Difference between revisions of "Connecting to the office network remotely from your home via VPN (OpenVPN)"

From Teltonika Networks Wiki
(Created page with "<table class="nd-othertables_2"> <tr> <th width="325;" style="border-bottom: 1px solid white;"></th> <th rowspan="2;" width="820;" style="border-bottom: 1p...")
 
Line 1: Line 1:
 
<table class="nd-othertables_2">
 
<table class="nd-othertables_2">
 
     <tr>
 
     <tr>
−
         <th width="325;" style="border-bottom: 1px solid white;"></th>
+
         <th width=325; style="border-bottom: 1px solid white;></th>
−
         <th rowspan="2;" width="820;" style="border-bottom: 1px solid white;">[[File:Networking rutxxx configuration openvpn topology v1.png|alt=|border|class=tlt-border|right|750x750px]]</th>
+
         <th width=820; style="border-bottom: 1px solid white;" rowspan=2;>
 +
[[File:Networking_RUTX_VPN_between_HQ_topology_v4.png|border|class=tlt-border|750px|right]]</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
         <td style="border-bottom: 1px solid white">
+
         <td style="border-bottom: 1px solid white>
−
{| align="center"
+
{|align=center
 
   |__TOC__
 
   |__TOC__
 
   |}
 
   |}
Line 16: Line 17:
  
 
'''Prerequisites''':
 
'''Prerequisites''':
−
*One Teltonika Networks router of any type
+
* One Teltonika Networks router (In this article RUTX11 will be used)
−
*A Public Static or Public Dynamic IP addresses
+
* A Public Static or Public Dynamic IP addresses
−
*At least one end device with Windows 10
+
* At least one end device with Windows 10
−
<br>The topology above depicts the OpenVPN scheme. - The router with the Public IP address ('''''RUTX11''''') acts as the '''OpenVPN server''' and the '''Windows 10 device''' acts as a '''client'''. OpenVPN connects the networks of '''RUTX11''' and '''Windows 10 clients'''.
+
<br>
 +
The topology above depicts the L2TP/IPsec scheme. - The router with the Public IP address ('''''RUTX11''''') acts as the '''L2TP/IPsec server''' and the '''Windows 10 device''' acts as '''client'''. L2TP connects the networks of '''RUTX11''' and '''Windows 10 client''', IPsec provides the encryption for the L2TP tunnel. Only LAN traffic is going to go through that tunnel, any other WAN traffic won't go through it. This way the VPN tunnel will not be under a huge load and will provide greater speeds.
  
−
When the scheme is realized, home workers will be able to reach the corporation’s internal network with all internal systems, allowing working from home to be possible.
+
When the scheme is realized, home workers will be able to reach corporation’s internal network with all internal systems, allowing working from home to be possible.
  
−
==Configuring OpenVPN from the client-side ==
+
==Configuring HQ corporation router==
−
===TLS Certificates===
+
===L2TP===
−
*Firstly generate TLS certificates on your Windows Computer, you can find instructions on how to do it [[How to generate TLS certificates (Windows)?|here]].
+
----
−
*After you've successfully generated TLS certificates you will need to create a '''.ovpn''' file for storing client configurations. Simply open any text editor and follow [[OpenVPN client on Windows|this]] tutorial.
 
−
*'''Important: in your .ovpn file certificates you will need to copy are:'''
 
−
*In '''<ca> </ca>''' paste whole certificate from '''/easy-rsa/pki/ca.crt'''
 
−
*IN '''<cert></cert>''' paste whole certificate from '''/easy-rsa/pki/issued/"your_client_name".crt'''
 
−
* And in the last section '''<key></key>''' paste whole private key from '''/easy-rsa/pki/private/"your_client_name".key'''
 
−
*One more thing to change in your .ovpn file is to change the IP address to your router's '''public IP address'''
 
−
[[File:Networking rutxxx configuration openvpn certification file.jpg|alt=|border|class=tlt-border]]
 
