Libreswan-xl2tpd
Version
About
L2TPD/IPSEC is secure method of connecting to your Koozali SME server. It is a suitable replacement for the existing PPTP VPN system on Koozali SME Server.
PPTP is totally insecure and should not be used.
L2TPD/IPSEC is like PPTP and really designed for roaming clients, each with their own IP. It is NOT suitable for Lan-Lan setups. Use pure IPSEC or OpenVPN instead.
If you are using with NAT behind a firewall, you can ONLY use one client per NAT'd Lan (because the Lan will likely only have one Public facing IP address.
L2TPD/IPSEC does not need any special software configuration on your clients. It is supported on a very large number of modern mobile phones and laptops although not every phone or device will support L2TPD/IPSEC out of the box. Please check your device for specifics.
The device first calls the server via IPSEC and makes a transport encrypted connection. But it has no networking information. xl2tpd then makes a PPP connection through that encrypted IPSEC connection and get its network information at this point.
Once implemented you can disable PPTP, which will be good for you and your users.
Notes
The contrib basically works but there, can be complications when you want to combine it with standard host-host ipsec connections. The issue that 'may' arise is if an IPSEC connection is matched prior to the L2TPD one. I do have both types running on my test box but need more feedback on this.
This is because pure ipsec usually relies on having connections from specific IP address / and or IDs / Certificates. To accept mobile clients, which could come from pretty well any IP address, we need to tell our L2TPD Ipsec configuration to accept connections from anywhere.
The potential issue is if you try a pure Ipsec connection that does not have a correct configuration in the database/configuration, it may try to connect via the L2TPD connection. That will not break anything, but you may experience odd results from the client.
Please note that you can enable or disable L2TPD VPN access for users via the Server Manager.
These links discuss the implementation and the creation of this page: https://forums.contribs.org/index.php/topic,53021.0/all.html
Some further reading can be found on this page: https://github.com/reetp/smeserver-libreswan-xl2tpd/blob/master/ipsecXl2tpd.Notes
Please report any problems by adding a bug to Bugzilla. See Bugs below.
Installation
The smeserver-libreswan-xl2tpd contrib is currently in the contribs repo.
Add the EPEL and Libreswan repos:
yum install smeserver-extrarepositories-libreswan smeserver-extrarepositories-epel db yum_repositories setprop libreswan status enabled Priority 10 signal-event yum-modify config set UnsavedChanges no
With the yum repo database updated, you can then run the installation of the package.
yum --enablerepo=smecontribs,epel,libreswan install smeserver-libreswan-xl2tpd
That should bring everything in, including ipsec which is required
signal-event post-upgrade;signal-event reboot
Configuration settings
You need at least one ordinary user on the system - for testing it can be admin. The user account needs VPN Client Access enabled in the Server Manager
Keys
These are the basic database keys required to setup the server
IPsec settings
- IPRange Start/Finish
An IP range from your server. Note it MUST NOT conflict with IPs issued by your DHCP server
db ipsec_connections setprop L2TPD-PSK IPRangeStart 192.168.1.176 IPRangeFinish 192.168.1.190
- rightsubnet
This must be the subnet in CIDR format and match the IP range allocated above eg:
db ipsec_connections setprop L2TPD-PSK rightsubnet 192.178.1.176/28
- passwd
IPsec pre shared key as per ipsec db connection below. Every user will need this common password.
Make it long and complicated !
db ipsec_connections setprop L2TPD-PSK password SomeLongComplicatedSecret db ipsec_connections setprop L2TPD-PSK password `openssl rand -base64 64|sed '/.*$/N;s/\n//'`
Ensure the connection is enabled:
db ipsec_connections setprop L2TPD-PSK status enabled
Ensure that the ipsec service is enabled:
config setprop ipsec status enabled
Xl2tps settings
- DNS
Optional - defaults to the SME server. Can add extra servers if required
config setprop xl2tpd DNS 8.8.8.8,8.8.4.4
- access
Defaults to private. Not necessary to set public.
- status
config setprop xl2tpd status enabled
- UDPPort
Defaults to 1701
- debug
Defaults to disabled
Create Server Connection
Note that some settings are preconfigured in the ipsec_connections database.
db ipsec_connections show L2TPD-PSK
We need to add some basic settings to the connection. Here we assume your local network is 192.168.101.x
db ipsec_connections setprop L2TPD-PSK \
status enabled \
IPRangeStart 192.168.101.176 \
IPRangeFinish 192.168.101.90 \
rightsubnet 192.168.101.176/28 \
passwd somesecret
Make sure the Start and Finish addresses do NOT conflict with your server dhcp range. You can see your server dhcpd range with:
config show dhcpd
config setprop ipsec access public
xl2tpd does not have to be set public as the xl2tpd connection is made inside the ipsec tunnel.
