP Configuration window.
 
 
[[Image:Services vpn l2tp client configuration.PNG]]
 
{| class="wikitable"
|+
! style="width: 250px; background: black; color: white;"  | Field name
! style="width: 250px; background: black; color: white;"  | Value
! style="width: 1200px; background: black; color: white;" | Description
|-
! style="text-align: left; vertical-align: top;" | Enable
| style="text-align: left; vertical-align: top;" | yes {{!}} no; Default: '''no'''
| style="text-align: left; vertical-align: top;" | Toggles L2TP Client ON or OFF
|-
! style="text-align: left; vertical-align: top;" | Server
| style="text-align: left; vertical-align: top;" | host {{!}} ip; Default: " "
| style="text-align: left; vertical-align: top;" | L2TP server's remote IP address or hostname
|-
! style="text-align: left; vertical-align: top;" | Username
| style="text-align: left; vertical-align: top;" | string; Default: " "
| style="text-align: left; vertical-align: top;" | User name used to authenticate you to the L2TP server
|-
! style="text-align: left; vertical-align: top;" | Password
| style="text-align: left; vertical-align: top;" | string; Default: " "
| style="text-align: left; vertical-align: top;" | Password used to authenticate you to the server
|-
|}
 
===L2TP Server===
----
[[Image:Services vpn l2tp server.PNG]]
 
{| class="wikitable"
|+
! style="width: 250px; background: black; color: white;"  | Field name
! style="width: 250px; background: black; color: white;"  | Value
! style="width: 1200px; background: black; color: white;" | Description
|-
! style="text-align: left; vertical-align: top;" | Enable
| style="text-align: left; vertical-align: top;" | yes {{!}} no; Default: '''no'''
| style="text-align: left; vertical-align: top;" | Toggles L2TP Server ON or OFF
|-
! style="text-align: left; vertical-align: top;" | Local IP
| style="text-align: left; vertical-align: top;" | ip; Default: '''192.168.0.1'''
| style="text-align: left; vertical-align: top;" | Virtual IP Address of this L2TP server
|-
! style="text-align: left; vertical-align: top;" | Remote IP range begin
| style="text-align: left; vertical-align: top;" | ip; Default: '''192.168.0.20'''
| style="text-align: left; vertical-align: top;" | Client IP address leases beginning
|-
! style="text-align: left; vertical-align: top;" | Remote IP range end
| style="text-align: left; vertical-align: top;" | ip; Default: '''192.168.0.30'''
| style="text-align: left; vertical-align: top;" | Client IP address leases end
|-
! style="text-align: left; vertical-align: top;" | User name
| style="text-align: left; vertical-align: top;" | string; Default: '''user'''
| style="text-align: left; vertical-align: top;" | Client's user name used for authentication with this server
|-
! style="text-align: left; vertical-align: top;" | Password
| style="text-align: left; vertical-align: top;" | string; Default: '''pass'''
| style="text-align: left; vertical-align: top;" | Client's password used for authentication with this server
|-
|}
 
==See also==
 
* Configuration examples for RUTxxx VPN services:
** [[OpenVPN configuration examples]]
** [[IPsec configuration examples]]
** [[GRE Tunnel configuration examples]]
** [[PPTP configuration examples]]
** [[L2TP configuration examples]]
* Configuration examples for third party VPN services
** [[expressvpn.com VPN configuration|expressvpn.com]]
** [[vpngate.net VPN configuration|vpngate.net]]
** [[Vpnbook.com VPN configuration|vpnbook.com]]
** [[hide.me VPN configuration|hide.me]]
* Other related examples:
** [[How to generate TLS certificates (Windows)?]]
** [[How to generate TLS certificates (Linux)?]]
** [[L2TP over IPsec]]
** [[OpenVPN traffic split]]
** [[OpenVPN client on Windows]]

Latest revision as of 08:03, 9 September 2024

Main Page > General Information > Configuration Examples > VPN

VPN

Retrieved from "https://wiki.teltonika-networks.com/index.php?title=VPN&oldid=132181"