  
−
*Now you can '''Save''' and '''Import''' your '''.ovpn''' file to the OpenVPN client by right-clicking on OpenVPN GUI in the hidden icons tray and navigating to '''Import → Import File'''.
+
<table class="nd-othertables_2">
−
[[File:Networking rutxxx configuration certificate import.jpg|alt=|border|class=tlt-border]]
+
    <tr>
 +
        <th width=355; style="border-bottom: 1px solid white;></th>
 +
        <th width=790; style="border-bottom: 1px solid white;" rowspan=2> [[File:Networking_rutx_configuration_examples_l2tp_over_ipsec_windows_10_1_v1.png|770px|right]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 1px solid white;>
 +
Login to the router's WebUI and navigate to the '''Services → VPN → L2TP''' page and do the following:
 +
<ol>
 +
    <li>Select '''Role: Server'''.</li>
 +
    <li>Enter a '''custom configuration name'''.</li>
 +
    <li>Click the '''Add''' button.</li>
 +
    <li>Click the '''Edit''' button next to the newly created L2TP instance.</li>
 +
</ol>
 +
        </td>
 +
    </tr>
 +
</table>
  
−
Do not connect yet to your VPN client, we still have to configure the server.
+
----
  
−
==Configuring OpenVPN from the server-side==
 
 
<table class="nd-othertables_2">
 
<table class="nd-othertables_2">
 
     <tr>
 
     <tr>
−
         <th width="355;" style="border-bottom: 1px solid white;"></th>
+
         <th width=355; style="border-bottom: 1px solid white;></th>
−
         <th rowspan="2" width="790;" style="border-bottom: 1px solid white;">[[File:Networking rutxxx configuration ovpn server creation.jpg|alt=|right|770x770px]]</th>
+
         <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutx_configuration_examples_l2tp_over_ipsec_windows_10_2_v1.png|770px|right]]</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
         <td style="border-bottom: 1px solid white;">
+
         <td style="border-bottom: 1px solid white>
−
Login to the router's WebUI and navigate to the '''Services → VPN → OPENVPN''' page and do the following:
 
 
<ol>
 
<ol>
−
     <li>Enter a '''custom configuration name'''</li>
+
    <li>'''Enable''' the L2TP instance.</li>
−
     <li>Select '''Role: Server'''.
+
     <li>Enter a '''User name''' and '''Password''' for authentication for the client.</li>
−
</li>
+
    <li>Optionaly, set a fixed IP for this client (if left empty, client will receive first free IP from the IP range).</li>
−
    <li>Click the '''Add''' button.</li>
+
     <li>Don't forget to '''Save''' the changes.</li>
−
    <li>Click the '''Edit''' button next to the newly created OpenVPN instance.</li>
+
</ol>
 +
        </td>
 +
    </tr>
 +
</table>
 +
 
 +
===IPsec===
 +
----
 +
 
 +
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=355; style="border-bottom: 1px solid white;></th>
 +
        <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutx_configuration_examples_l2tp_over_ipsec_windows_10_3_v1.png|770px|right]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 1px solid white>
 +
Go to the '''Services → VPN → IPsec''' page and do the following:
 +
<ol>   
 +
      <li>Enter a custom name for the IPsec instance.</li>
 +
      <li>Click the '''Add''' button.</li>
 +
      <li>Click the '''Edit''' button next to the newly created instance.</li>
 +
</ol>
 +
        </td>
 +
    </tr>
 +
</table>
 +
 
 +
----
 +
 
 +
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=355; style="border-bottom: 1px solid white;></th>
 +
        <th width=790; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutx_configuration_examples_l2tp_over_ipsec_windows_10_4_v1.png|770px|right]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 1px solid white>
 +
In the '''IPsec Configuration''' page, do the following (and leave the rest as defaults, unless your specific configuration requires otherwise):
 +
<ol>   
 +
      <li>'''Enable''' the instance.</li>
 +
      <li>Enter your '''Pre-shared key'''.</li>
 +
      <li>Select '''Type: Transport'''.</li>
 +
      <li>'''Save''' changes.</li>
 
