How to configure an IPSec/L2TP VPN server on Ubuntu/Debian

Sometimes you may need to connect your Clouding server or network to your local computer. This article explains how to install strongswan with xl2tpd and make the necessary configuration changes to set up an L2TP/IPSec PSK VPN on Ubuntu 24.04 LTS.

Clouding firewall configuration

For the VPN to work, create and assign a firewall profile with the following rules for the server:

Preliminary steps

To avoid DNS errors, run the following commands:

# apt remove unbound -y && systemctl stop systemd-resolved.service && systemctl disable systemd-resolved.service && rm /etc/resolv.conf

Then use the following command:

# nano /etc/resolv.conf

Leave only the following content:

nameserver 8.8.8.8
nameserver 8.8.4.4

Installing Strongswan

# apt-get update && apt-get upgrade -y && apt-get install strongswan -y

Now edit the IPSec configuration file:

# nano /etc/ipsec.conf

Add the connection at the end:

config setup
    charondebug="ike 2, knl 2, cfg 2, net 2, esp 3, dmn 2, mgr 2"

conn L2TP
    authby=secret
    ike=aes256-sha1-ecp384!
    keyexchange=ikev1
    left=%any
    right=%any
    auto=add
    type=transport
    leftprotoport=17/1701
    rightprotoport=17/1701
    rekey=no

Next, specify a pre-shared key:

# nano /etc/ipsec.secrets

Add the following at the end (replace the example key):

: PSK "MiClaveSecreta"

Installing xl2tpd

# apt install xl2tpd -y && systemctl enable xl2tpd

Once installed, edit the xl2tp configuration file using this command:

# nano /etc/xl2tpd/xl2tpd.conf

Add the following at the end:

[global]
listen-addr = 0.0.0.0 ; Escucha en todas las interfaces de red
auth file = /etc/xl2tpd/l2tp-secrets ; Archivo de autenticación de usuarios
ipsec saref = yes ; Habilita la referencia de seguridad de IPsec para optimizar el tráfico
force userspace = yes ; Para que cada User utilice su propia conexión
debug tunnel = yes ; Habilita logs detallados del túnel L2TP
debug avp = yes ; Registra paquetes AVP (Attribute-Value Pair)
debug network = yes ; Logs del tráfico de red
debug state = yes ; Depuración del estado de las conexiones
[lns default]
ip range = 10.30.10.5-10.30.10.200 ; Rango de IP VPN para los clientes L2TP
local ip = 10.30.10.1 ; IP VPN del servidor
refuse chap = yes ; Rechazar autenticación CHAP
refuse pap = yes ; Rechazar autenticación PAP (menos seguro que CHAP)
require authentication = yes ; Obliga a autenticación antes de establecer la conexión
bps = 104857600 ; Límite de velocidad en bits por segundo (~100 Mbps)
ppp debug = yes ; Habilita el modo de depuración de PPP (útil para diagnóstico)
pppoptfile = /etc/ppp/options.xl2tpd ; Archivo con opciones de configuración de PPP
length bit = yes ; Indica que el bit de longitud está presente en los paquetes PPP

Then copy and edit the xl2tp options file:

# cp /etc/ppp/options /etc/ppp/options.xl2tpd && nano /etc/ppp/options.xl2tpd

Add the following at the end:

ipcp-accept-local # Acepta la dirección IP local propuesta por el servidor durante la negociación IPCP (IP Control Protocol)
ipcp-accept-remote # Acepta la dirección IP remota propuesta por el cliente durante la negociación IPCP
require-mschap-v2 # Obliga a usar MSCHAPv2 para autenticación, más seguro que PAP y CHAP
ms-dns 8.8.8.8 # Especifica un servidor DNS para los clientes VPN (en este caso, Google DNS)
proxyarp # Habilita Proxy ARP para permitir que el servidor responda a solicitudes ARP en nombre de los clientes VPN
connect-delay 5000 # Retrasa la conexión PPP en 5000 ms (5 segundos) para evitar problemas de sincronización en la autenticaciónconnect-delay 5000
nodefaultroute
mtu 1410
mru 1410
debug

Here you can create all the users who need access to the VPN:

# nano /etc/ppp/chap-secrets

Add the following at the end of the file, using the CHAP password and username:

userVPN * passVPN *

Then, to add the L2TP password and username:

# nano /etc/xl2tpd/l2tp-secrets

Add the user at the end:

* userVPN passVPN

NOTE: Use strong passwords; this is an example.

Installing dnsmasq

# apt install dnsmasq -y && systemctl enable dnsmasq

Create and edit the configuration file:

# nano /etc/dnsmasq.conf

Add the following content:

dhcp-range=10.30.10.5,10.30.10.200
dhcp-option=6,8.8.4.4,8.8.8.8
#dhcp-option=121,10.30.10.0/24,10.30.10.1
#dhcp-option=249,10.30.10.0/24,10.30.10.1

By default, the VPN server itself is used as the gateway, so there is no need to add routes. However, you can uncomment the entries and add the active routes you need.

Next, run the following to enable routing and make the change permanent:

# echo 'net.ipv4.ip_forward=1' | tee -a /etc/sysctl.conf && sysctl -p

Now restart the services to apply the changes made to them:

# service xl2tpd restart && service dnsmasq restart && ipsec restart

Finally, run the following to masquerade VPN traffic (this is not necessary when using static routes):

# iptables -A FORWARD -i ppp0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Also add the command to /etc/rc.local so it persists after the server restarts:

# nano /etc/rc.local

Add the following at the end:

/sbin/iptables -A FORWARD -i ppp0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

How to configure an L2TP VPN on Windows

In the Windows Control Panel search box, type VPN, open “Cambiar redes privadas virtuales” and click “Agregar una conexión VPN”. Then fill in the fields with the VPN details (IP, PSK, username, and password):

You can now start using the VPN.

How to configure an L2TP VPN on Android

To configure the VPN on Android, go to Ajustes, then más redes, open the VPN option, and tap + to create a VPN:

Remember, if you have any questions about this or anything else related to your Clouding servers, feel free to email soporte@clouding.io We're here to help with whatever you need. Get in touch!