9,305
edits
Changes
Template:Networking rutos manual vpn (view source)
Revision as of 13:52, 1 September 2022
, 13:52, 1 September 2022no edit summary
<!-- Template uses {{{name}}}, {{{series}}} -->
<!-- Template uses {{{name}}}, {{{series}}} -->
{{Template:Networking_rutos_manual_fw_disclosure
{{Template: Networking_rutos_manual_fw_disclosure
| fw_version = {{{series}}}{{#ifeq:{{{name}}}|RUT241|M|}}_R_00.07.01
| fw_version ={{Template: Networking_rutos_manual_latest_fw
| series = {{{series}}}
| series = {{{series}}}
| name = {{{name}}}
}}
}}
}}
{{#ifeq: {{{series}}} | RUT9 |<br><i><b>Note</b>: <b>[[{{{name}}} VPN (legacy WebUI)|click here]]</b> for the old style WebUI (FW version RUT9XX_R_00.06.08.5 and earlier) user manual page.</i>|}}
{{#ifeq: {{{series}}} | RUT9 |<br><i><b>Note</b>: <b>[[{{{name}}} VPN (legacy WebUI)|click here]]</b> for the old style WebUI (FW version {{Template: Networking_rutos_manual_latest_fw | series = RUT9XX}} and earlier) user manual page.</i>|}}
{{#ifeq: {{{series}}} | RUT2 |
{{#ifeq: {{{series}}} | RUT2 |<br><i><b>Note</b>: <b>[[{{{name}}} VPN (legacy WebUI)|click here]]</b> for the old style WebUI (FW version {{Template: Networking_rutos_manual_latest_fw | series = RUT2XX}} and earlier) user manual page.</i>|}}
<br><i><b>Note</b>: <b>[[{{{name}}} VPN (legacy WebUI)|click here]]</b> for the old style WebUI (FW version RUT2XX_R_00.01.14.4 and earlier) user manual page.</i>}}
==Summary==
==Summary==
<b>OpenVPN</b> is an open-source software application that implements virtual private network (VPN) techniques for creating secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. It is often regarded as being the most universal VPN protocol because of its flexibility, support of SSL/TLS security, multiple encryption methods, many networking features and compatibility with most OS platforms.
<b>OpenVPN</b> is an open-source software application that implements virtual private network (VPN) techniques for creating secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. It is often regarded as being the most universal VPN protocol because of its flexibility, support of SSL/TLS security, multiple encryption methods, many networking features and compatibility with most OS platforms.
{{{name}}} devices run OpenVPN version <b>2.5.2</b>.
{{{name}}} devices run OpenVPN version <b>2.5.3</b>.
===OpenVPN Client===
===OpenVPN Client===
<tr>
<tr>
<td>Protocol</td>
<td>Protocol</td>
<td>UDP {{!}} TCP{{#ifeq:{{{series}}}|RUTX| {{!}} <span style="color: #1E3D71;"><b>UDP6</b></span> {{!}} <span style="color: #1E3D71;"><b>TCP6</b></span>}}; default: <b>UDP</b></td>
<td>UDP {{!}} TCP{{#ifeq:{{{series}}}|RUTX| {{!}} <span style="color: #20C0D7;"><b>UDP6</b></span> {{!}} <span style="color: #20C0D7;"><b>TCP6</b></span>}}; default: <b>UDP</b></td>
<td>Transfer protocol used by the OpenVPN connection.
<td>Transfer protocol used by the OpenVPN connection.
<ul>
<ul>
</tr>
</tr>
<tr>
<tr>
<td><span style="color: red;">TLS</span>/<span style="color: #0054a6;">TLS/Password:</span> <span style="color: #1E3D71;"><b>Virtual network IPv6 address</b></span></td>
<td><span style="color: red;">TLS</span>/<span style="color: #0054a6;">TLS/Password:</span> <span style="color: #20C0D7;"><b>Virtual network IPv6 address</b></span></td>
<td>ip6; default: <b>none</b></td>
<td>ip6; default: <b>none</b></td>
<td>IPv6 address of the OpenVPN network.</td>
<td>IPv6 address of the OpenVPN network.</td>
<tr>
<tr>
<td><span style="color:darkred">X.509:</span> Key</td>
<td><span style="color:darkred">X.509:</span> Key</td>
<td>.key file; default: <b>none</b></td>
<td>.der file; default: <b>none</b></td>
<td>A public key file.</td>
<td>A public key file.</td>
</tr>
</tr>
<tr>
<tr>
<td><span style="color:darkred">X.509:</span> Local Certificate</td>
<td><span style="color:darkred">X.509:</span> Local Certificate</td>
<td>.pem file; default: <b>none</b></td>
<td>.der file; default: <b>none</b></td>
<td>A local certificate file.</td>
<td>A local certificate file.</td>
</tr>
</tr>
<tr>
<tr>
<td><span style="color:darkred">X.509:</span> CA Certificate</td>
<td><span style="color:darkred">X.509:</span> CA Certificate</td>
<td>.crt file; default: <b>none</b></td>
