Difference between revisions of "Template:Networking rutxxx configuration examples l2tp pover ipsec windows"

From Teltonika Networks Wiki
(Created page with "==Introduction== {{Template:Networking_rutxxx_manual_fw_disclosure | fw_version = RUT9XX_R_00.06.05.3 }} Because of the lack of confidentiality inherent in the '''Layer 2 Net...")
 
 
(8 intermediate revisions by 2 users not shown)
Line 1: Line 1:
 
==Introduction==
 
==Introduction==
 
{{Template:Networking_rutxxx_manual_fw_disclosure
 
{{Template:Networking_rutxxx_manual_fw_disclosure
| fw_version = RUT9XX_R_00.06.05.3
+
| fw_version = {{{fw_version}}}
 
}}
 
}}
  
Line 21: Line 21:
 
'''Configuration scheme''':
 
'''Configuration scheme''':
  
[[File:L2TP WIN10.png|border|class=tlt-border]]
+
[[File:{{{file_scheme}}}|border|class=tlt-border]]
  
 
The figure above depicts the L2TP/IPsec scheme. - The router with the Public IP address (''RUT1'') acts as the L2TP/IPsec server and the '''Windows 10 device''' acts as client. L2TP connects the networks of ''RUT1'' and ''Windows 10 client'' and IPsec provides the encryption for the L2TP tunnel.
 
The figure above depicts the L2TP/IPsec scheme. - The router with the Public IP address (''RUT1'') acts as the L2TP/IPsec server and the '''Windows 10 device''' acts as client. L2TP connects the networks of ''RUT1'' and ''Windows 10 client'' and IPsec provides the encryption for the L2TP tunnel.
Line 31: Line 31:
 
If you have familiarized yourself with the configuration scheme and have all of the devices in order, we can start configuring the routers using instructions provided in this section. To summarize, we'll be configuring an L2TP server and an IPsec Transport instance (server) on ''RUT1''; an a ''Windows 10 VPN connection (client).''
 
If you have familiarized yourself with the configuration scheme and have all of the devices in order, we can start configuring the routers using instructions provided in this section. To summarize, we'll be configuring an L2TP server and an IPsec Transport instance (server) on ''RUT1''; an a ''Windows 10 VPN connection (client).''
  
===L2TP Server (RUT1)===
+
===L2TP Server===
 
----
 
----
* Login to the router's WebUI and navigate to '''Services → VPN → IPsec'''.
+
First, you'll need to configure an L2TP server instance on your router. Adhere to the instructions below for guidance.
[[File:L2TPWIN10-01.png|border|class=tlt-border]]
+
----
*Enter a custom name for your IPsec instance and click the "Add" button.
+
<ul>
[[File:L2TPWIN10-02.png|border|class=tlt-border]]
+
    <li>Login to the router's WebUI and navigate to the <b>Services → VPN → L2TP</b> page and do the following:
*Then click the "Edit" button located next to the newly created instance after which you will redirected to that instance's configuration window.
+
        <ol>
[[File:L2TPWIN10-03.png|border|class=tlt-border]]
+
            <li>Select <i>Role: Server</i>.</li>
<li>Adhere to the configurations presented in the figure below:</li>
+
            <li>Enter a <i>custom configuration name</i>.</li>
[[File:L2TPWIN10-04.png|border|class=tlt-border]]
+
            <li>Click the <i>Add New</i> button.</li>
 +
            <li>Click the <i>Edit</i> button next to the newly created L2TP instance.</li>
 +
        </ol>[[File:{{{file_1}}}|border|class=tlt-border]]
 +
    </li>
 +
----
 +
    <li>Configure the L2TP server instance:</li>
 +
        <ol>
 +
            <li><i>Enable</i> the L2TP instance.</li>
 +
            <li>Enter a <i>User name</i> and <i>Password</i> for authentication for the client.</li>
 +
            <li>Optionaly, set a fixed IP for this client (if left empty, client will receive first free IP from the IP range).</li>
 +
            <li>Don't forget to <i>Save</i> the changes.</li>
 +
        </ol>[[File:{{{file_2}}}|border|class=tlt-border]]
 +
    </li>
 +
</ul>
  
