Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


t0ny

306 posts

Ultimate Geek

Lifetime subscriber

#196668 8-Jun-2016 16:13
Send private message

Iam trying to set up VPN on my edge router lite and i can see my client hitting the router but it doesnt appear to do anything after that. The VPN has been set up using the following commands:

 

set vpn ipsec ipsec-interfaces interface pppoe0
set vpn l2tp remote-access outside-address XX.XX.XX.XX
set vpn ipsec nat-traversal enable
set vpn ipsec nat-networks allowed-network 0.0.0.0/0
set vpn l2tp remote-access client-ip-pool start 192.168.100.1
set vpn l2tp remote-access client-ip-pool stop 192.168.100.10
set vpn l2tp remote-access dns-servers server-1 192.168.1.10
set vpn l2tp remote-access authentication mode local
set vpn l2tp remote-access authentication require pap
set vpn l2tp remote-access authentication local-users username XXXX password XXXX
set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret
set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret XXXX
set vpn l2tp remote-access ipsec-settings ike-lifetime 3600
set vpn l2tp remote-access mtu 1492

 

Firewall has been set up as follows:

 

set firewall name WAN_LOCAL rule 3 action accept
set firewall name WAN_LOCAL rule 3 description 'Allow IKE for VPN'
set firewall name WAN_LOCAL rule 3 destination port 500
set firewall name WAN_LOCAL rule 3 log disable
set firewall name WAN_LOCAL rule 3 protocol udp

 

set firewall name WAN_LOCAL rule 4 action accept
set firewall name WAN_LOCAL rule 4 description 'Allow L2TP for VPN'
set firewall name WAN_LOCAL rule 4 destination port 1701
set firewall name WAN_LOCAL rule 4 log disable
set firewall name WAN_LOCAL rule 4 protocol udp

 

set firewall name WAN_LOCAL rule 5 action accept
set firewall name WAN_LOCAL rule 5 description 'Allow ESP for VPN'
set firewall name WAN_LOCAL rule 5 log disable
set firewall name WAN_LOCAL rule 5 protocol esp

 

set firewall name WAN_LOCAL rule 6 action accept
set firewall name WAN_LOCAL rule 6 description 'Allow Nat-T for VPN'
set firewall name WAN_LOCAL rule 6 destination port 4500
set firewall name WAN_LOCAL rule 6 log enable
set firewall name WAN_LOCAL rule 6 protocol udp

 

 

 

Is there anything iam missing?

 

 


Filter this topic showing only the reply marked as answer Create new topic
t0ny

306 posts

Ultimate Geek

Lifetime subscriber

  #1568662 9-Jun-2016 13:33
Send private message

Downgraded to v 1.7 of the firmware and now there is activity. Ill need to spend bit more time looking into it as still not able to connect


t0ny

306 posts

Ultimate Geek

Lifetime subscriber

  #1568663 9-Jun-2016 13:33
Send private message

Downgraded to v 1.7 of the firmware and now there is activity. Ill need to spend bit more time looking into it as still not able to connect


 
 
 
 


Athsetics
3 posts

Wannabe Geek


  #1569809 10-Jun-2016 22:57
Send private message

Hi there.
From briefly looking at it, i think you missed assigning your next outside hop. Whether or not that helps the situation or if there is something else im not sure but ill try and check tommorrow.

The command to add the next outside hop is;
set vpn l2tp remote-access outside-nexthop x.x.x.x

The ip should be your wan default gateway. If you dont know what it is, you should be able to find it on the routes page.

Hope this helps.

EDIT: one thing to note is currently EdgeMAX doesnt natively support a dynamic IP from PPPoE. If this affects you. Let me know and i can show you a way to do it (but its dirty)

JessieB
29 posts

Geek


  #1569872 11-Jun-2016 09:11
Send private message

I have recently got it working with v1.8 and bigpipe. I have a fixed IP. I also think you need to add next hop which the gateway ip which is found in 

 

/var/log/vyatta/ppp_pppoe0.log.

