Changes

'''Prerequisites''':

'''Prerequisites''':

* Two RUTxxx routers of any type (excluding [[RUT850]])

* Two RUTxxx routers of any type (excluding [[RUT850]])

* Both routers must have a Public Static or Public Dynamic IP addresses

* At least one router must have a Public Static or Public Dynamic IP address

* At least one end device (PC, Laptop, Tablet, Smartphone) to configure the routers

* At least one end device (PC, Laptop, Tablet, Smartphone) to configure the routers

* (Optional) A second end device to configure and test remote LAN access

* (Optional) A second end device to configure and test remote LAN access

There will be two IPsec configuration schemes presented. Although the second scheme is only an extension of the first one. Therefore, to configure the second scheme, you will have to configure the first as well.

There will be two IPsec configuration schemes presented. Although the second scheme is only an extension of the first one. Therefore, to configure the second scheme, you will have to configure the first as well.

'''configuration scheme 1''':

'''Configuration scheme 1''':

[[File:Configuration examples ipsec scheme 1.png]]

[[File:Configuration examples ipsec scheme 1.png]]

The figure above above depicts two RUTxxx routers (RUT1 and RUT2) connected by an IPsec tunnel via the Internet.

The figure above depicts two RUTxxx routers (RUT1 and RUT2) connected by an IPsec tunnel via the Internet.

----

----

'''configuration scheme 2''':

'''Configuration scheme 2''':

[[File:Configuration examples ipsec scheme.png]]

[[File:Configuration examples ipsec scheme 2.png]]

As mentioned earlier,''configuration scheme 2'' (figure above) is an extension of ''configuration scheme 1''. While ''configuration scheme 1'' only depicts a connection between two IPsec instances, you can see that in ''configuration scheme 2'' additionally contains two end devices ('''END1''' and '''END2'''), each connected to a separate router's LAN. When this scheme is realized, not only will the two routers be able to communicate with each other, the end devices will also be reachable to one another and from each router.

As mentioned earlier, ''configuration scheme 2'' (figure above) is an extension of ''configuration scheme 1''. While ''configuration scheme 1'' only depicts a connection between two IPsec instances, you can see that ''configuration scheme 2'' additionally contains two end devices ('''END1''' and '''END2'''), each connected to a separate router's LAN. When this scheme is realized, not only will the two routers be able to communicate with each other, but the end devices will also be reachable to one another and from each router.

It should also be noted the connection type used is '''Tunnel''' and not '''Transport'''. Tunnel protects the internal routing information by encrypting the IP header of the original packet. The original packet is encapsulated by a another set of IP headers. Transport encrypts only the payload and Encapsulating Security Payload (ESP) trailer; so the IP header of the original packet is not encrypted. Transport mode is usually used when another tunneling protocol (such as [[VPN#GRE_Tunnel|GRE]], [[VPN#L2TP|L2TP]]) is used to first encapsulate the IP data packet, then IPsec is used to protect the GRE/L2TP tunnel packets.

It should also be noted the connection type used is '''Tunnel''' and not '''Transport'''. Tunnel protects the internal routing information by encrypting the IP header of the original packet. The original packet is encapsulated by a another set of IP headers. Transport encrypts only the payload and Encapsulating Security Payload (ESP) trailer; so the IP header of the original packet is not encrypted. Transport mode is usually used when another tunneling protocol (such as [[VPN#GRE_Tunnel|GRE]], [[VPN#L2TP|L2TP]]) is used to first encapsulate the IP data packet, then IPsec is used to protect the GRE/L2TP tunnel packets.

Tunnel is more is more widely implemented in site-to-site VPN scenarios and supports NAT traversal, that's why we chose it for the example.

Tunnel is more widely implemented in site-to-site VPN scenarios and supports NAT traversal. For instructions on how to configure Transport mode, you may want to check out our '''[[L2TP over IPsec]]''' article.