 
===IPsec===
 
===IPsec===
 
----
 
----
You must configure a working IPsec Transport connection. This subsection contains instructions on how to do just that. Other used parameters will be defaults; You can find explanations for those parameters in the '''[[VPN#IPsec|VPN manual page, IPsec section]]'''.
+
Next, you must configure a working IPsec Transport connection. This subsection contains instructions on how to do just that. Other used parameters will be defaults; you can find explanations for those parameters in the '''[[{{{name}}}_VPN#IPsec|VPN manual page, IPsec section]]'''.
 +
----
 +
<ul>
 +
    <li>Go to the <b>Services → VPN → IPsec</b> page and do the following:
 +
        <ol>
 +
            <li>Enter a custom name for the IPsec instance.</li>
 +
            <li>Click the <i>Add</i> button.</li>
 +
            <li>Click the <i>Edit</i> button next to the newly created instance.</li>
 +
        </ol>[[File:{{{file_3}}}|border|class=tlt-border]]
 +
    </li>
 +
----
 +
    <li>In the IPsec Configuration page, do the following (and leave the rest as defaults, unless your specific configuration requires otherwise):
 +
        <ol>
 +
            <li>Enable the instance.</li>
 +
            <li>Select <i>Type: Transport</i> and save changes.</li>
 +
        </ol>[[File:{{{file_4}}}|border|class=tlt-border]]
 +
    </li>
 +
----
 +
    <li>After having saved the changes, you will be redirected back to the main IPsec page. While there, locate the <b>Pre-shared Keys</b> section and do the following:
 +
        <ol>
 +
            <li>Click the <i>Add</i> button.</li>
 +
            <li>Enter your <i>Pre-shared key</i>.</li>
 +
            <li>Enter <i>%any</i> under <i>Secret's ID selector</i>.</li>
 +
            <li>Click the <i>Save</i> button.</li>
 +
        </ol>[[File:{{{file_5}}}|border|class=tlt-border]]
 +
    </li>
 +
</ul>
  
<li>Go to '''Services --> VPN --> IPsec.''' Enter a name for your IPsec instance and click '''ADD'''.</li>
+
==Windows 10 client Configuration==
  
[[File:L2TPWIN10-05.png|border|class=tlt-border]]<br>
+
Finally, configure the L2TP/IPsec client on your Windows 10 computer.
<li>Your instance will appear like in the example and then press '''Edit.'''</li>
+
----
[[File:L2TPWIN10-06.png|border|class=tlt-border]]<br>
 
 
<ul>
 
<ul>
<div>'''1.''' Enable instance.</div>
+
    <li>Type <i>VPN setting</i> in the Windows search bar:<br>[[File:{{{file_6}}}|border|class=tlt-border]]</li>
<div>'''2.''' Select Type (Transport).</div>
+
----
<div>'''3.''' Leave other settings as default and press Save.</div>
+
    <li>Click the <i>Add a VPN connection</i> button:<br>[[File:{{{file_7}}}|border|class=tlt-border]]</li>
</ul>
+
----
[[File:L2TPWIN10-07.png|border|class=tlt-border]]<br>
+
    <li>Configure the following parameters:
<li>Then go back to the IPsec overview window.
+
        <ol>
 +
            <li>Select <i>VPN provider: WIndows (built-in)</i>.</li>
 +
            <li>Enter a custom <i>Connection name</i>.</li>
 +
            <li>Enter the router's WAN IP address into the <i>Server name or address</i> field.</li>
 +
            <li>Select <i>VPN type: L2TP/IPsec with pre-shared key</i>.</li>
 +
            <li>Enter the <i>Pre-shared key</i> exactly as it was specified on the router.</li>
 +
            <li>Select <i>Type of sign-in info: User name and password</i>.</li>
 +
            <li>Enter the <i>User name</i> and <i>Password</i> exactly as they were specified on the router.</li></li>
 +
            <li>Click <i>Save</i></li>
 +
        </ol>[[File:{{{file_8}}}|border|class=tlt-border]]
 +
    </li>
 +
----
 +
    <li>After you are redirected back to the VPN settings page, locate your new connection and click the <i>Connect</i> button. If the connection was successful, you should see the word "connected" appear under the connection name:<br>[[File:{{{file_9}}}|border|class=tlt-border]]</li>
 