Now we can enable the required services which will automatically add the correct firewall ports.
config setprop xl2tpd status enabled config setprop ipsec status enabled signal-event ipsec-update
You can regenerate the server templates with:
signal-event remoteaccess-update
Note that this this will not stop or restart ipsec. Use ipsec-update to do this:
signal-event ipsec-update
Create a connection from a device
Note. This is really designed for remote roaming clients with their own individual public IP. Ipsec/l2tpd can only cope with one public IP at a time. So you cannot connect two devices from the same LAN to the server. For that you need a Lan-Lan setup and can use pure ipsec or openvpn.
This is the basic setup for your remote device, e.g. laptop or tablet.
For Linux/Android it is pretty straight forward:
Connection type: L2TP/IPSec PSK Server IP : Your server IP address IPsec preshared key : as per passwd set above Username : Any user on your server with VPN Access set to Enabled Password : adminpassword (the password for the above user)
For Windows it is a little more complicated if you are going to use this behind a NAT.
This has links: https://github.com/StreisandEffect/streisand/issues/291
You will need a new registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent RegValue: AssumeUDPEncapsulationContextOnSendRule Type: DWORD Data Value: 2
Note that after creating this key you will need to reboot the machine. Then create a VPN connection, type L2TP/Ipsec with pre-shared key.
Stop the service
config setprop xl2tpd status disabled config setprop ipsec status disabled signal-event ipsec-update
Disable PPTP
Once the implementation is complete and functional, you will not need PPTP enabled. If your L2TPD setup is working then make sure that this is disabled or you may still leave ordinary pptp connections open.
You can go to your server manager and disable it forever and sing a thousand hallelujahs for secure communications ;-)
config setprop pptpd status disabled sessions 0
signal-event remoteaccess-update
Take this action only *after* you have confirmed proper L2TP connection is working.
Issues
Ipsec and l2tpd is a vast and complicated subject. I have tried to simplify it to the best of my abilities. Mainly because I can't do complicated.
Please go and have a good read of the online documentation for Libreswan
I basically used an example like this Ipsec/L2tpd although this never page existed when I first started building this contrib.
The first thing to do if you get stuck is check all your settings and your logs.
Go back and check your network settings. Check you passwords. Get someone else to make sure they are OK.
Is the ipsec secret correct?
Have you enabled remote VPN access for a user and checked the password?
Ipsec - check here first:
/var/log/pluto/pluto.log
Look for L2TPD-PSK entries and in particular this "STATE_QUICK_R2: IPsec SA established transport mode"
That means that you have a basic ipsec connection
L2tpd - check here:
/var/log/messages
Look for xl2tpd and pppd entries
Do you get as far as this "ip-up: xl2tpd ppp0 /dev/pts/2 150 192.168.97.1 192.168.97.180 xl2tpd"
If so you have a basic l2tpd connection
To debug have a look at the following:
db ipsec_connections show L2TPD-PSK
config show ipsec
config show xl2tpd
cat /etc/ipsec.d/ipsec.conf
cat /etc/ipsec.d/ipsec.secrets
Try restarting both ipsec and xl2tpd and watch your logs for errors:
service xl2tpd restart
service ipsec restart
If you are still stuck then ask on the forums, or if you have some template errors or other issues please raise a bug.
To Do List
A VPN Access Group may be worth looking at in the future
Add server manager panel (with an IPsec panel too)
Commit the code to the CVS.
The code probably needs reviewing and cleaning up by a greater mind than mine :-)
Bugs
Please raise bugs under the SME-Contribs section in bugzilla and select the libreswan-xl2tpd component or use this link
Bugs (test entry)
Please raise bugs under the SME-Contribs section in bugzilla and select the smeserver-letsencrypt-xl2tpd component or use this link
| ID | Product | Version | Status | Summary |
|---|---|---|---|---|
| 11409 | SME Contribs | 10beta | RESOLVED | Initial Import in SME 10 [smeserver-libreswan-xl2tpd] |
Below is an overview of the current issues for this contrib:
Changelog
Only released version in smecontrib are listed here.