Changes

Template:Networking rutos configuration example l2tp over ipsec android (view source)

Revision as of 10:15, 2 July 2020

1,875 bytes added ,  10:15, 2 July 2020
no edit summary
Line 3: Line 3:  
         <th width=325; style="border-bottom: 1px solid white;></th>
 
         <th width=325; style="border-bottom: 1px solid white;></th>
 
         <th width=820; style="border-bottom: 1px solid white;" rowspan=2;>
 
         <th width=820; style="border-bottom: 1px solid white;" rowspan=2;>
−
[[File:Networking_RUTX_VPN_between_HQ_topology_v3.png|border|class=tlt-border|750px|right]]</th>
+
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_topology_v1.png|border|class=tlt-border|750px|right]]</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
Line 21: Line 21:  
* At least one Android device
 
* At least one Android device
   −
The topology above depicts the L2TP/IPsec scheme. - The router with the Public IP address ('''''RUTX11''''') acts as the '''L2TP/IPsec server''' and the '''Android device''' acts as '''client'''. L2TP connects the networks of '''RUTX11''' and '''Android client''', IPsec provides the encryption for the L2TP tunnel. Only LAN traffic is going to go through that tunnel, any other WAN traffic won't go through it. This way the VPN tunnel will not be under a huge load and will provide greater speeds.
+
The topology above depicts the L2TP/IPsec scheme. The router with the Public IP address ('''RUTX''') acts as the '''L2TP/IPsec server''' and the '''Android device''' acts as '''client'''. L2TP connects the networks of '''RUTX''' and '''Android client''', IPsec provides the encryption for the L2TP tunnel. Created VPN tunnel will allow Android device to reach home network behind the RUTX router, but the rest of Android device network traffic will not be redirected through VPN. This way the VPN tunnel will not be under a huge load and will provide greater speeds.
   −
When the scheme is realized, you will be able to reach your home internal network with all internal systems, cameras, or other IOT devices, from anywhere in the world.
+
When the scheme is realized, you will be able to log on to your home network from anywhere - work, hotel, car. You will have access to all of your home resources, and your data will still be secure, even if you will be using public WiFi.
    
==Configuring home router (RUTX)==
 
==Configuring home router (RUTX)==
Line 37: Line 37:  
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white;>
 
         <td style="border-bottom: 1px solid white;>
−
Login to the router's WebUI and navigate to the '''Services → VPN → L2TP''' page and do the following:
+
Login to the router's WebUI, navigate to the '''Services → VPN → L2TP''' page and do the following:
 
<ol>
 
<ol>
 +
    <li>Enter a '''custom configuration name'''.</li>
 
     <li>Select '''Role: Server'''.</li>
 
     <li>Select '''Role: Server'''.</li>
−
    <li>Enter a '''custom configuration name'''.</li>
   
     <li>Click the '''Add''' button.</li>
 
     <li>Click the '''Add''' button.</li>
 
     <li>Click the '''Edit''' button next to the newly created L2TP instance.</li>
 
     <li>Click the '''Edit''' button next to the newly created L2TP instance.</li>
Line 60: Line 60:  
<ol>
 
<ol>
 
     <li>'''Enable''' the L2TP instance.</li>
 
     <li>'''Enable''' the L2TP instance.</li>
−
     <li>Enter a '''User name''' and '''Password''' for authentication for the client.</li>
+
     <li>Enter a '''Username''' and '''Password''' which later will be used for client authentication.</li>
−
     <li>Optionaly, set a fixed IP for this client (if left empty, client will receive first free IP from the IP range).</li>
+
     <li>Optionally, set a fixed IP for this client (if left empty, client will receive first free IP from the IP range).</li>
 
     <li>Don't forget to '''Save''' the changes.</li>
 
     <li>Don't forget to '''Save''' the changes.</li>
 
</ol>
 
</ol>
Line 81: Line 81:  
Go to the '''Services → VPN → IPsec''' page and do the following:
 
Go to the '''Services → VPN → IPsec''' page and do the following:
 
<ol>     
 
<ol>     
−
       <li>Enter a custom name for the IPsec instance.</li>
+
       <li>Enter a custom '''Name''' for the IPsec instance.</li>
 
       <li>Click the '''Add''' button.</li>
 
       <li>Click the '''Add''' button.</li>
 
       <li>Click the '''Edit''' button next to the newly created instance.</li>
 
       <li>Click the '''Edit''' button next to the newly created instance.</li>
Line 104: Line 104:  
       <li>Enter your '''Pre-shared key'''.</li>
 
       <li>Enter your '''Pre-shared key'''.</li>
 
       <li>Select '''Type: Transport'''.</li>
 
       <li>Select '''Type: Transport'''.</li>
 +
      <li>Set '''DH group''' to '''MODP1024'''.</li>
 +
      <li>Go to '''Phase 2''' settings and also set '''DH group''' to '''MODP1024'''.</li>
 +
      <li>'''Save''' changes.</li>
 +
</ol>
 +
        </td>
 +
    </tr>
 +
</table>
 +
 +
===Firewall===
 +
----
 +
 +
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=355; style="border-bottom: 1px solid white;></th>
 +
        <th width=790; style="border-bottom: 1px solid white;" rowspan=2>
 +
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_11_v1.png|770px|right]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 1px solid white>
 +
Now go to the '''Network → Firewall → General Settings''' page and press '''Edit''' button next to the L2TP forward rule:
 +
        </td>
 +
    </tr>
 +
</table>
 +
 +
----
 +
 +
<table class="nd-othertables_2">
 +
    <tr>
 +
        <th width=355; style="border-bottom: 1px solid white;></th>
 +
        <th width=790; style="border-bottom: 1px solid white;" rowspan=2>
 +
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_12_v1.png|770px|right]]</th>
 +
    </tr>
 +
    <tr>
 +
        <td style="border-bottom: 1px solid white>
 +
<ol>   
 +
      <li>Set '''Forward: accept'''.</li>
 +
      <li>Select '''Covered networks: LAN'''.</li>
 