</ol>
 
</ol>
 +
        </td>
 +
    </tr>
 +
</table>
 +
 +
==Home worker’s computer==
 +
 +
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=525; style="border-bottom: 1px solid white;"></th>
 +
        <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_6_v2.png|border|class=tlt-border|550px|right]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 1px solid white>
 +
Type '''VPN settings''' in the Windows search bar:
 +
        </td>
 +
    </tr>
 +
</table>
 +
 +
----
 +
 +
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=525; style="border-bottom: 1px solid white;"></th>
 +
        <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_7_v2.png|border|class=tlt-border|550px|right]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 1px solid white>
 +
Click the '''Add a VPN connection''' button:
 +
        </td>
 +
    </tr>
 +
</table>
 +
 +
----
 +
 +
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=525; style="border-bottom: 1px solid white;"></th>
 +
        <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_8_v2.png|border|class=tlt-border|550px|right]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 1px solid white>
 +
Configure the following parameters:
 +
        <ol>
 +
            <li>Select '''VPN provider: Windows (built-in)'''.</li>
 +
            <li>Enter a custom '''Connection name'''.</li>
 +
            <li>Enter the router's WAN IP address into the '''Server name or address''' field.</li>
 +
            <li>Select '''VPN type: L2TP/IPsec with pre-shared key'''.</li>
 +
            <li>Enter the '''Pre-shared key''' exactly as it was specified on the router.</li>
 +
            <li>Select '''Type of sign-in info: User name and password'''.</li>
 +
            <li>Enter the '''User name''' and '''Password''' exactly as they were specified on the router.</li>
 +
            <li>Click '''Save'''</li>
 +
        </ol>
 
         </td>
 
         </td>
 
     </tr>
 
     </tr>
Line 61: Line 160:
 
----
 
----
  
−
<br>
+
<table class="nd-othertables_2">
−
----<table class="nd-othertables_2">
 
 
     <tr>
 
     <tr>
−
         <th width="355;" style="border-bottom: 1px solid white;"></th>
+
         <th width=525; style="border-bottom: 1px solid white;"></th>
−
         <th rowspan="2" width="790;" style="border-bottom: 1px solid white;">[[File:Networking rutxxx configuration ovpn settings.jpg|alt=|border|right|770x770px]]</th>
+
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_11_v2.png|border|class=tlt-border|550px|right]]</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
         <td style="border-bottom: 1px solid white">
+
         <td style="border-bottom: 1px solid white>
−
<ol>
+
Type '''Network Connections''' in the Windows search bar:
−
    <li>'''Enable''' OpenVPN instance.</li>
 
−
    <li>Change '''Authentication''' to '''TLS'''
 
−
</li>
 
−
    <li>Change '''Encryption''' to '''AES-256-GCM 256'''
 
−
</li><li>Change '''Keep alive''' to '''5 10'''
 
−
</li><li>In '''Virtual network IP address''' type: '''192.168.15.0'''
 
−
</li><li>'''Virtual network netmask''' select: '''255.255.255.0'''
 
−
</li><li>Leave everything else default
 
−
</li></ol>
 
 
         </td>
 
         </td>
 
     </tr>
 
     </tr>
 +
</table>
  
 +
----
 +
 +
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=525; style="border-bottom: 1px solid white;"></th>
 +
        <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_12_v2.png|border|class=tlt-border|550px|right]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 1px solid white>
 +
Press right mouse click on your newly created VPN instance and select '''Properties''':
 +
        </td>
 +
    </tr>
 