Cheers.

t0ny

306 posts

Ultimate Geek

Lifetime subscriber

  #1570075 11-Jun-2016 17:08
Send private message

Thanks everyone. I have it working now. I had to reset the router to default and start over. My final setup had the PAP configuration taken out and i also added the next hop.


t0ny

306 posts

Ultimate Geek

Lifetime subscriber

  #1570816 13-Jun-2016 08:10
Send private message

Complete set of commands if anyone wants to set up vpn on the edgerouter. If it doesnt work, reset to default config, set up your pppoe0 interface correctly (look here for info) and then run the following commands:

 

configure

 

set vpn ipsec ipsec-interfaces interface pppoe0
set vpn l2tp remote-access outside-address XX.XX.XX.XX
set vpn l2tp remote-access outside-nexthop XX.XX.XX.XX
set vpn ipsec nat-traversal enable
set vpn ipsec nat-networks allowed-network 0.0.0.0/0
set vpn l2tp remote-access client-ip-pool start XX.XX.XX.XX
set vpn l2tp remote-access client-ip-pool stop XX.XX.XX.XX
set vpn l2tp remote-access dns-servers server-1 XX.XX.XX.XX
set vpn l2tp remote-access authentication mode local
set vpn l2tp remote-access authentication local-users username XXXX password XXXX
set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret
set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret XXXX
set vpn l2tp remote-access ipsec-settings ike-lifetime 3600
set vpn l2tp remote-access mtu 1492

 

set firewall name WAN_LOCAL rule 3 action accept
set firewall name WAN_LOCAL rule 3 description 'Allow IKE for VPN'
set firewall name WAN_LOCAL rule 3 destination port 500
set firewall name WAN_LOCAL rule 3 log disable
set firewall name WAN_LOCAL rule 3 protocol udp

 

set firewall name WAN_LOCAL rule 4 action accept
set firewall name WAN_LOCAL rule 4 description 'Allow L2TP for VPN'
set firewall name WAN_LOCAL rule 4 destination port 1701
set firewall name WAN_LOCAL rule 4 log disable
set firewall name WAN_LOCAL rule 4 protocol udp

 

set firewall name WAN_LOCAL rule 5 action accept
set firewall name WAN_LOCAL rule 5 description 'Allow ESP for VPN'
set firewall name WAN_LOCAL rule 5 log disable
set firewall name WAN_LOCAL rule 5 protocol esp

 

set firewall name WAN_LOCAL rule 6 action accept
set firewall name WAN_LOCAL rule 6 description 'Allow Nat-T for VPN'
set firewall name WAN_LOCAL rule 6 destination port 4500
set firewall name WAN_LOCAL rule 6 log enable
set firewall name WAN_LOCAL rule 6 protocol udp

 

commit;save;exit


Filter this topic showing only the reply marked as answer Create new topic





News »

Nanoleaf enhances lighting line with launch of Triangles and Mini Triangles
Posted 17-Oct-2020 20:18


Synology unveils DS16211+
Posted 17-Oct-2020 20:12


Ingram Micro introduces FootfallCam to New Zealand channel
Posted 17-Oct-2020 20:06


Dropbox adopts Virtual First working policy
Posted 17-Oct-2020 19:47


OPPO announces Reno4 Series 5G line-up in NZ
Posted 16-Oct-2020 08:52


Microsoft Highway to a Hundred expands to Asia Pacific
Posted 14-Oct-2020 09:34


Spark turns on 5G in Auckland
Posted 14-Oct-2020 09:29


AMD Launches AMD Ryzen 5000 Series Desktop Processors
Posted 9-Oct-2020 10:13


Teletrac Navman launches integrated multi-camera solution for transport and logistics industry
Posted 8-Oct-2020 10:57


Farmside hits 10,000 RBI customers
Posted 7-Oct-2020 15:32


NordVPN starts deploying colocated servers
Posted 7-Oct-2020 09:00


Google introduces Nest Wifi routers in New Zealand
Posted 7-Oct-2020 05:00


Orcon to bundle Google Nest Wifi router with new accounts
Posted 7-Oct-2020 05:00


Epay and Centrapay partner to create digital gift cards
Posted 2-Oct-2020 17:34


Inseego launches 5G MiFi M2000 mobile hotspot
Posted 2-Oct-2020 14:53









Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.