1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
|
.. _l2tp:
L2TP
----
VyOS utilizes accel-ppp_ to provide L2TP server functionality. It can be used
with local authentication or a connected RADIUS server.
L2TP over IPsec
===============
Example for configuring a simple L2TP over IPsec VPN for remote access (works
with native Windows and Mac VPN clients):
.. code-block:: none
set vpn ipsec interface eth0
set vpn l2tp remote-access outside-address 192.0.2.2
set vpn l2tp remote-access client-ip-pool start 192.168.255.2
set vpn l2tp remote-access client-ip-pool stop 192.168.255.254
set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret
set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret <secret>
set vpn l2tp remote-access authentication mode local
set vpn l2tp remote-access authentication local-users username test password 'test'
In the above example, an external IP of 192.0.2.2 is assumed.
If a local firewall policy is in place on your external interface you will need
to allow the ports below:
* UDP port 500 (IKE)
* IP protocol number 50 (ESP)
* UDP port 1701 for IPsec
As well as the below to allow NAT-traversal (when NAT is detected by the
VPN client, ESP is encapsulated in UDP for NAT-traversal):
* UDP port 4500 (NAT-T)
Example:
.. code-block:: none
set firewall name OUTSIDE-LOCAL rule 40 action 'accept'
set firewall name OUTSIDE-LOCAL rule 40 protocol 'esp'
set firewall name OUTSIDE-LOCAL rule 41 action 'accept'
set firewall name OUTSIDE-LOCAL rule 41 destination port '500'
set firewall name OUTSIDE-LOCAL rule 41 protocol 'udp'
set firewall name OUTSIDE-LOCAL rule 42 action 'accept'
set firewall name OUTSIDE-LOCAL rule 42 destination port '4500'
set firewall name OUTSIDE-LOCAL rule 42 protocol 'udp'
set firewall name OUTSIDE-LOCAL rule 43 action 'accept'
set firewall name OUTSIDE-LOCAL rule 43 destination port '1701'
set firewall name OUTSIDE-LOCAL rule 43 ipsec 'match-ipsec'
set firewall name OUTSIDE-LOCAL rule 43 protocol 'udp'
To allow VPN-clients access via your external address, a NAT rule is required:
.. code-block:: none
set nat source rule 110 outbound-interface 'eth0'
set nat source rule 110 source address '192.168.255.0/24'
set nat source rule 110 translation address masquerade
VPN-clients will request configuration parameters, optionally you can DNS
parameter to the client.
.. code-block:: none
set vpn l2tp remote-access name-server '198.51.100.8'
set vpn l2tp remote-access name-server '198.51.100.4'
Established sessions can be viewed using the **show l2tp-server sessions**
operational command
.. code-block:: none
vyos@vyos:~$ show l2tp-server sessions
ifname | username | ip | ip6 | ip6-dp | calling-sid | rate-limit | state | uptime | rx-bytes | tx-bytes
--------+----------+---------------+-----+--------+-------------+------------+--------+----------+----------+----------
l2tp0 | test | 192.168.255.3 | | | 192.168.0.36 | | active | 02:01:47 | 7.7 KiB | 1.2 KiB
LNS (L2TP Network Server)
=========================
LNS are often used to connect to a LAC (L2TP Access Concentrator).
Below is an example to configure a LNS:
.. code-block:: none
set vpn l2tp remote-access outside-address 192.0.2.2
set vpn l2tp remote-access client-ip-pool start 192.168.255.2
set vpn l2tp remote-access client-ip-pool stop 192.168.255.254
set vpn l2tp remote-access lns shared-secret 'secret'
set vpn l2tp remote-access ccp-disable
set vpn l2tp remote-access authentication mode local
set vpn l2tp remote-access authentication local-users username test password 'test'
The example above uses 192.0.2.2 as external IP address. A LAC normally requires
an authentication password, which is set in the example configuration to
``lns shared-secret 'secret'``. This setup requires the Compression Control
Protocol (CCP) being disabled, the command ``set vpn l2tp remote-access
ccp-disable`` accomplishes that.
Bandwidth Shaping
=================
Bandwidth rate limits can be set for local users or via RADIUS based attributes.
Bandwidth Shaping for local users
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The rate-limit is set in kbit/sec.
