L2TP over IPsec
Example for configuring a simple L2TP over IPsec VPN for remote access (works with native Windows and Mac VPN clients):
set vpn ipsec ipsec-interfaces interface eth0
set vpn ipsec nat-traversal enable
set vpn ipsec nat-networks allowed-network 0.0.0.0/0
set vpn l2tp remote-access outside-address 203.0.113.2
set vpn l2tp remote-access client-ip-pool start 192.168.255.1
set vpn l2tp remote-access client-ip-pool stop 192.168.255.254
set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret
set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret <secret>
set vpn l2tp remote-access authentication mode local
set vpn l2tp remote-access authentication local-users username <username> password <password>
In the example above an external IP of 203.0.113.2 is assumed.
If a local firewall policy is in place on your external interface you will need to open:
UDP port 500 (IKE)
IP protocol number 50 (ESP)
UDP port 1701 for IPsec
In addition when NAT is detected by the VPN client ESP is encapsulated in UDP for NAT-traversal:
UDP port 4500 (NAT-T)
Example:
set firewall name OUTSIDE-LOCAL rule 40 action 'accept'
set firewall name OUTSIDE-LOCAL rule 40 protocol 'esp'
set firewall name OUTSIDE-LOCAL rule 41 action 'accept'
set firewall name OUTSIDE-LOCAL rule 41 destination port '500'
set firewall name OUTSIDE-LOCAL rule 41 protocol 'udp'
set firewall name OUTSIDE-LOCAL rule 42 action 'accept'
set firewall name OUTSIDE-LOCAL rule 42 destination port '4500'
set firewall name OUTSIDE-LOCAL rule 42 protocol 'udp'
set firewall name OUTSIDE-LOCAL rule 43 action 'accept'
set firewall name OUTSIDE-LOCAL rule 43 destination port '1701'
set firewall name OUTSIDE-LOCAL rule 43 ipsec 'match-ipsec'
set firewall name OUTSIDE-LOCAL rule 43 protocol 'udp'
Also note that if you wish to allow the VPN to be used for external access you will need to add the appropriate source NAT rules to your configuration.
set nat source rule 110 outbound-interface 'eth0'
set nat source rule 110 source address '192.168.255.0/24'
set nat source rule 110 translation address masquerade
To be able to resolve when connected to the VPN, the following DNS rules are needed as well.
set vpn l2tp remote-access dns-servers server-1 '8.8.8.8'
set vpn l2tp remote-access dns-servers server-2 '8.8.4.4'
Note
Those are the Google public DNS servers. You can also use the public available servers from Quad9 (9.9.9.9) or Cloudflare (1.1.1.1).
Established sessions can be viewed using the show vpn remote-access operational command.
vyos@vyos:~$ show vpn remote-access
Active remote access VPN sessions:
User Proto Iface Tunnel IP TX byte RX byte Time
---- ----- ----- --------- ------- ------- ----
vyos L2TP l2tp0 192.168.255.1 3.2K 8.0K 00h06m13s
RADIUS authentication
The above configuration uses local accounts on the VyOS router for authenticating L2TP/IPSec clients. In bigger environments usually something like RADIUS (FreeRADIUS or Microsoft Network Policy Server, NPS) is used.
VyOS supports either local or radius user authentication:
set vpn l2tp remote-access authentication mode <local|radius>
In addition one or more RADIUS servers can be configured to server for user authentication. This is done using the radius server and radius server key nodes:
set vpn l2tp remote-access authentication radius server 1.1.1.1 key 'foo'
set vpn l2tp remote-access authentication radius server 2.2.2.2 key 'foo'
Note
Some RADIUS severs make use of an access control list which is allowed to query the server. Please configure your VyOS router in the allowed client list.
RADIUS source address
If you are using e.g. OSPF as IGP always the nearest interface facing the RADIUS server is used. With VyOS 1.2 you can bind all outgoing RADIUS requests to a single source IP e.g. the loopback interface.
set vpn l2tp remote-access authentication radius source-address 3.3.3.3
Above command will use 3.3.3.3 as source IPv4 address for all RADIUS queries on this NAS.