</table>
 
</table>
−
<br>
+
 
−
----<table class="nd-othertables_2">
+
----
 +
 
 +
<table class="nd-othertables_2">
 
     <tr>
 
     <tr>
−
         <th width="355;" style="border-bottom: 1px solid white;"></th>
+
         <th width=525; style="border-bottom: 1px solid white;"></th>
−
         <th rowspan="2" width="790;" style="border-bottom: 1px solid white;">[[File:Networking rutxxx configuration ovpn configuration.jpg|alt=|border|right|770x770px]]</th>
+
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_13_v2.png|border|class=tlt-border|550px|right]]</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
         <td style="border-bottom: 1px solid white">
+
         <td style="border-bottom: 1px solid white>
−
<ol>
+
Navigate to '''Networking''' section and double click '''Internet Protocol Version 4 (TCP/IPv4)''':
−
    <li>The last thing left to do is to upload '''Certificates''', firstly upload '''Certificate authority''' ('''ca.crt''' file)</li>
 
−
    <li>Upload '''Server certificate''' ('''server.crt''' file)
 
−
</li>
 
−
    <li>Upload '''Server key''' ('''server.key''' file)
 
−
</li>
 
−
    <li>Now upload '''Diffie Hellman parameters''' ('''dh.pem''' file)
 
−
</li>
 
−
    <li>Press '''SAVE & APPLY''' button
 
−
</li></ol>
 
 
         </td>
 
         </td>
 
     </tr>
 
     </tr>
 
</table>
 
</table>
 +
 
----
 
----
−
==Connecting to the OpenVPN server ==
 
  
−
If everything was configurated correctly your OpenVPN server should be '''Active''':
+
<table class="nd-othertables_2">
−
[[File:Networking rutxxx configuration ovpn active state.jpg|alt=|border|1008x1008px|class=tlt-border]]
+
    <tr>
 +
        <th width=525; style="border-bottom: 1px solid white;"></th>
 +
        <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_14_v2.png|border|class=tlt-border|550px|right]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 1px solid white>
 +
Go to '''Advanced''' settings:
 +
        </td>
 +
    </tr>
 +
</table>
  
−
Now let's try to connect from a '''client''' to the '''server'''.
+
----
  
−
On your Windows machine right-click on '''OpenVPN GUI''' '''→''' Select your client → Press Connect
+
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=525; style="border-bottom: 1px solid white;"></th>
 +
        <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_15_v2.png|border|class=tlt-border|550px|right]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 1px solid white>
 +
Now disable '''Use default gateway on remote network''' and save settings:
 +
        </td>
 +
    </tr>
 +
</table>
  
−
[[File:Networking rutxxx configuration openvpn connect to the client.jpg|alt=|border|class=tlt-border]]
+
----
  
−
If the connection was successful then you will get the following notification:
+
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=525; style="border-bottom: 1px solid white;"></th>
 +
        <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_9_v2.png|border|class=tlt-border|550px|right]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 1px solid white>
 +
Go back to the VPN settings page, locate your new connection and click the '''Connect''' button. If the connection was successful, you should see the word '''"Connected"''' appear under the connection name:
 +
        </td>
 +
    </tr>
 +
</table>
  
−
[[File:Networking rutxxx configuration successful connection.jpg|alt=|border|class=tlt-border]]
+
==Results==
  
−
To test if the connection is working properly on your Windows machine open '''CMD''' and type ping '''192.168.15.1''' (server's VPN IP) you should get a similar response:
+
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=525; style="border-bottom: 1px solid white;></th>
 +
        <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_10_v2.png|border|class=tlt-border|550px|right]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 1px solid white>
 +
Home worker should now be able to access HQ network resources.
 +
To verify the connection you can ping some internal HQ server and if you get a reply, you have successfully connected to HQ‘s internal network.
  
−
[[File:Networking rutxxx configuration cmd ping to the server.jpg|alt=|border|class=tlt-border]]
+
        </td>
 +
    </tr>
 +
</table>

Revision as of 13:56, 20 October 2022

Main Page > General Information > Configuration Examples > Use cases > Connecting to the office network remotely from your home via VPN (OpenVPN)
Networking RUTX VPN between HQ topology v4.png

Configuration overview and prerequisites

Prerequisites:

  • One Teltonika Networks router (In this article RUTX11 will be used)
  • A Public Static or Public Dynamic IP addresses
  • At least one end device with Windows 10


The topology above depicts the L2TP/IPsec scheme. - The router with the Public IP address (RUTX11) acts as the L2TP/IPsec server and the Windows 10 device acts as client. L2TP connects the networks of RUTX11 and Windows 10 client, IPsec provides the encryption for the L2TP tunnel. Only LAN traffic is going to go through that tunnel, any other WAN traffic won't go through it. This way the VPN tunnel will not be under a huge load and will provide greater speeds.