==Router configuration==

==Router configuration==

* You will be redirected to the instance's configuration window. From here we will discuss how to configure both instances (''RUT1'' and ''RUT2''). Creating a second instance is analogous to how we created the first one - just login to the second router and repeat the first two steps. Although not mandatory, we recommend that you use a distinct name for the second instance (for this example we use ''RUT2'') for easier management purposes. <br> The specifics of both configurations are described in the figure below:

* You will be redirected to the instance's configuration window. From here we will discuss how to configure both instances (''RUT1'' and ''RUT2''). Creating a second instance is analogous to how we created the first one - just login to the second router and repeat the first two steps. Although not mandatory, we recommend that you use a distinct name for the second instance (for this example we use ''RUT2'') for easier management purposes. <br> The specifics of both configurations are described in the figure below:

[[File:Creating an ipsec instance part 3 v2.png]]

[[File:Creating an ipsec instance part 3 v3.png|1150px]]

* Below are explanations of the parameters highlighted in the figure above. Other parameters (not highlighted) are defaults. You can find descriptions for these parameters in the '''[[VPN#IPsec|VPN manual page, IPsec section]]'''.

* Below are explanations of the parameters highlighted in the figure above. Other parameters (not highlighted) are defaults. You can find descriptions for these parameters in the '''[[VPN#IPsec|VPN manual page, IPsec section]]'''

** '''Enable''' - enables the IPsec instance

** '''Enable''' - enables the IPsec instance

** '''Local IP address/Subnet mask''' - LAN IP address/Subnet mask of the router on which the IPsec instance is configured

** '''Local IP address/Subnet mask''' - LAN IP address/Subnet mask of the router on which the IPsec instance is configured

'''NOTE''': remember to replace certain parameter values (like IP addresses) with your own relevant data.

'''NOTE''': remember to replace certain parameter values (like IP addresses) with your own relevant data.

----

----

* The last in configuring the IPsec intances is '''Phase settings'''. For this example we left the default Phase settings. If you're planning to change Phase settings, make sure they match with the Phase settings of the incoming connection:

* The last step in configuring the IPsec instances is '''Phase settings'''. For this example we left the default Phase settings. If you're planning to change Phase settings, make sure they match with the Phase settings (both Phase 1 and Phase 2) of the incoming connection:

[[File:Creating an ipsec instance part 4 v1.png]]

[[File:Creating an ipsec instance part 4 v2.png|1150px]]

When you're finished with the configuration, don't forget to click the "Save" button.

When you're finished with the configuration, don't forget to click the "Save" button.

===Remote LAN access===

<!--===Remote LAN access===

----

----

First of, lets configure a simple connection between two IPsec instances, i.e., RUT1 and RUT2 as described above in configuration scheme 1.  

Once your IPsec tunnel is operational, you can configure remote access to LAN devices via the tunnel as referenced in ''[[IPsec_configuration_examples#Configuration_overview_and_prerequisites|configuration scheme 2]]''. This section provides a description on how to do just that.

* In order for the remote LAN access to work, we'll need to add a couple of static routes - one in each router. Login to a router's WebUI and navigate to '''Network → Routing → Static Routes'''. Continuing our example, below is figure depicting the static route configuration for '''RUT1''':

 

* To sum up, for our current purposes select '''MAIN''' Routing table and '''LAN''' interface in both routers; under Destination address, specify the LAN address of the opposite router; under Netmask, specify '''255.255.255.0''' unless your configuring a different size network (more on Netmasks '''[[What_is_a_Netmask%3F|here]]'''); under Gateway, specify the current router's LAN IP address; you can leave the Metric as 0 unless your own specific configuration requires otherwise.

 

'''NOTE''': make sure to add a new entry in the Static Routes table when you configure custom routes. You can configure existing routes, but take note that this may cause backup WAN to function improperly or not at all.

 

==Testing the setup==

==Testing the setup==

==See also==

==See also==

* Other types of VPNs suported by RUTxxx devices:

* Other types of VPNs suported by RUTxxx devices:

** [[OpenVPN configuration examples]]

** [[OpenVPN configuration examples]]

** [[PPTP configuration examples]]

** [[PPTP configuration examples]]

** [[L2TP configuration examples]]

** [[L2TP configuration examples]]