You may sometimes need to connect your Clouding network to your local network. In this article, we will show you how to install strongswan with xl2tpd and configure an L2TP/IPSec PSK VPN on Ubuntu 20.04 LTS.
Clouding firewall configuration
To get your VPN working, create a firewall profile with the following rules:
Server requirements
To create the L2TP VPN, use an Ubuntu 20.04 machine with 1 GB of RAM, 0,5 Core and 5 GB of disk space. When creating the server, make sure you select the previously created firewall profile.
Preliminary steps
To avoid DNS errors, enter the following commands:
# apt remove unbound
# systemctl stop systemd-resolved.service
# systemctl disable systemd-resolved.service
# rm /etc/resolv.confThen run this command:
# nano /etc/resolv.confAdd the following to the file:
nameserver 8.8.8.8
nameserver 8.8.4.4Install strongswan
# apt install strongswanNow edit the configuration file using “nano /etc/ipsec.conf”, add the following at the end and update the IP addresses:
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
auto=add
keyingtries=3
rekey=no
dpddelay=10
dpdtimeout=90
dpdaction=clear
esp=aes128-sha1
ike=aes128-sha-modp1024
ikelifetime=8h
keylife=1h
type=transport
left=85.208.20.174
leftprotoport=17/%any
right=%any
rightprotoport=17/%any
conn L2TP-PSK-noNAT-Private
authby=secret
auto=add
keyingtries=3
rekey=no
dpddelay=10
dpdtimeout=90
dpdaction=clear
esp=aes128-sha1
ike=aes128-sha-modp1024
ikelifetime=8h
keylife=1h
type=transport
left=10.20.10.5
leftprotoport=17/%any
right=%any
rightprotoport=17/%any
Specify the PSK (pre-shared key) by opening the file with “nano /etc/ipsec.secrets” and adding the following at the end:
: PSK "Especificar Clave Privada Segura (Contraseña a elegir)"Install xl2tpd
# apt install xl2tpd
# systemctl enable xl2tpdConfigure Xl2tp by opening the file with “nano /etc/xl2tpd/xl2tpd.conf” and adding the following at the end:
[global]
listen-addr = 0.0.0.0
auth file = /etc/xl2tpd/l2tp-secrets
ipsec saref = yes
force userspace = yes
[lns default]
ip range = 10.254.254.100-10.254.254.200
local ip = 10.254.254.1
;require chap = yes
refuse chap = yes
refuse pap = yes
require authentication = yes
bps = 104857600
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yesTo specify the Xl2tp options, run “cp /etc/ppp/options /etc/ppp/options.xl2tpd” and “nano /etc/ppp/options.xl2tpd”, then add the following at the end:
ipcp-accept-local
ipcp-accept-remote
require-mschap-v2
ms-dns 8.8.8.8
proxyarp
connect-delay 5000
In the same file ("/etc/ppp/options.xl2tpd"), comment out the following modules, as the version currently available in the repositories causes errors when a user tries to connect through the VPN.
# Use hardware flow control (i.e. RTS/CTS) to control the flow of data
# on the serial port.
#crtscts
# Specifies that pppd should use a UUCP-style lock on the serial device
# to ensure exclusive access to the device.
#lock
# Use the modem control lines. On Ultrix, this option implies hardware
# flow control, as for the crtscts option. (This option is not fully
# implemented.)
#modem*If you need these modules, download and compile an earlier version.
Here you can create all the users who need access to the VPN. Open the files with “nano /etc/ppp/chap-secrets” and “nano /etc/xl2tpd/l2tp-secrets” and add the following at the end:
*/etc/ppp/chap-secrets
userVPN * passVPN **/etc/xl2tpd/l2tp-secrets
userVPN passVPNNOTE: Use strong passwords; this is an example.
Install dnsmasq
# apt install dnsmasq
# systemctl enable dnsmasq Create an empty configuration file (/etc/dnsmasq.conf) and add the following content:
dhcp-range=10.254.254.100,10.254.254.200
dhcp-option=121,10.20.10.0/24,10.254.254.1,27.0.172.0/22,10.254.254.1,46.183.112.0/21,10.254.254.1,80.240.126.0/23,10.254.254.1,85.208.20.0/21,10.254.254.1,93.189.88.0/19,10.254.254.1,103.23.60.0/23,10.254.254.1,161.22.40.0/21,10.254.254.1,185.166.212.0/21,10.254.254.1,185.253.152.0/22,10.254.254.1,185.254.204.0/22,10.254.254.1,213.192.233.0/24,10.254.254.1,217.71.200.0/21,10.254.254.1
dhcp-option=249,10.20.10.0/24,10.254.254.1,27.0.172.0/22,10.254.254.1,46.183.112.0/21,10.254.254.1,80.240.126.0/23,10.254.254.1,85.208.20.0/21,10.254.254.1,93.189.88.0/19,10.254.254.1,103.23.60.0/23,10.254.254.1,161.22.40.0/21,10.254.254.1,185.166.212.0/21,10.254.254.1,185.253.152.0/22,10.254.254.1,185.254.204.0/22,10.254.254.1,213.192.233.0/24,10.254.254.1,217.71.200.0/21,10.254.254.1The IP ranges 10.20.10.0/24 (private network) and 85.208.20.174/21 (public network) belong to Clouding. Any access to Clouding servers will use the VPN's IP address.
You can add any ranges you need.
Finally, run:
# /sbin/sysctl -w net.ipv4.ip_forward=1
# /sbin/iptables -t nat -A POSTROUTING -s 10.254.254.0/24 -j MASQUERADE
# service xl2tpd restart; service dnsmasq restart; ipsec restartAlso add the commands above to /etc/rc.local so that these settings persist when you restart the server:
/sbin/sysctl -w net.ipv4.ip_forward=1
/sbin/iptables -t nat -A POSTROUTING -s 10.254.254.0/24 -j MASQUERADEConfigure the VPN on Windows
In the Windows Control Panel search box, type VPN and open “Cambiar redes privadas virtuales”. Click “Agregar una conexión VPN” and fill in the fields with your details (IP, PSK, username and password).
Also change the setting that routes all traffic through the VPN. Open “Cambiar opciones del adaptador” on the right, select the VPN adapter you created and open “Propiedades”. On the “Funciones de red” tab, double-click Protocolo TCP/IPv4, open “Opciones avanzadas” and clear “Usar la puerta de enlace predeterminada en la red remota”.
You can now start using your VPN.
Configure the VPN on Android
To configure the VPN on Android, go to Ajustes, then más redes, open VPN and tap + to create a VPN. Remember, if you have any questions about this or anything else related to your Clouding servers, feel free to email soporte@clouding.io We're here to help with whatever you need. Get in touch!