How To Set Up A L2TP/IPSec VPN In A VPS

As mentioned before, PPTP VPN may be not workable for Mac OS X, at least mine, so that I have to use L2TP/IPSec (L2TP over IPSec) VPN.

This post will show you how to set up a L2TP/IPSec VPN in a VPS, and what you need are a Xen VPS and a computer. Same as the PPTP tutorial, the following steps are based on the Terminal application of Mac, for Linux, the steps will be nearly the same, and for Windows, you need to install Putty first.

By the way, make sure you are using Ubuntu 11.04, since the lower versions (at least Ubuntu 10.04 LTS Lucid 64Bit) may be not workable. Here we go:

I. Connect to your VPS

Run your Terminal, and enter the following command:

ssh [email protected]

Just replace "xxx.xxx.xxx.xxx" with your VPS’ IP, such as "178.18.17.30".

Then you will see the following message:

Are you sure you want to continue connecting (yes/no)?

Enter "yes" and press the "Return" key, then, enter your password and press the "Return" key.

P.S.:

If you’ve rebuilt your VPS, you may meet the following error:

Host key verification failed.

In that case, enter the following command at first:

ssh-keygen -R xxx.xxx.xxx.xxx

Remember to replace "xxx.xxx.xxx.xxx" with your VPS’ IP address.

II. Install OpenSwan

Although you can enter the command "aptitude install openswan" to install OpenSwan directly, it was not workable during my test in two different VPS, so you’d better get OpenSwan from its official website and install.

1. Enter the following command:

aptitude install build-essential

Press the "Return" key, then enter "y" and press the "Return" key again.

2. Enter the following command:

aptitude install libgmp3-dev gawk flex bison

Press the "Return" key, then enter "y" and press the "Return" key again.

3. Enter the following command:

wget http://www.openswan.org/download/openswan-2.6.35.tar.gz

Press the "Return" key.

4. Enter the following command:

tar xzvf openswan-2.6.35.tar.gz

Press the "Return" key.

5. Enter the following command:

cd openswan-2.6.35

Press the "Return" key.

6. Enter the following command:

make programs

Press the "Return" key.

7. Enter the following command:

make install

Press the "Return" key.

P.S.:

a. 2.6.35 is the latest version now, and you can check the OpenSwan website to see if there is a new version later, if yes, you can use it instead of this one.

b. When it says "Enter" something, you can always copy and paste it.

III. Edit IPSec

While OpenSwan is used for IPSec, IPSec is used for L2TP.

1. Enter the following command:

vi /etc/ipsec.conf

Press the "Return" key，enter "dG" to delete all the existing contents, and press the "i" key, then copy and paste the following ones:

version 2.0
config setup
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
    oe=off
    protostack=netkey

conn %default
    forceencaps=yes

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=YOUR.VPS.IP.ADDRESS
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any

Remember to change YOUR.VPS.IP.ADDRESS to your VPS’ IP address, such as 178.18.17.30 for this post. To do so, press the "ESC" key to quit the insert mode, move the cursor to the "Y" letter, press the "i" key, enter your IP address, then press the "ESC" key, and move the cursor over the "YOUR.VPS.IP.ADDRESS" characters to delete them one by one by pressing the "x" key. Or you can edit the contents with Notepad or Stickies and paste them into your Terminal without any edition later.

After that, enter ":wq", then press the "Return" key to save.

P.S.:

You need to press the "i" key before you insert anything, and press the "ESC" key to quit the insert mode, or there will be something wrong.

2. Enter the following command:

vi /etc/ipsec.secrets

Press the "Return" key, and press the "i" key, then enter the following content:

YOUR.VPS.IP.ADDRESS %any: PSK “YourSharedSecret”

For example:

178.18.17.30 %any: PSK “123456abcdef”

(Tips: You need to press the Tab key to make a pace among each value.)

Then press the "ESC" key, enter ":wq", and press the "Return" key to save.

3. Enter the following commands one by one:

for each in /proc/sys/net/ipv4/conf/*
do
echo 0 > $each/accept_redirects
echo 0 > $each/send_redirects
done

Remember to press the "Return" key after every command.

4. Enter the following command:

service ipsec restart

And then press the "Return" key.

P.S.:

Enter "ipsec verify", press the "Return" key, if everything is right, then you will see the results as the following image:

If not, double check the above steps, especially the "ipsec.conf" settings.

IV. Install L2TP

Based on IPSec, L2TP is used for VPN.

1. Enter the following command:

cd ..

Press the "Return" key and go back to the root.

2. Enter the following command:

aptitude install xl2tpd

Press the "Return" key, enter "y" and press the "Return" key again.

3. Enter the following command:

vi /etc/xl2tpd/xl2tpd.conf

And enter "dG" to delete all the existing contents, then press the "i" key, and paste the following contents:

[global]
; listen-addr = 192.168.1.98

[lns default]
ip range = 10.1.1.2-10.1.1.255
local ip = 10.1.1.1
require chap = yes
refuse pap = yes
require authentication = yes
name = LinuxVPNserver
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

Then press the "ESC" key, enter ":wq", and press the "Return" key to save.

V. Set up xl2tpd

Supposed that your VPS has PPP support already, if not, enter "aptitude install ppp" before the following steps:

1. Enter the following command:

vi /etc/ppp/options.xl2tpd

Press the "Return" key, and press the "i" key, then paste the following codes:

require-mschap-v2
ms-dns 8.8.8.8
ms-dns 8.8.4.4
asyncmap 0
auth
crtscts
lock
hide-password
modem
debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4

Then press the “ESC” key, enter “:wq”, and press the “Return” key to save it.

P.S.:

You can also replace 8.8.8.8 & 8.8.4.4 with 208.67.222.222 & 208.67.220.220.

2. Enter the following command:

vi /etc/ppp/chap-secrets

Press the "Return" key, then press the "i" key to enter the following contents:

username l2tpd password *

For example:

freenuts l2tpd 123456 *

Again, remember to use the "tab" key for a space, and enter “:wq” to save it.

3. Enter the following command:

service xl2tpd restart

Press the "Return" key.

VI. IP forward

This step will let your VPN connect with the whole internet world:

1. Enter the following command:

vi /etc/sysctl.conf

Press the "Return" key, find the line of "#net.ipv4.ip_forward=1" and remove the "#" by pressing the "x", then press "ESC", enter ":wq" to save it.

2. Enter the following command:

sysctl -p

Press the "Return" key, then you will only see "net.ipv4.ip_forward=1" as the result if everything is right.

3. Enter the following command:

iptables -t nat -A POSTROUTING -s 10.1.1.0/24 -o eth0 -j MASQUERADE

Now, you can connect your L2TP/IPSec VPN and use it to get access to any blocked sites, but if you reboot your VPS, your forwarding settings will be gone, to avoid this, you can enter the following command:

vi /etc/rc.local

Press the "Return" key and paste the following contents before the "exit 0" line:

for each in /proc/sys/net/ipv4/conf/*
do
echo 0 > $each/accept_redirects
echo 0 > $each/send_redirects
done
iptables -t nat -A POSTROUTING -s 10.1.1.0/24 -o eth0 -j MASQUERADE
/etc/init.d/ipsec restart

Save it, then you are done.

Bonus:

The following is a L2TP/IPSec VPN account created in a 2Host VPS according to the above tutorials:

Server Address: 178.18.17.30
Account Name: freenuts
Password: 123456
Shared Secret: 123456abcdef

The above VPN will be free and available for a month, and you can check out this post for how to use it in your computer and mobile phone.