Configure an L2TP/IPSec PSK VPN server with Ubuntu 18.04

Sometimes you may need to connect your Clouding network to your local network. In this article, we will show you how to install strongswan with xl2tpd and make the necessary configuration changes to set up an L2TP/IPSec PSK VPN for Ubuntu 18.04 LTS.

Clouding firewall configuration

To make our VPN work, we will create a firewall profile with the following rules:

Server requirements

We will create the L2TP VPN on a machine running Ubuntu 18.04 with 1 GB of RAM, 0,5 Core and 5 GB of disk space. When creating the server, be sure to select the firewall profile created above.

Install strongswan

# apt-get install strongswan

Now we will edit the configuration file using “vi /etc/ipsec.conf”, add the following at the end and modify the IP addresses:

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
    authby=secret
    auto=add
    keyingtries=3
    rekey=no
    dpddelay=10
    dpdtimeout=90
    dpdaction=clear
    esp=aes128-sha1
    ike=aes128-sha-modp1024
    ikelifetime=8h
    keylife=1h
    type=transport
    left=85.208.20.174
    leftprotoport=17/%any
    right=%any
    rightprotoport=17/%any
conn L2TP-PSK-noNAT-Private
    authby=secret
    auto=add
    keyingtries=3
    rekey=no
    dpddelay=10
    dpdtimeout=90
    dpdaction=clear
    esp=aes128-sha1
    ike=aes128-sha-modp1024
    ikelifetime=8h
    keylife=1h
    type=transport
    left=10.20.10.5
    leftprotoport=17/%any
    right=%any
    rightprotoport=17/%any

We will specify the PSK (Pre Shared Key) using “vi /etc/ipsec.secrets”, adding the following at the end:

: PSK "Especificar Clave Privada Segura"

Install xl2tpd

# apt-get install xl2tpd
# update-rc.d xl2tpd enable

We will configure Xl2tp using “vi /etc/xl2tpd/xl2tpd.conf”, adding the following at the end:

[global]
listen-addr = 0.0.0.0
auth file = /etc/xl2tpd/l2tp-secrets
ipsec saref = yes
force userspace = yes
[lns default]
ip range = 10.254.254.100-10.254.254.200
local ip = 10.254.254.1
;require chap = yes
refuse chap = yes
refuse pap = yes
require authentication = yes
bps = 104857600
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

We will specify the Xl2tp options. To do this, run “cp /etc/ppp/options /etc/ppp/options.xl2tpd” and “vi /etc/ppp/options.xl2tpd”, then add the following at the end:

ipcp-accept-local
ipcp-accept-remote
require-mschap-v2
ms-dns 8.8.8.8
proxyarp
connect-delay 5000

In the same file ("/etc/ppp/options.xl2tpd"), we will comment out the following modules because, with the version currently available in the repositories, they cause an error when a user tries to connect through the VPN.

# Use hardware flow control (i.e. RTS/CTS) to control the flow of data
# on the serial port.
#crtscts

# Specifies that pppd should use a UUCP-style lock on the serial device
# to ensure exclusive access to the device.
#lock

 # Use the modem control lines.  On Ultrix, this option implies hardware
# flow control, as for the crtscts option.  (This option is not fully
# implemented.)
#modem

 *If you need these modules, you must download and compile an earlier version.

Here we can create all the users we want to grant access to the VPN. Use “vi /etc/ppp/chap-secrets” and “vi /etc/xl2tpd/l2tp-secrets”, adding the following at the end:

userVPN * passVPN *

*/etc/ppp/chap-secrets

userVPN passVPN

 */etc/xl2tpd/l2tp-secrets

NOTE: Use strong passwords; this is an example.

Install dnsmasq

# apt-get install dnsmasq
# update-rc.d dnsmasq enable

We will edit the file using "vi /etc/dnsmasq.conf" and add the following content:

dhcp-range=10.254.254.100,10.254.254.200
dhcp-option=121,10.20.10.0/24,10.254.254.1,27.0.172.0/22,10.254.254.1,46.183.112.0/21,10.254.254.1,80.240.126.0/23,10.254.254.1,85.208.20.0/21,10.254.254.1,93.189.88.0/19,10.254.254.1,103.23.60.0/23,10.254.254.1,161.22.40.0/21,10.254.254.1,185.166.212.0/21,10.254.254.1,185.253.152.0/22,10.254.254.1,185.254.204.0/22,10.254.254.1,213.192.233.0/24,10.254.254.1,217.71.200.0/21,10.254.254.1
dhcp-option=249,10.20.10.0/24,10.254.254.1,27.0.172.0/22,10.254.254.1,46.183.112.0/21,10.254.254.1,80.240.126.0/23,10.254.254.1,85.208.20.0/21,10.254.254.1,93.189.88.0/19,10.254.254.1,103.23.60.0/23,10.254.254.1,161.22.40.0/21,10.254.254.1,185.166.212.0/21,10.254.254.1,185.253.152.0/22,10.254.254.1,185.254.204.0/22,10.254.254.1,213.192.233.0/24,10.254.254.1,217.71.200.0/21,10.254.254.1

The IP ranges 10.20.10.0/24 (private network) and 85.208.20.174/21 (public network) belong to Clouding. Any access to Clouding servers will use the VPN's IP address.
You can add any ranges you need.
Finally, we will run:

# /sbin/sysctl -w net.ipv4.ip_forward=1
# /sbin/iptables -t nat -A POSTROUTING -s 10.254.254.0/24 -j MASQUERADE
# service xl2tpd restart; service dnsmasq restart; ipsec restart

We will also add the commands above to /etc/rc.local so that they remain in effect when we restart our server:

/sbin/sysctl -w net.ipv4.ip_forward=1
/sbin/iptables -t nat -A POSTROUTING -s 10.254.254.0/24 -j MASQUERADE

Configure the VPN on Windows

In the Windows Control Panel, type VPN in the search box, open “Cambiar redes privadas virtuales”, click “Agregar una conexión VPN” and fill in the fields with your details (IP, PSK, username and password)

We will also change the setting that uses the VPN for all traffic. Open “Cambiar opciones del adaptador” on the right, select the VPN adapter we created and go to “Propiedades”. On the “Funciones de red” tab, double-click Protocolo TCP/IPv4, go to “Opciones avanzadas” and clear “Usar la puerta de enlace predeterminada en la red remota”

We can now start using our VPN.

Configure the VPN on Android

To configure our VPN on Android, go to Ajustes, then más redes, open VPN and tap + to create a VPN.
 

Remember, if you have any questions about this or anything else related to your Clouding servers, feel free to write to soporte@clouding.io We are here to help with whatever you need. Get in touch!