<td>.der file; default: <b>none</b></td>
<td>A certificate authority file.</td>
<td>A certificate authority file.</td>
</tr>
</tr>
<tr>
<tr>
<td><span style="color: purple;">Transport:</span> Bind to</td>
<td><span style="color: purple;">Transport:</span> Bind to</td>
<td>GRE interface; default: <b>none</b></td>
<td>GRE interface; L2TP interface; default: <b>none</b></td>
<td>Bind to GRE interface to create GRE over IPsec.</td>
<td>Bind to GRE or L2TP interface to create GRE/L2TP over IPsec.</td>
</tr>
</tr>
<tr>
<tr>
====Advanced settings====
====Advanced settings====
----
----
[[File:Networking_rutos_vpn_ipsec_connection_settings_advanced_settings.png|border|class=tlt-border]]
[[File:Networking_rutos_vpn_ipsec_connection_settings_advanced_settings.png|border|class=tlt-border]]
<td>off {{!}} on; default: <b>on</b></td>
<td>off {{!}} on; default: <b>on</b></td>
<td>Adds necessary firewall rules to allow traffic of from the opposite IPsec instance on this device.</td>
<td>Adds necessary firewall rules to allow traffic of from the opposite IPsec instance on this device.</td>
</tr>
<tr>
<td>Compatibility mode</td>
<td>off {{!}} on; default: <b>off</b></td>
<td>Turns on compatibility mode to help deal with a 3rd party remote peer with multiple subnets.</td>
</tr>
</tr>
<tr>
<tr>
<td>integer; default: <b>none</b></td>
<td>integer; default: <b>none</b></td>
<td>The frequency of sending R_U_THERE messages or INFORMATIONAL exchanges to peer.</td>
<td>The frequency of sending R_U_THERE messages or INFORMATIONAL exchanges to peer.</td>
</tr>
<tr>
<td><span style="color: #0054a6;">Dead Peer Detection:</span> DPD Timeout</td>
<td>integer; default: <b>none</b></td>
<td>Defines the timeout interval, after which all connections to a peer are deleted in case of inactivity.</td>
</tr>
<tr>
<td>XAuth identity</td>
<td>string; default: <b>none</b></td>
<td>The identity/username the client uses to reply to an XAuth request. If not defined, the IKEv1 identity will be used as XAuth identity.</td>
</tr>
</tr>
<tr>
<tr>
<tr>
<tr>
<td>DH group</td>
<td>DH group</td>
<td>MODP768 {{!}} MODP1024 {{!}} MODP1536 {{!}} MODP2048 {{!}} MODP3072 {{!}} MODP4096 {{!}} ECP192 {{!}} ECP224 {{!}} ECP256 {{!}} ECP384 {{!}} ECP521; default: <b>MODP1536</b></td>
<td>MODP768 {{!}} MODP1024 {{!}} MODP1536 {{!}} MODP2048 {{!}} MODP3072 {{!}} MODP4096 {{!}} ECP192 {{!}} ECP224 {{!}} ECP256 {{!}} ECP384 {{!}} ECP521 {{!}} No PFS; default: <b>MODP1536</b></td>
<td>Diffie-Hellman (DH) group used in the key exchange process. Higher group numbers provide more security, but take longer and use more resources to compute the key. Must match with another incoming connection to establish IPSec. </td>
<td>Diffie-Hellman (DH) group used in the key exchange process. Higher group numbers provide more security, but take longer and use more resources to compute the key. Must match with another incoming connection to establish IPSec. </td>
</tr>
</tr>
</tr>
</tr>
<tr>
<tr>
<td>Hash algorithm</td>
<td>Encryption algorithm</td>
<td>3DES {{!}} AES 128 {{!}} AES 192 {{!}} AES 256 {{!}} AES128 GCM8 {{!}} AES192 GCM8 {{!}} AES256 GCM8 {{!}} AES128 GCM12 {{!}} AES192 GCM12 {{!}} AES256 GCM12 {{!}} AES128 GCM16 {{!}} AES192 GCM16 {{!}} AES256 GCM16; default: <b>AES 128</b></td>
<td>3DES {{!}} AES 128 {{!}} AES 192 {{!}} AES 256 {{!}} AES128 GCM8 {{!}} AES192 GCM8 {{!}} AES256 GCM8 {{!}} AES128 GCM12 {{!}} AES192 GCM12 {{!}} AES256 GCM12 {{!}} AES128 GCM16 {{!}} AES192 GCM16 {{!}} AES256 GCM16; default: <b>3DES</b></td>
<td>Algorithm used for data encryption.</td>
<td>Algorithm used for data encryption.</td>
</tr>
</tr>
<tr>
<tr>
<td>Hash algorithm</td>
<td>Hash algorithm</td>
<td>MD5 {{!}} SHA1 {{!}} SHA256 {{!}} SHA384 {{!}} SHA512; default: <b>SHA1</b></td>
<td>MD5 {{!}} SHA1 {{!}} SHA256 {{!}} SHA384 {{!}} SHA512; default: <b>MD5</b></td>
<td>Algorithm used for exchanging authentication and hash information.</td>
<td>Algorithm used for exchanging authentication and hash information.</td>
</tr>
</tr>
<tr>
<tr>
<td>PFS group</td>
<td>PFS group</td>
<td>MODP768 {{!}} MODP1024 {{!}} MODP1536 {{!}} MODP2048 {{!}} MODP3072 {{!}} MODP4096 {{!}} ECP192 {{!}} ECP224 {{!}} ECP256 {{!}} ECP384 {{!}} ECP521; default: <b>MODP1536</b></td>