       <li>'''Save''' changes.</li>
 
       <li>'''Save''' changes.</li>
 
</ol>
 
</ol>
Line 120: Line 157:  
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white>
 
         <td style="border-bottom: 1px solid white>
−
Type '''VPN settings''' in the Windows search bar:
+
Go to your Android device '''VPN settings''' and create a new VPN network:
 
         </td>
 
         </td>
 
     </tr>
 
     </tr>
Line 131: Line 168:  
         <th width=525; style="border-bottom: 1px solid white;"></th>
 
         <th width=525; style="border-bottom: 1px solid white;"></th>
 
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
 
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_6_v2.png|border|class=tlt-border|300px|center]]</th>
+
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_6_v3.png|border|class=tlt-border|300px|center]]</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white>
 
         <td style="border-bottom: 1px solid white>
−
Click the '''Add a VPN connection''' button:
+
Apply the following configuration:
 +
        <ol>
 +
            <li>Select '''Type: L2TP/IPsec PSK'''.</li>
 +
            <li>Enter the router's WAN IP address into the '''Server''' field.</li>
 +
            <li>Enter the '''Pre-shared key''' exactly as it was specified in the router's IPsec settings.</li>
 +
            <li>Press '''Show advanced options'''</li>
 +
        </ol>
 
         </td>
 
         </td>
 
     </tr>
 
     </tr>
Line 146: Line 189:  
         <th width=525; style="border-bottom: 1px solid white;"></th>
 
         <th width=525; style="border-bottom: 1px solid white;"></th>
 
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
 
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>
−
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_7_v2.png|border|class=tlt-border|300px|center]]</th>
+
[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_7_v3.png|border|class=tlt-border|300px|center]]</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white>
 
         <td style="border-bottom: 1px solid white>
−
Configure the following parameters:
   
         <ol>
 
         <ol>
−
             <li>Select '''VPN provider: Windows (built-in)'''.</li>
+
             <li>Write the '''DNS servers''' you are planning to use (in this example we used google DNS servers).</li>
−
            <li>Enter a custom '''Connection name'''.</li>
+
             <li>Add '''Forwarding routes''' (RUTX LAN network).</li>
−
            <li>Enter the router's WAN IP address into the '''Server name or address''' field.</li>
+
             <li>'''Save''' settings.</li>
−
            <li>Select '''VPN type: L2TP/IPsec with pre-shared key'''.</li>
  −
            <li>Enter the '''Pre-shared key''' exactly as it was specified on the router.</li>
  −
            <li>Select '''Type of sign-in info: User name and password'''.</li>
  −
             <li>Enter the '''User name''' and '''Password''' exactly as they were specified on the router.</li>
  −
             <li>Click '''Save'''</li>
   
         </ol>
 
         </ol>
 
         </td>
 
         </td>
Line 175: Line 212:  
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white>
 
         <td style="border-bottom: 1px solid white>
−
Type '''Network Connections''' in the Windows search bar:
+
Now open your newly created VPN instance and connect to it:
 +
        <ol>
 +
            <li>Write the '''Username''' you created in router's L2TP settings.</li>
 +
            <li>Write the '''Password''' you created in router's L2TP settings.</li>
 +
            <li>Press '''Connect'''.</li>
 +
        </ol>
 
         </td>
 
         </td>
 
     </tr>
 
     </tr>
Line 190: Line 232:  
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white>
 
         <td style="border-bottom: 1px solid white>
−
Press right mouse click on your newly created VPN instance and select '''Properties''':
+
If you applied the configuration correctly, after a moment it should indicate '''Connected''':
 
         </td>
 
         </td>
 
     </tr>
 
     </tr>
Line 200: Line 242:  
     <tr>
 
     <tr>
 
         <th width=525; style="border-bottom: 1px solid white;></th>
 
         <th width=525; style="border-bottom: 1px solid white;></th>
−
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutxxx_configuration_examples_l2tp_over_ipsec_windows_10_10_v2.png|border|class=tlt-border|550px|right]]</th>
+
         <th width=620; style="border-bottom: 1px solid white;" rowspan=2>[[File:Networking_rutos_configuration_example_l2tp_over_ipsec_android_10_v1.png|border|class=tlt-border|300px|center]]</th>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
         <td style="border-bottom: 1px solid white>
 
         <td style="border-bottom: 1px solid white>
−
Home worker should now be able to access HQ network resources.  
+
Now you should be able to access your home network resources.  
−
To verify the connection you can ping some internal HQ server and if you get a reply, you have successfully connected to HQ‘s internal network.
+
To verify the connection you can try accessing your router's WebUI without being connected to it in any way. If you are able to do that, you have successfully connected to your home network.
    
         </td>
 
         </td>
 
     </tr>
 
     </tr>
 
</table>
 
</table>
 +
 +
----
 +
 +
'''Disclaimer:'''
 +
 +
This configuration example was created by using Android version 10. The IPsec '''Phase 1''' and '''Phase 2''' settings, which were used in this configuration example, might not work with other Android versions and might require adjustment.
Justinasm
0

edits

Retrieved from "https://wiki.teltonika-networks.com/view/Special:MobileDiff/63402...65946"

Navigation menu