<ul>
 
<ul>
<div>'''1.''' Press Add Pre-shared Keys (it should appear like in the example).</div>
 
<div>'''2.''' Create Pre-shared Key.</div>
 
<div>'''3.''' Write Secret’s ID selector (%any or users public IP address).</div>
 
<div>'''4.''' Press '''Save'''</div>
 
</ul>
 
</li>
 
[[File:L2TPWIN10-08.png|border|class=tlt-border|color=black]]
 
  
==Windows 10 client Configuration==
+
==Testing the configuration==
<li>Write VPN in the search bar and then open VPN settings.</li>
 
[[File:L2TPWIN10-09.png|border|class=tlt-border]]
 
<li>Then press Add VPN connection</li>
 
[[File:L2TPWIN10-10.png|border|class=tlt-border]]
 
  
<ul>
+
Open the Windows <b>Command Prompt</b> and attempt to ping router's L2TP address:
<div>'''1.''' Create Connection name.</div>
+
<div>'''2.''' Write server’s IP address.</div>
+
[[File:{{{file_10}}}|border|class=tlt-border]]
<div>'''3.''' Select VPN type (L2TP/IPsec with pre-shared key).</div>
 
<div>'''4.''' Write Pre-shared key (write the password you created in the IPsec settings).</div>
 
<div>'''5.''' Select Type of sign-in info (User name and password).</div>
 
<div>'''6.''' Write Username (write the username you created in the L2TP settings).</div>
 
<div>'''7.''' Write Password (write the password you created in the L2TP settings).</div>
 
<div>'''8.''' Press Save.</div>
 
</ul>
 
  
[[File:L2TPWIN10-11.png|border|class=tlt-border|800px]]
+
If your computer is receiving replies, then the L2TP/IPsec connection was a success.
<li>Try connecting VPN server.</li>
 
[[File:L2TPWIN10-12.png|border|class=tlt-border]]
 
<li>It should show Connected.</li>
 
[[File:L2TPWIN10-13.png|border|class=tlt-border]]
 
<li>From computer, try to ping remote VPN endpoint by using CMD and ping command.</li>
 
[[File:L2TPWIN10-14.png|border|class=tlt-border]]
 
  
 
==See also==
 
==See also==
  
* Other types of VPNs suported by RUTxxx devices:
+
* Other types of VPNs supported by {{{name}}} devices:
 
** [[L2TP configuration examples]]
 
** [[L2TP configuration examples]]
 
** [[IPsec configuration examples]]
 
** [[IPsec configuration examples]]
Line 100: Line 126:
 
** [[OpenVPN configuration examples]]
 
** [[OpenVPN configuration examples]]
 
** [[PPTP configuration examples]]
 
** [[PPTP configuration examples]]
 +
 +
[[Category:{{{name}}} Configuration Examples]]

Latest revision as of 13:09, 16 March 2020

Introduction

The information in this page is updated in accordance with the [[Media:{{{fw_version}}}_WEBUI.bin|{{{fw_version}}}]] firmware version.

Because of the lack of confidentiality inherent in the Layer 2 Networking Protocol (L2TP) protocol, Internet Protocol Security (IPsec) is often used to secure L2TP packets by providing confidentiality, authentication and integrity. The combination of these two protocols is generally known as L2TP over IPsec (or simply L2TP/IPsec).

This article provides a guide on how to configure L2TP/IPsec on RUTxxx routers and how to connect them with a Windows 10 client.

It should also be noted that this guide is aimed at more advanced users and, therefore, skips some of the more self-explanatory steps in order to preserve the overall coherence of the article. For example, instead of showing how to add new instances step by step, it is only mentioned in a short sentence. If you feel this lack of information impedes your ability to configure the setup, we suggest you check out our separate configuration guides on IPsec and L2TP for reference.