<td>MODP768 {{!}} MODP1024 {{!}} MODP1536 {{!}} MODP2048 {{!}} MODP3072 {{!}} MODP4096 {{!}} ECP192 {{!}} ECP224 {{!}} ECP256 {{!}} ECP384 {{!}} ECP521 {{!}} No PFS; default: <b>MODP768</b></td>
<td>The PFS (Perfect Forward Secrecy). Must match with another incoming connection to establish IPSec. </td>
<td>The PFS (Perfect Forward Secrecy). Must match with another incoming connection to establish IPSec. </td>
</tr>
</tr>
You should be redirected to the configuration page for the newly added PPTP Client which should look similar to this:
You should be redirected to the configuration page for the newly added PPTP Client which should look similar to this:
[[File:Networking_rutos_vpn_pptp_client.png|border|class=tlt-border]]
[[File:Networking_rutos_vpn_pptp_client_v2.png|border|class=tlt-border]]
<table class="nd-mantable">
<table class="nd-mantable">
<td>string; default: <b>none</b></td>
<td>string; default: <b>none</b></td>
<td>Password used for authentication to the PPTP server.</td>
<td>Password used for authentication to the PPTP server.</td>
</tr><tr>
</tr>
<tr>
<td>Client to client</td>
<td>off {{!}} on; default: <b>off</b></td>
<td>Adds route to make other PPTP clients reachable.</td>
</tr>
<tr>
<td>Default route</td>
<td>Default route</td>
<td>off {{!}} on; default: <b>off</b></td>
<td>off {{!}} on; default: <b>off</b></td>
</table>
</table>
----
----
The <b>User List</b> section is used to user authentication settings required to successfully connect to this server. The list is empty by default. Click the 'Add' button to create a new PPTP User:
The <b>User List</b> section is used to keep authentication settings required to successfully connect to this server. The list is empty by default. Click the 'Add' button to create a new PPTP User:
[[File:Networking_rutos_vpn_pptp_server_user_list_add_button.png|border|class=tlt-border]]
[[File:Networking_rutos_vpn_pptp_server_user_list_add_button.png|border|class=tlt-border]]
</table>
</table>
<b>Note:</b> there can only one PPTP Server configuration on the device.
<b>Note:</b> there can only be one PPTP Server configuration on the device.
==SSTP==
==SSTP==
<b>Secure Socket Tunneling Protocol</b> (SSTP) is a VPN protocol designed to transport PPP traffic via a secure SSL/TLS channel.
<b>Secure Socket Tunneling Protocol</b> (SSTP) is a VPN protocol designed to transport PPP traffic via a secure SSL/TLS channel.
{{#ifeq: TRB1 | RUTX | |
{{#ifeq: {{{series}}} | RUTX | |
</br><u><b>Note:</b> SSTP is additional software that can be installed from the <b>Services → [[{{{name}}} Package Manager|Package Manager]]</b> page.</u>
</br><u><b>Note:</b> SSTP is additional software that can be installed from the <b>Services → [[{{{name}}} Package Manager|Package Manager]]</b> page.</u>
}}
}}
</tr>
</tr>
<tr>
<tr>
<td>Networks/td>
<td>Networks</td>
<td>hex string; default: <b>none</b></td>
<td>hex string; default: <b>none</b></td>
<td>ZeroTier Network ID. Log in to your ZeroTier account in order to locate the ZeroTier Network ID, which should be a string of hexadecimal characters.</td>
<td>ZeroTier Network ID. Log in to your ZeroTier account in order to locate the ZeroTier Network ID, which should be a string of hexadecimal characters.</td>
</tr>
</tr>
<tr>
<tr>
<td>Port/td>
<td>Port</td>
<td>integer [0..65535]; default: <b>none</b></td>
<td>integer [0..65535]; default: <b>none</b></td>
<td>ZeroTier Network port.</td>
<td>ZeroTier Network port.</td>
might be regarded as the most secure, easiest to use, and simplest VPN solution.
might be regarded as the most secure, easiest to use, and simplest VPN solution.
WireGuard works by adding an interface which acts as a tunnel. To create one enter its name and click the <b>Add</b> button. This should add a new Wireguard instance and open a configuration window.
WireGuard works by adding an interface which acts as a tunnel. To create one enter its name and click the <b>Add</b> button.
[[File:Networking_rutx_vpn_wireguard_v1.png|border|class=tlt-border]]
[[File:Networking_rutx_vpn_wireguard_v1.png|border|class=tlt-border]]
===General Instance Settings===
===General Instance Settings===