.. code-block:: none
set vpn l2tp remote-access outside-address 192.0.2.2
set vpn l2tp remote-access client-ip-pool start 192.168.255.2
set vpn l2tp remote-access client-ip-pool stop 192.168.255.254
set vpn l2tp remote-access authentication mode local
set vpn l2tp remote-access authentication local-users username test password test
set vpn l2tp remote-access authentication local-users username test rate-limit download 20480
set vpn l2tp remote-access authentication local-users username test rate-limit upload 10240
vyos@vyos:~$ show l2tp-server sessions
ifname | username | ip | ip6 | ip6-dp | calling-sid | rate-limit | state | uptime | rx-bytes | tx-bytes
--------+----------+---------------+-----+--------+-------------+------------+--------+----------+----------+----------
l2tp0 | test | 192.168.255.3 | | | 192.168.0.36 | | active | 02:01:47 | 7.7 KiB | 1.2 KiB
RADIUS authentication
======================
To enable RADIUS based authentication, the authentication mode needs to be
changed within the configuration. Previous settings like the local users, still
exists within the configuration, however they are not used if the mode has been
changed from local to radius. Once changed back to local, it will use all local
accounts again.
.. code-block:: none
set vpn l2tp remote-access authentication mode <local|radius>
Since the RADIUS server would be a single point of failure, multiple RADIUS
servers can be setup and will be used subsequentially.
.. code-block:: none
set vpn l2tp remote-access authentication radius server 10.0.0.1 key 'foo'
set vpn l2tp remote-access authentication radius server 10.0.0.2 key 'foo'
.. note:: Some RADIUS_ severs use an access control list which allows or denies
queries, make sure to add your VyOS router to the allowed client list.
RADIUS source address
^^^^^^^^^^^^^^^^^^^^^
If you are using OSPF as IGP, always the closest interface connected to the
RADIUS server is used. With VyOS 1.2 you can bind all outgoing RADIUS requests
to a single source IP e.g. the loopback interface.
.. code-block:: none
set vpn l2tp remote-access authentication radius source-address 10.0.0.3
Above command will use `10.0.0.3` as source IPv4 address for all RADIUS queries
on this NAS.
.. note:: The ``source-address`` must be configured on one of VyOS interface.
Best practice would be a loopback or dummy interface.
RADIUS bandwidth shaping attribute
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
To enable bandwidth shaping via RADIUS, the option rate-limit needs to be
enabled.
.. code-block:: none
set vpn l2tp remote-access authentication radius rate-limit enable
The default RADIUS attribute for rate limiting is ``Filter-Id``, but you may
also redefine it.
.. code-block:: none
set vpn l2tp remote-access authentication radius rate-limit attribute Download-Speed
.. note:: If you set a custom RADIUS attribute you must define it on both
dictionaries at RADIUS server and client, which is the vyos router in our
example.
The RADIUS dictionaries in VyOS are located at ``/usr/share/accel-ppp/radius/``
RADIUS advanced features
^^^^^^^^^^^^^^^^^^^^^^^^
Received RADIUS attributes have a higher priority than parameters defined within
the CLI configuration, refer to the explanation below.
Allocation clients ip addresses by RADIUS
*****************************************
If the RADIUS server sends the attribute ``Framed-IP-Address`` then this IP
address will be allocated to the client and the option ip-pool within the CLI
config is being ignored.
Renaming clients interfaces by RADIUS
*************************************
If the RADIUS server uses the attribute ``NAS-Port-Id``, ppp tunnels will be
renamed.
.. note:: The value of the attribute ``NAS-Port-Id`` must be less than 16
characters, otherwise the interface won't be renamed.
.. _`Google Public DNS`: https://developers.google.com/speed/public-dns
.. _Quad9: https://quad9.net
.. _CloudFlare: https://blog.cloudflare.com/announcing-1111
.. _OpenNIC: https://www.opennic.org/
.. _RADIUS: https://en.wikipedia.org/wiki/RADIUS
.. _FreeRADIUS: https://freeradius.org
.. _`Network Policy Server`: https://en.wikipedia.org/wiki/Network_Policy_Server
.. _accel-ppp: https://accel-ppp.org/
|
