Template:Networking rutos manual vpn: Difference between revisions

To begin configuration, click the button that looks like a pencil next to the client instance. Refer to the figure and table below for information on the OpenVPN client's configuration fields:

<table class="nd-mantable">

       <td>Yes {{!}} No {{!}} None; default: <b>None</b></td>

       <td>Turns LZO data compression on or off.</td>

     </tr>

     <tr>

     <td>Authentication</td>

         <td>Authentication mode, used to secure data sessions.

             <ul>

             </ul>

         </td>

     </tr>

     <tr>

     </tr>

     <tr>

     </tr>

     <tr>

     </tr>

     <tr>

     </tr>

   <tr>

   </tr>

     <tr>

     </tr>

     <tr>

         <td>Client certificate is a type of digital certificate that is used by client systems to make authenticated requests to a remote server. Client certificates play a key role in many mutual authentication designs, providing strong assurances of a requester's identity.</td>

     </tr>

To begin configuration, click the button that looks like a pencil next to the server instance. Refer to the figure and table below for information on the OpenVPN server's configuration fields:

<table class="nd-mantable">

                 <li><b>User Datagram Protocol</b> (<b>UDP</b>) - packets are sent to the recipient without error-checking or back-and-forth quality control, meaning that when packets are lost, they are gone forever. This makes it less reliable but faster than TCP; therefore, it should be used when transfer speed is crucial (for example, video streaming, live calls).</li>

             </ul>

     </tr>

     <tr>

       <td>Yes {{!}} No {{!}} None; default: <b>None</b></td>

       <td>Turns LZO data compression on or off.</td>

     </tr>

     <tr>

     <td>Authentication</td>

         <td>Authentication mode, used to secure data sessions.

             <ul>

                     </ul>All mentioned certificates can be generated using OpenVPN or Open SSL utilities on any type of host machine. One of the most popular utilities used for this purpose is called Easy-RSA.

                 </li>

                 <li><b>TLS/Password</b> uses both TLS and username/password authentication.</li>

             </ul>

     </tr>

     <tr>

         <td>ip; default: <b>none</b></td>

         <td>IP address of the local OpenVPN network interface.</td>

     </tr>

     <tr>

     </tr>

     <tr>

     </tr>

     <tr>

To begin configuration, click the button that looks like a pencil located next to the instance. Refer to the figure and table below for information on the fields located in the GRE instance configuration section.

<table class="nd-mantable">

     <tr>

       <td>Tunnel source</td>

       <td>Network interface used to establish the GRE Tunnel.</td>

     </tr>

     <tr>

       <td>MTU</td>

       <td>Sets the maximum transmission unit (MTU) size. It is the largest size of a protocol data unit (PDU) that can be transmitted in a single network layer transaction.</td>

     </tr>

     <tr>

     <tr>

     <td>Path MTU Discovery</td>

         <td>When unchecked, sets the <i>nopmtudisc</i> option for tunnel. Can not be used together with the TTL option.</td>

     </tr>

     <tr>

     <td>Keep alive</td>

         <td>Turns "keep alive" on or off. The "keep alive" feature sends packets to the remote instance in order to determine the health of the connection. If no response is received, the device will attempt to re-establish the tunnel.</td>

     </tr>

     <tr>

         <td>integer [0..255]; default: <b>none</b></td>

         <td>Frequency (in seconds) at which "keep alive" packets are sent to the remote instance.</td>

     <tr>

       <td>Authentication method</td>

       <td>Specify authentication method. Choose between Pre-shared key and X.509 certificates.</td>

     </tr>

         <td>A shared password used for authentication between IPsec peers before a secure channel is established.</td>

     </tr>

         <td><span style="color:darkred">Certificate files from device</span></td>

         <td>off {{!}} on; default: <b>off</b></td>

     <tr>

       <td>Type</td>

       <td>IPSec secret type.</br><b>NOTE:</b> XAUTH secrets are IKEv1 only.</td>

     </tr>

----

<table class="nd-mantable">

             </ul>

         </td>

     </tr>

</table>

     <tr>

       <td>Tunnel source</td>

       <td>Network interface used to establish the GRE Tunnel.</td>

     </tr>

     <tr>

     <td>DH/PFS group</td>

         <td>Diffie-Hellman (DH) group used in the key exchange process. Higher group numbers provide more security, but take longer and use more resources to compute the key. Must match with another incoming connection to establish IPSec. </td>

     </tr>

     <tr>

       <td>NHRP network ID</td>

       <td>An identifier used to define the NHRP domain. This is a local parameter and its value does not need to match the values specified on other domains. However, the NHRP ID is added to packets which arrive on the GRE interface; therefore, it may be helpful to use the same ID for troubleshooting purposes.</td>

     </tr>

     <tr>

       <td>NHRP hold time</td>

       <td>Specifies the holding time for NHRP Registration Requests and Resolution Replies sent from this interface or shortcut-target. The hold time is specified in seconds and defaults to two hours.</td>

     </tr>

In computer networking, <b>Layer 2 Tunneling Protocol</b> (<b>L2TP</b>) is a tunneling protocol used to support virtual private networks (VPNs). It is more secure than PPTP but, because it encapsulates the transferred data twice, but it is slower and uses more CPU power.

----

An <b>L2TP client</b> is an entity that initiates a connection to an L2TP server. To create a new client instance, go to the <i>Services → VPN → L2TP</i> section, select <i>Role: Client</i>, enter a custom name and click the 'Add' button. An L2TP client instance with the given name will appear in the "L2TP Configuration" list.

To begin configuration, click the button that looks like a pencil next to the client instance. Refer to the figure and table below for information on the L2TP client's configuration fields:

<table class="nd-mantable">

     </tr>

     <tr>

       <td>off {{!}} on; default: <b>off</b></td>

       <td>When turned on, this connection will become device default route. This means that all traffic directed to the Internet will go through the L2TP server and the server's IP address will be seen as this device's source IP to other hosts on the Internet.{{#ifeq:{{{series}}}|RUTX|<br><b>NOTE</b>: this can only be used when [[{{{name}}} Failover|Failover]] is turned off.}}</td>

</table>

----

An <b>L2TP server</b> is an entity that waits for incoming connections from L2TP clients. To create a new server instance, go to the <i>Services → VPN → L2TP</i> section, select <i>Role: Server</i>, enter a custom name and click the 'Add' button. An L2TP server instance with the given name will appear in the "L2TP Configuration" list. Only one L2TP server instance is allowed to be added.

To begin configuration, click the button that looks like a pencil next to the server instance. Refer to the figure and table below for information on the L2TP server's configuration fields:

<table class="nd-mantable">

       <td>ip; default: <b>192.168.0.30</b></td>

       <td>L2TP IP address leases will end with the address specified in this field.</td>

     </tr>

     <tr>

       <td>Must be specified in hexidecimal form and be length of 8 or 16. eg.: 89ABCDEF. It must match other end Cookie.</td>

     </tr>

     </tr>

     <tr>

     </tr>

     <tr>

     </tr>

     <tr>

Private keys and generate them, specify Port and IP addresses for communication.

<table class="nd-mantable">

     <tr>

     <td>Private Key</td>

     </tr>

     <tr>

       <td>Public Key</td>

         <td>Public Key used in authentication.</td>

     </tr>

     <tr>

     <td>Listen Port</td>

         <td>Specify port to listen for incomming connections. It will be set to a random integer if left empty.</td>

     </tr>