When the scheme is realized, home workers will be able to reach corporation’s internal network with all internal systems, allowing working from home to be possible.

Configuring HQ corporation router

L2TP

Networking rutx configuration examples l2tp over ipsec windows 10 1 v1.png

Login to the router's WebUI and navigate to the Services → VPN → L2TP page and do the following:

  1. Select Role: Server.
  2. Enter a custom configuration name.
  3. Click the Add button.
  4. Click the Edit button next to the newly created L2TP instance.
Networking rutx configuration examples l2tp over ipsec windows 10 2 v1.png
  1. Enable the L2TP instance.
  2. Enter a User name and Password for authentication for the client.
  3. Optionaly, set a fixed IP for this client (if left empty, client will receive first free IP from the IP range).
  4. Don't forget to Save the changes.

IPsec

Networking rutx configuration examples l2tp over ipsec windows 10 3 v1.png

Go to the Services → VPN → IPsec page and do the following:

  1. Enter a custom name for the IPsec instance.
  2. Click the Add button.
  3. Click the Edit button next to the newly created instance.
Networking rutx configuration examples l2tp over ipsec windows 10 4 v1.png

In the IPsec Configuration page, do the following (and leave the rest as defaults, unless your specific configuration requires otherwise):

  1. Enable the instance.
  2. Enter your Pre-shared key.
  3. Select Type: Transport.
  4. Save changes.

Home worker’s computer

Networking rutxxx configuration examples l2tp over ipsec windows 10 6 v2.png

Type VPN settings in the Windows search bar:

Networking rutxxx configuration examples l2tp over ipsec windows 10 7 v2.png

Click the Add a VPN connection button:

Networking rutxxx configuration examples l2tp over ipsec windows 10 8 v2.png

Configure the following parameters:

  1. Select VPN provider: Windows (built-in).
  2. Enter a custom Connection name.
  3. Enter the router's WAN IP address into the Server name or address field.
  4. Select VPN type: L2TP/IPsec with pre-shared key.
  5. Enter the Pre-shared key exactly as it was specified on the router.
  6. Select Type of sign-in info: User name and password.
  7. Enter the User name and Password exactly as they were specified on the router.
  8. Click Save
Networking rutxxx configuration examples l2tp over ipsec windows 10 11 v2.png

Type Network Connections in the Windows search bar:

Networking rutxxx configuration examples l2tp over ipsec windows 10 12 v2.png

Press right mouse click on your newly created VPN instance and select Properties:

Networking rutxxx configuration examples l2tp over ipsec windows 10 13 v2.png

Navigate to Networking section and double click Internet Protocol Version 4 (TCP/IPv4):

Networking rutxxx configuration examples l2tp over ipsec windows 10 14 v2.png

Go to Advanced settings:

Networking rutxxx configuration examples l2tp over ipsec windows 10 15 v2.png

Now disable Use default gateway on remote network and save settings:

Networking rutxxx configuration examples l2tp over ipsec windows 10 9 v2.png

Go back to the VPN settings page, locate your new connection and click the Connect button. If the connection was successful, you should see the word "Connected" appear under the connection name:

Results

Networking rutxxx configuration examples l2tp over ipsec windows 10 10 v2.png

Home worker should now be able to access HQ network resources. To verify the connection you can ping some internal HQ server and if you get a reply, you have successfully connected to HQ‘s internal network.

Retrieved from "https://wiki.teltonika-networks.com/index.php?title=Connecting_to_the_office_network_remotely_from_your_home_via_VPN_(OpenVPN)&oldid=97377"