Follow the next steps to establish “road warrior” pre-shared secret L2TP VPN connection to remote VPN server (running RouterOS 5.24 in my case) from your Fedora system.<\/p>\n
Install ipsec and l2tp packages.<\/p>\n
\r\n$ yum install libreswan xl2tpd\r\n<\/pre>\nMain IPSec configuration is located in
\/etc\/ipsec.conf<\/code> and\/etc\/ipsec.secrets<\/code>. You can review it, but no changes are required to Fedora’s default that basically enables NAT traversal and includes\/etc\/ipsec.d\/*.conf<\/code> and\/etc\/ipsec.d\/*.secrets<\/code> files into the configuration.<\/p>\nCreate new configuration file in
\/etc\/ipsec.d\/desired_vpn_name.conf<\/code> with following content and replace connection name and local and remote IPs.<\/p>\n\r\nconn VPN_CONNECTION_NAME\r\n authby=secret\r\n pfs=no\r\n auto=add\r\n keyingtries=3\r\n dpddelay=30\r\n dpdtimeout=120\r\n dpdaction=clear\r\n rekey=yes\r\n ikelifetime=8h\r\n keylife=1h\r\n type=transport\r\n left=YOUR_LOCAL_IP_ADDRESS\r\n leftnexthop=%defaultroute\r\n leftprotoport=17\/1701\r\n right=REMOTE_VPN_SERVER_IP_ADDRESS\r\n rightprotoport=17\/1701\r\n<\/pre>\nCreate new secrets file in
\/etc\/ipsec.d\/desired_vpn_name.secrets<\/code> with following content and replace remote server IP and pre-shared secret.<\/p>\n\r\n%any REMOTE_VPN_SERVER_IP_ADDRESS : PSK \"YOUR-PRE-SHARED-SECRET\"\r\n<\/pre>\nStart IPSec daemon in foreground to ensure IPSec stack is in your kernel and testing your configuration later.<\/p>\n
\r\n$ ipsec pluto --stderrlog --config \/etc\/ipsec.conf --nofork\r\n<\/pre>\nIf you find out following section in the output:<\/p>\n
\r\nNo Kernel XFRM\/NETKEY interface detected\r\nNo Kernel KLIPS interface detected\r\nNo Kernel MASTKLIPS interface detected\r\nUsing 'no_kernel' interface code on 3.16.3-200.fc20.i686\r\n<\/pre>\nit means there is no IPSec stack in your kernel and you have to load apropriate module into the kernel manually by:<\/p>\n
\r\n$ modprobe af_key\r\n<\/pre>\nIf you have no IPSec stack in the kernel and continue you will get completely misleading error when trying to connect the tunnel.<\/p>\n
\r\n022 \"VPN_CONNECTION_NAME\": We cannot identify ourselves with either end of this connection.\r\n<\/pre>\nWhen everything is alright you should see just:<\/p>\n
\r\nUsing Linux XFRM\/NETKEY IPsec interface code on 3.16.3-200.fc20.i686\r\n<\/pre>\nAdd your new connection by:<\/p>\n
\r\n$ ipsec auto --add VPN_CONNECTION_NAME\r\n<\/pre>\nNow configure L2TP part. Add a new section to
\/etc\/xl2tpd\/xl2tpd.conf<\/code> and replace connection name and remote server IP.<\/p>\n\r\n[lac VPN_CONNECTION_NAME]\r\nlns = REMOTE_VPN_SERVER_IP_ADDRESS\r\nppp debug = yes\r\npppoptfile = \/etc\/ppp\/options.xl2tpd.VPN_CONNECTION_NAME\r\nlength bit = yes\r\n<\/pre>\nAnd create new file
\/etc\/ppp\/options.xl2tpd.VPN_CONNECTION_NAME<\/code> with your new PPP options and put there following configuration (replace username and password for authentication).<\/p>\n\r\nipcp-accept-local\r\nipcp-accept-remote\r\nrefuse-eap\r\nrequire-mschap-v2\r\nnoccp\r\nnoauth\r\nidle 1800\r\nmtu 1410\r\nmru 1410\r\ndefaultroute\r\nusepeerdns\r\ndebug\r\nlock\r\nconnect-delay 5000\r\nname AUTH_USERNAME\r\npassword AUTH_PASSWORD\r\n<\/pre>\nStart all daemons and connect the tunnel<\/p>\n
$ systemctl start ipsec\r\n$ systemctl start xl2tpd\r\n$ echo \"c VPN_CONNECTION_NAME\" > \/var\/run\/xl2tpd\/l2tp-control\r\n<\/pre>\nTo disconnect do<\/p>\n
\r\n$ echo \"d VPN_CONNECTION_NAME\" > \/var\/run\/xl2tpd\/l2tp-control\r\n<\/pre>\nRemind: if you successfully reached this point you have the tunnel only and you need to add your routes manually to access the networks behind the tunnel!<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"
Follow the next steps to establish “road warrior” pre-shared secret L2TP VPN connection to remote VPN server (running RouterOS 5.24 in my case) from your Fedora system. Install ipsec and l2tp packages. $ yum install libreswan xl2tpd Main IPSec configuration is located in \/etc\/ipsec.conf and \/etc\/ipsec.secrets. You can review it, but no changes are required…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[7,33],"tags":[73,55,70,71,72],"class_list":["post-1522","post","type-post","status-publish","format-standard","hentry","category-technology","category-work","tag-client","tag-fedora","tag-ipsec","tag-l2tp","tag-vpn"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p20Iro-oy","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.moucha.cc\/charon\/wp-json\/wp\/v2\/posts\/1522","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.moucha.cc\/charon\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.moucha.cc\/charon\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.moucha.cc\/charon\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.moucha.cc\/charon\/wp-json\/wp\/v2\/comments?post=1522"}],"version-history":[{"count":12,"href":"https:\/\/www.moucha.cc\/charon\/wp-json\/wp\/v2\/posts\/1522\/revisions"}],"predecessor-version":[{"id":1534,"href":"https:\/\/www.moucha.cc\/charon\/wp-json\/wp\/v2\/posts\/1522\/revisions\/1534"}],"wp:attachment":[{"href":"https:\/\/www.moucha.cc\/charon\/wp-json\/wp\/v2\/media?parent=1522"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.moucha.cc\/charon\/wp-json\/wp\/v2\/categories?post=1522"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.moucha.cc\/charon\/wp-json\/wp\/v2\/tags?post=1522"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}