mirror/setup-ipsec-vpn
1
0
Fork 0
mirror of synced 2024-11-22 13:06:02 +03:00
Code Issues Projects Releases Wiki Activity
b8bc702f21
setup-ipsec-vpn/docs/clients.md
hwdsl2 b8bc702f21 Update docs 
[ci skip]
2016-09-18 17:30:23 -05:00

14 KiB
Raw Blame History

Configure IPsec/L2TP VPN Clients

Read this in other languages: English, 简体中文.

Note: You may also connect using IPsec/XAuth mode, or set up IKEv2.

After setting up your own VPN server, follow these steps to configure your devices. IPsec/L2TP is natively supported by Android, iOS, OS X, and Windows. There is no additional software to install. Setup should only take a few minutes. In case you are unable to connect, first check to make sure the VPN credentials were entered correctly.

An alternative setup guide with images is available, written by Tony Tran.

Windows

Windows 10 and 8.x

  1. Right-click on the wireless/network icon in your system tray.
  2. Select Open Network and Sharing Center.
  3. Click Set up a new connection or network.
  4. Select Connect to a workplace and click Next.
  5. Click Use my Internet connection (VPN).
  6. Enter Your VPN Server IP in the Internet address field.
  7. Enter anything you like in the Destination name field, and then click Create.
  8. Return to Network and Sharing Center. On the left, click Change adapter settings.
  9. Right-click on the new VPN entry and choose Properties.
  10. Click the Security tab. Select "Layer 2 Tunneling Protocol with IPsec (L2TP/IPSec)" for the Type of VPN.
  11. Click Allow these protocols. Check "Challenge Handshake Authentication Protocol (CHAP)" and uncheck all others.
  12. Click the Advanced settings button.
  13. Select Use preshared key for authentication and enter Your VPN IPsec PSK for the Key.
  14. Click OK to close the Advanced settings.
  15. Click OK to save the VPN connection details.

Windows 7, Vista and XP

  1. Click on the Start Menu and go to the Control Panel.
  2. Go to the Network and Internet section.
  3. Click Network and Sharing Center.
  4. Click Set up a new connection or network.
  5. Select Connect to a workplace and click Next.
  6. Click Use my Internet connection (VPN).
  7. Enter Your VPN Server IP in the Internet address field.
  8. Enter anything you like in the Destination name field.
  9. Check the Don't connect now; just set it up so I can connect later checkbox.
  10. Click Next.
  11. Enter Your VPN Username in the User name field.
  12. Enter Your VPN Password in the Password field.
  13. Check the Remember this password checkbox.
  14. Click Create, and then Close.
  15. Return to Network and Sharing Center. On the left, click Change adapter settings.
  16. Right-click on the new VPN entry and choose Properties.
  17. Click the Options tab and uncheck Include Windows logon domain.
  18. Click the Security tab. Select "Layer 2 Tunneling Protocol with IPsec (L2TP/IPSec)" for the Type of VPN.
  19. Click Allow these protocols. Check "Challenge Handshake Authentication Protocol (CHAP)" and uncheck all others.
  20. Click the Advanced settings button.
  21. Select Use preshared key for authentication and enter Your VPN IPsec PSK for the Key.
  22. Click OK to close the Advanced settings.
  23. Click OK to save the VPN connection details.

To connect to the VPN: Click on the wireless/network icon in your system tray, select the new VPN entry, and click Connect. If prompted, enter Your VPN Username and Password, then click OK. You can verify that your traffic is being routed properly by looking up your IP address on Google. It should say "Your public IP address is Your VPN Server IP".

If you get an error when trying to connect, see Troubleshooting.

OS X

  1. Open System Preferences and go to the Network section.
  2. Click the + button in the lower-left corner of the window.
  3. Select VPN from the Interface drop-down menu.
  4. Select L2TP over IPSec from the VPN Type drop-down menu.
  5. Enter anything you like for the Service Name.
  6. Click Create.
  7. Enter Your VPN Server IP for the Server Address.
  8. Enter Your VPN Username for the Account Name.
  9. Click the Authentication Settings button.
  10. In the User Authentication section, select the Password radio button and enter Your VPN Password.
  11. In the Machine Authentication section, select the Shared Secret radio button and enter Your VPN IPsec PSK.
  12. Click OK.
  13. Check the Show VPN status in menu bar checkbox.
  14. Click the Advanced button and make sure the Send all traffic over VPN connection checkbox is checked.
  15. Click the TCP/IP tab, and make sure Link-local only is selected in the Configure IPv6 section.
  16. Click OK to close the Advanced settings, and then click Apply to save the VPN connection information.

To connect to the VPN: Use the menu bar icon, or go to the Network section of System Preferences, select the VPN and choose Connect. You can verify that your traffic is being routed properly by looking up your IP address on Google. It should say "Your public IP address is Your VPN Server IP".

Android

  1. Launch the Settings application.
  2. Tap More... in the Wireless & Networks section.
  3. Tap VPN.
  4. Tap Add VPN Profile or the + icon at top-right of screen.
  5. Enter anything you like in the Name field.
  6. Select L2TP/IPSec PSK in the Type drop-down menu.
  7. Enter Your VPN Server IP in the Server address field.
  8. Enter Your VPN IPsec PSK in the IPSec pre-shared key field.
  9. Tap Save.
  10. Tap the new VPN connection.
  11. Enter Your VPN Username in the Username field.
  12. Enter Your VPN Password in the Password field.
  13. Check the Save account information checkbox.
  14. Tap Connect.

Once connected, you will see a VPN icon in the notification bar. You can verify that your traffic is being routed properly by looking up your IP address on Google. It should say "Your public IP address is Your VPN Server IP".

