Changes

'''Prerequisites''':

'''Prerequisites''':

* Two RUTxxx routers of any type (excluding [[RUT850]])

* Two RUTxxx routers of any type (excluding [[RUT850]])

* Both routers must have a Public Static or Public Dynamic IP addresses

* At least one router must have a Public Static or Public Dynamic IP address

* At least one end device (PC, Laptop, Tablet, Smartphone) to configure the routers

* At least one end device (PC, Laptop, Tablet, Smartphone) to configure the routers

* (Optional) A second end device to configure and test remote LAN access

* (Optional) A second end device to configure and test remote LAN access

[[File:Configuration examples ipsec scheme 1.png]]

[[File:Configuration examples ipsec scheme 1.png]]

The figure above above depicts two RUTxxx routers (RUT1 and RUT2) connected by an IPsec tunnel via the Internet.

The figure above depicts two RUTxxx routers (RUT1 and RUT2) connected by an IPsec tunnel via the Internet.

----

----

'''Configuration scheme 2''':

'''Configuration scheme 2''':

* You will be redirected to the instance's configuration window. From here we will discuss how to configure both instances (''RUT1'' and ''RUT2''). Creating a second instance is analogous to how we created the first one - just login to the second router and repeat the first two steps. Although not mandatory, we recommend that you use a distinct name for the second instance (for this example we use ''RUT2'') for easier management purposes. <br> The specifics of both configurations are described in the figure below:

* You will be redirected to the instance's configuration window. From here we will discuss how to configure both instances (''RUT1'' and ''RUT2''). Creating a second instance is analogous to how we created the first one - just login to the second router and repeat the first two steps. Although not mandatory, we recommend that you use a distinct name for the second instance (for this example we use ''RUT2'') for easier management purposes. <br> The specifics of both configurations are described in the figure below:

[[File:Creating an ipsec instance part 3 v3.png]]

[[File:Creating an ipsec instance part 3 v3.png|1150px]]

* Below are explanations of the parameters highlighted in the figure above. Other parameters (not highlighted) are defaults. You can find descriptions for these parameters in the '''[[VPN#IPsec|VPN manual page, IPsec section]]'''.

* Below are explanations of the parameters highlighted in the figure above. Other parameters (not highlighted) are defaults. You can find descriptions for these parameters in the '''[[VPN#IPsec|VPN manual page, IPsec section]]'''

** '''Enable''' - enables the IPsec instance

** '''Enable''' - enables the IPsec instance

** '''Local IP address/Subnet mask''' - LAN IP address/Subnet mask of the router on which the IPsec instance is configured

** '''Local IP address/Subnet mask''' - LAN IP address/Subnet mask of the router on which the IPsec instance is configured

* The last step in configuring the IPsec instances is '''Phase settings'''. For this example we left the default Phase settings. If you're planning to change Phase settings, make sure they match with the Phase settings (both Phase 1 and Phase 2) of the incoming connection:

* The last step in configuring the IPsec instances is '''Phase settings'''. For this example we left the default Phase settings. If you're planning to change Phase settings, make sure they match with the Phase settings (both Phase 1 and Phase 2) of the incoming connection:

[[File:Creating an ipsec instance part 4 v2.png]]

[[File:Creating an ipsec instance part 4 v2.png|1150px]]

When you're finished with the configuration, don't forget to click the "Save" button.

When you're finished with the configuration, don't forget to click the "Save" button.

===Remote LAN access===

<!--===Remote LAN access===

----

----

Once your IPsec tunnel is operational, you can configure remote access to LAN devices via the tunnel as referenced in ''[[IPsec_configuration_examples#Configuration_overview_and_prerequisites|configuration scheme 2]]''. This section provides a description on how to do just that.

Once your IPsec tunnel is operational, you can configure remote access to LAN devices via the tunnel as referenced in ''[[IPsec_configuration_examples#Configuration_overview_and_prerequisites|configuration scheme 2]]''. This section provides a description on how to do just that.

* In order for the remote LAN access to work, we'll need to add a couple of static routes - one in each router. Login to a router's WebUI and navigate to '''Network → Routing → Static Routes'''. Continuing our example, below is figure depicting the static route configuration for '''RUT1''':

* In order for the remote LAN access to work, we'll need to add a couple of static routes - one in each router. Login to a router's WebUI and navigate to '''Network → Routing → Static Routes'''. Continuing our example, below is figure depicting the static route configuration for '''RUT1''':

   

   

[[File:How to configure static routes for ipsec rut1.png]]

[[File:How to configure static routes for ipsec rut1 v2.png]]

----

----

* And for '''RUT2''':

* And for '''RUT2''':

[[File:How to configure static routes for ipsec rut2.png]]

[[File:How to configure static routes for ipsec rut2 v2.png]]

----

----

* To sum up, for our current purposes select '''MAIN''' Routing table and '''LAN''' interface in both routers; under Destination address, specify the LAN address of the opposite router; under Netmask, specify '''255.255.255.0''' unless your configuring a different size network (more on Netmasks '''[[What_is_a_Netmask%3F|here]]'''); under Gateway, specify the current router's LAN IP address; you can leave the Metric as 0 unless your own specific configuration requires otherwise.

* To sum up, for our current purposes select '''MAIN''' Routing table and '''LAN''' interface in both routers; under Destination address, specify the LAN address of the opposite router; under Netmask, specify '''255.255.255.0''' unless your configuring a different size network (more on Netmasks '''[[What_is_a_Netmask%3F|here]]'''); under Gateway, specify the current router's LAN IP address; you can leave the Metric as 0 unless your own specific configuration requires otherwise.

==Testing the setup==

==Testing the setup==

* Other types of VPNs suported by RUTxxx devices:

* Other types of VPNs suported by RUTxxx devices:

** [[OpenVPN configuration examples]]

** [[OpenVPN configuration examples]]

** [[PPTP configuration examples]]

** [[PPTP configuration examples]]

** [[L2TP configuration examples]]

** [[L2TP configuration examples]]