Configuration overview and prerequisites

Before we begin, let's overview the configuration that we are attempting to achieve and the prerequisites that make it possible.

Prerequisites:

  • One RUTxxx routers of any type (excluding RUT850)
  • A Public Static or Public Dynamic IP addresses
  • At least one end device with Windows 10


Configuration scheme:

[[File:{{{file_scheme}}}|border|class=tlt-border]]

The figure above depicts the L2TP/IPsec scheme. - The router with the Public IP address (RUT1) acts as the L2TP/IPsec server and the Windows 10 device acts as client. L2TP connects the networks of RUT1 and Windows 10 client and IPsec provides the encryption for the L2TP tunnel.

When the scheme is realized, L2TP packets between the endpoints are encapsulated by IPsec. Since the L2TP packet itself is wrapped and hidden within the IPsec packet, the original source and destination IP address is encrypted within the packet.

Router configuration

If you have familiarized yourself with the configuration scheme and have all of the devices in order, we can start configuring the routers using instructions provided in this section. To summarize, we'll be configuring an L2TP server and an IPsec Transport instance (server) on RUT1; an a Windows 10 VPN connection (client).

L2TP Server


First, you'll need to configure an L2TP server instance on your router. Adhere to the instructions below for guidance.


  • Login to the router's WebUI and navigate to the Services → VPN → L2TP page and do the following:
    1. Select Role: Server.
    2. Enter a custom configuration name.
    3. Click the Add New button.
    4. Click the Edit button next to the newly created L2TP instance.
    [[File:{{{file_1}}}|border|class=tlt-border]]

  • Configure the L2TP server instance:
    1. Enable the L2TP instance.
    2. Enter a User name and Password for authentication for the client.
    3. Optionaly, set a fixed IP for this client (if left empty, client will receive first free IP from the IP range).
    4. Don't forget to Save the changes.
    [[File:{{{file_2}}}|border|class=tlt-border]]

IPsec


Next, you must configure a working IPsec Transport connection. This subsection contains instructions on how to do just that. Other used parameters will be defaults; you can find explanations for those parameters in the [[{{{name}}}_VPN#IPsec|VPN manual page, IPsec section]].


  • Go to the Services → VPN → IPsec page and do the following:
    1. Enter a custom name for the IPsec instance.
    2. Click the Add button.
    3. Click the Edit button next to the newly created instance.
    [[File:{{{file_3}}}|border|class=tlt-border]]

  • In the IPsec Configuration page, do the following (and leave the rest as defaults, unless your specific configuration requires otherwise):
    1. Enable the instance.
    2. Select Type: Transport and save changes.
    [[File:{{{file_4}}}|border|class=tlt-border]]

  • After having saved the changes, you will be redirected back to the main IPsec page. While there, locate the Pre-shared Keys section and do the following:
    1. Click the Add button.
    2. Enter your Pre-shared key.
    3. Enter %any under Secret's ID selector.
    4. Click the Save button.
    [[File:{{{file_5}}}|border|class=tlt-border]]

Windows 10 client Configuration

Finally, configure the L2TP/IPsec client on your Windows 10 computer.


  • Type VPN setting in the Windows search bar:
    [[File:{{{file_6}}}|border|class=tlt-border]]

  • Click the Add a VPN connection button:
    [[File:{{{file_7}}}|border|class=tlt-border]]

  • Configure the following parameters:
    1. Select VPN provider: WIndows (built-in).
    2. Enter a custom Connection name.
    3. Enter the router's WAN IP address into the Server name or address field.
    4. Select VPN type: L2TP/IPsec with pre-shared key.
    5. Enter the Pre-shared key exactly as it was specified on the router.
    6. Select Type of sign-in info: User name and password.
    7. Enter the User name and Password exactly as they were specified on the router.
    8. Click Save
    [[File:{{{file_8}}}|border|class=tlt-border]]

  • After you are redirected back to the VPN settings page, locate your new connection and click the Connect button. If the connection was successful, you should see the word "connected" appear under the connection name:
    [[File:{{{file_9}}}|border|class=tlt-border]]