If you get an error when trying to connect, see Troubleshooting.

iOS

  1. Go to Settings -> General -> VPN.
  2. Tap Add VPN Configuration....
  3. Tap Type. Select L2TP and go back.
  4. Tap Description and enter anything you like.
  5. Tap Server and enter Your VPN Server IP.
  6. Tap Account and enter Your VPN Username.
  7. Tap Password and enter Your VPN Password.
  8. Tap Secret and enter Your VPN IPsec PSK.
  9. Make sure the Send All Traffic switch is ON.
  10. Tap Done.
  11. Slide the VPN switch ON.

Once connected, you will see a VPN icon in the status bar. You can verify that your traffic is being routed properly by looking up your IP address on Google. It should say "Your public IP address is Your VPN Server IP".

Chromebook

  1. If you haven't already, sign in to your Chromebook.
  2. Click the status area, where your account picture appears.
  3. Click Settings.
  4. In the Internet connection section, click Add connection.
  5. Click Add OpenVPN / L2TP.
  6. Enter Your VPN Server IP for the Server hostname.
  7. Enter anything you like for the Service name.
  8. Make sure Provider type is L2TP/IPSec + pre-shared key.
  9. Enter Your VPN IPsec PSK for the Pre-shared key.
  10. Enter Your VPN Username for the Username.
  11. Enter Your VPN Password for the Password.
  12. Click Connect.

Once connected, you will see a VPN icon overlay on the network status icon. You can verify that your traffic is being routed properly by looking up your IP address on Google. It should say "Your public IP address is Your VPN Server IP".

Windows Phone

Users with Windows Phone 8.1 and newer, try this tutorial. Please note that IPsec/L2TP support on this platform may have some issues. You can verify that your traffic is being routed properly by looking up your IP address on Google. It should say "Your public IP address is Your VPN Server IP".

Linux

Ubuntu & Debian

Follow the steps in this tutorial. Some corrections are required:

  1. In xl2tpd.conf, remove the line # your vpn server goes here.

  2. In options.l2tpd.client, replace require-mschap-v2 with require-chap.

  3. Replace sudo echo "c XXX-YOUR-CONNECTION-NAME-XXX <user> <pass>" > /var/run/xl2tpd/l2tp-control with:

    echo "c XXX-YOUR-CONNECTION-NAME-XXX <user> <pass>" | sudo tee /var/run/xl2tpd/l2tp-control

  4. Replace the last command sudo route add -net default gw <vpn server local ip> with:

    sudo route add default dev ppp0

    If there is an error, check the output of ifconfig and replace ppp0 above with ppp1, etc.

Once connected, verify that your traffic is being routed properly:

wget -qO- http://whatismyip.akamai.com; echo

The above command should return Your VPN Server IP.

To stop routing traffic via the VPN server:

sudo route del default dev ppp0

CentOS & Fedora

Refer to the Ubuntu/Debian section above, with these changes:

  1. Use yum instead of apt-get to install packages.
  2. In these systems, the ipsec command has been renamed to strongswan.
  3. The files ipsec.conf and ipsec.secrets should be saved under /etc/strongswan.

Other Linux

If your system provides the strongswan package, refer to the two sections above.

Troubleshooting

Windows Error 809

The network connection between your computer and the VPN server could not be established because the remote server is not responding.

To fix this error, a one-time registry change is required because the VPN server and/or client is behind NAT (e.g. home router). Refer to the linked web page, or run the following from an elevated command prompt. When finished, reboot your PC.

  • For Windows Vista, 7, 8 and 10

    REG ADD HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d 0x2 /f

  • For Windows XP ONLY

    REG ADD HKLM\SYSTEM\CurrentControlSet\Services\IPSec /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d 0x2 /f

Windows Error 628

The connection was terminated by the remote computer before it could be completed.

To fix this error, please follow these steps:

  1. Right-click on the wireless/network icon in system tray, select Open Network and Sharing Center.
  2. On the left, click Change adapter settings. Right-click on the new VPN and choose Properties.
  3. Click the Security tab. Select "Layer 2 Tunneling Protocol with IPsec (L2TP/IPSec)" for Type of VPN.
  4. Click Allow these protocols. Check "Challenge Handshake Authentication Protocol (CHAP)" and uncheck all others.
  5. Click OK to save the VPN connection details.

Select CHAP in VPN connection properties

Android 6.0 and 7.0

If you are unable to connect using Android 6.0 (Marshmallow) or 7.0 (Nougat), try these workarounds:

  1. Tap the "Settings" icon next to your VPN profile. Select "Show Advanced Options" and scroll down to the bottom. If the option "Backwards-compatible mode" exists, enable it and reconnect the VPN. If not, see the next step.
  2. (Note: The latest version of VPN scripts already includes these changes) Edit /etc/ipsec.conf on the VPN server and append ,aes256-sha2_256 to both ike= and phase2alg= lines. Then add a new line sha2-truncbug=yes immediately after those. Indent lines with two spaces. Save the file and run service ipsec restart. (Ref)

Other Errors

Refer to the links below for more troubleshooting tips:

https://documentation.meraki.com/MX-Z/Client_VPN/Troubleshooting_Client_VPN#Common_Connection_Issues
https://blogs.technet.microsoft.com/rrasblog/2009/08/12/troubleshooting-common-vpn-related-errors/
http://www.tp-link.com/en/faq-1029.html

Credits

This document was adapted from the Streisand project by Joshua Lund and contributors.

License

Note: This license applies to this document only.

Copyright (C) 2016 Lin Song
Based on the work of Joshua Lund (Copyright 2014-2016)

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.