L2TP over IPsec VPN Server

This video demonstrates a couple of ways to set up an L2TP over IPsec VPN Server on an Edge Router.

Channel Support:

Here are the steps discussed in this video:

STEP 1: Setting WAN Interface and internal network
set vpn ipsec ipsec-interfaces interface eth0
set vpn ipsec nat-networks allowed-network 192.168.1.1/24
set vpn ipsec nat-traversal enable

STEP 2: Setting Authentication Mode and Create Users
set vpn l2tp remote-access authentication mode local
set vpn l2tp remote-access authentication local-users username xxxx password xxxx

STEP 3: Setting Client IP Pool

STEP 4: Setting Client DNS Servers
set vpn l2tp remote-access dns-servers server-1 8.8.8.8
set vpn l2tp remote-access dns-servers server-2 4.2.2.2

STEP 5: Setting Pre-shared Secret
set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret
set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret xxxxxxx
set vpn l2tp remote-access ipsec-settings ike-lifetime 3600

STEP 6: Setting Outside Access

For DHCP: set vpn l2tp remote-access dhcp-interface eth0

For Dynamic DNS w/PPPOE: set vpn l2tp remote-access outside-address 0.0.0.0

STEP 7: Save Settings
commit; save; exit

Amazon Affiliate Links:

Disclaimers:
I participate in the Amazon Affiliate Program. When purchasing using my Amazon Affiliate links, your price doesn't change. You pay the same, but I do get a small percentage of the sale in commission. This helps the channel to continue creating content.

About Tony:
I am a retired educator of 32 years. I started out as an instrumental music teacher and evolved into technology support. After many years of providing technology support to teachers and students, the last ten years of my career, I was in a leadership position of Technology Coordinator and also Supervisor of Technology. My passion has always been helping people. I hope to continue helping people in my youtube community.

That being said, I have no association with Ubiquiti Networks, the makers of the Edge Router, nor am I being paid to make this video. I purchased my own Edge Router for use on my own home network.

Contact Tony at:

Follow me on:
Twitter @quiktechreview
Facebook @quiktechsolutionsllc

Hope you enjoyed this video.

Regards!!

[miragesea]

Thank you Tony! I always learn er-x configuration bit by bit from your videos. It's a great way to build up my networking knowledge.

[dave_dennis]

Tony,
This was so much better than most of these types of videos because you didn't just show the config. You took the time to explain what each line of the config did! That helps SO much.
One thing I didn't understand is how the packets coming in via the VPN address pool get route to and from the public WAN address. Thanks

[miljansimonovic]

Tony, this video of yours deserves all kinds of accolades. Very clear, descriptive, informative. Great job and thanks!

[alfajuliet]

Thanks Tony. I just found your video and I was able to setup VPN on my iPhone and Edgerouter 4 by following these instructions.

[ivanromero]

Hey Tony! Fantastic tutorial for those who come from Iptables-linux-based-routing, thank you so much. Greeting from Argentina.

[SteliosIoannidis]

I had to upgrade my EdgeRouter X to 1.9.1.1, because on the previous version it did not work. Once I upgrade to 1.9.1.1, it worked like charm! Thank you very much!

[NathanTEG]

Still brilliant in 2023. My issue was external connection. Internal was fine. After setting the firewall rules from the ubiquity guide i had some pre existing port forwards on port 500 and 4500. Make sure to check your exisitng forwarding rules.

[rhether]

Just set this up today with my EdgeRouterX SFP, so much better than reading thru tutorials on the web. I enjoy all your vids and Happy New Year.

[chrisdavis]

Thanks for the detailed explanation. It is taking me awhile to learn the ins and outs of this device but It’s nice to finally have vpn set up.

[andrewredmon]

Thank you for this tutorial Tony. I have tried this tutorial twice over the last few weeks on two different edgerouters at two different sites, on several different computers, and I keep running into the same problem. I am able to connect to the vpn successfully. I am able to verify with ipconfig that I am on the network with the the right ip address and range that I have assigned. The problem is I can not see other computers or devices on the network I am attached to via the VPN. I try to ping the computer I want to remote into and do not receive a response it, but I can do the opposite. I can ping the computer connected via the VPN, receive a response from it, and initiate a remote desktop connection. It's like the traffic is only flowing one way. Any computer on the physical network can ping the computer that's connected via the VPN, but not vice versa. I also tried remoting into the computer I want to remote into from another computer on the same physical network, and remote desktop works great. I made sure the VPN connections are set to private in Windows 10 and even tried disabling the Windows firewall. I feel as if there is a edgerouter firewall rule in place(or not in place) that is only allowing one way traffic to the VPN, but I'm probably wrong and am missing something. Any input would be greatly appreciated.

[hellohello]

Just want to say thank you for the video. I have used this to successfully configure my EdgeRouter and connected via my Android device!

[monteduncan]

Super helpful! I have used this video twice now (had to reconfigure my edge-router) and both times process went smoothly because your video was so easy to follow! Thanks for a job well done!!

[Twister]

Thank you So much TONY :) I just find your video so so helpful and nearly the ONLY ONE who explains how to do VPN on GUI apart from everyone else who does CLI
I'm Really grateful that there's a Youtuber out there like you ... KEEP UP MY FRIEND 👍

[chrispaetz]

If your trying to connect to this from windows your must configure your VPN adapter to support MS-CHAP v2. Just had to search for this so thought I would post it here for everyone.

Navigate to the Windows 10 Network connections.
Settings > Network & Internet > Status > Change Adapter Options > L2TP Adapter properties
Security > Allow these protocols > Microsoft CHAP Version 2 (MS-CHAP v2)

[NineStarAK]

Thank you much!!! I've been struggling to find a configuration that really works... Your directions were clear and totally effective. Awesome!

[xkompotikx]

Thank you Tony for the great instructions. Clear and understandable. I wish you many more such tutorials. Best regards from Slovakia

[bartek]

Thank you sir, worked for the first time. Now finally after long time and tries i'm able to wake my pc from my smartphone/remote access. Works like a charm. Greetings from Germany

[hdtrejo]

Well done sir. Thank you for taking the time to create this video.

[gnikolov]

Very descriptive and illustrative. It works! Thank you!

[Steveshiflet]

First, thank you for making this excellent tutorial. I have scoured the internet and your video is by far the best I have found for this topic. I am unable to make this work for me, and I know it is because of something I am doing wrong - in spite of deleting and re-adding a few times. Have you considered making an updated version of this video? As the version of the Edgerouter UI has changed quite a bit, it would be great to see a new tutorial. Plus, L2TP is considered unsecure and no one else has made a (good) recent video of how to setup a more secure VPN in this space.