L2TP VPN using rp-l2tpd

As I wrote in my earlier post, I configured the L2TP tunnel using xl2tpd & rp-l2tpd application. But the primary application “xl2tpd” has a lot of bugs & I was frustrated of its problems. Finally I use rp-l2tpd only to make the L2TP VPN server. Thanks for project administrator of this application, It is almost a bug free L2TP VPN application & also very easy to configure (especially for my case).

Kernel Requirement of rp-l2tpd

ppp_generic: kernel config –> Network device support –> PPP (point-to-point protocol) support
ppp_synctty: kernel config –> Network device support –> PPP support for sync tty ports
slhc(optional): kernel config –> Network device support –> SLIP (serial line) support –> CSLIP compressed headers
n_hdlc: kernel config –> Character devices –> Non-standard serial port support –> HDLC line discipline support

Use the modprobe command to install the above modules:

modprobe ppp_generic

modprobe ppp_synctty

modprobe n_hdlc

If modules not able to load in your system, recompile & install your kernel with those modules.

To load those modules at startup, add above commands at /etc/rc.local or see this link http://www.centos.org/modules/newbb/viewtopic.php?topic_id=15303&forum=37&post_id=53665 if you are using CentOS.

Prepare the rp-l2tpd Server

To configure the rp-l2tpd VPN server, we need a Linux system with least of two network interfaces. I use Centos 5 Linux operating system for my VPN installation. You can also use other Linux’s flavors, but avoid using Fedora Core 8. Fedora Core 8 has some bug in pppd that doesn’t accept the connection from client.

Activate the IP forwarding on the server to send the data of one to interface to other (from ppp tunnel interface to internal LAN interface). Use the following command to activate the IP forwarding.

echo 1 > /proc/sys/net/ipv4/ip_forward

Downloading & Installing rp-l2tpd

You can download rp-l2tpd from http://sourceforge.net/projects/rp-l2tp/. For installation follow the simple procedure.

./configuremakemake install

rp-l2tpd Server Configuration

To configure the rp-l2tpd server, you need to change the following files.

/etc/l2tp/l2tp.conf

/etc/ppp/options

/etc/ppp/chap-secrets

l2tp.conf

This file has the configuration of L2TP server parameters.

# Global section (by default, we start in global mode)global# Load handlers load-handler sync-pppd.so load-handler cmd.so # Bind address listen-port 1701 # Configure the sync-pppd handler.  You MUST have a “section sync-pppd” line # even if you don’t set any options. section sync-pppd # Configure the CHAP for ppp authentication, you can also use require-pap, but avoid this. lns-pppd-opts ”require-chap 10.10.10.1: lcp-echo-interval 30 lcp-echo-failure 6″ # Peer section section peer # For any peer enters the value 0.0.0.0 with mask 0, otherwise specify the static IP address of peer. peer 0.0.0.0 mask 0 port 1701 lac-handler sync-pppd lns-handler sync-pppd hide-avps yes # Configure the cmd handler.  You MUST have a “section cmd” line # even if you don’t set any options. section cmd

I don’t know how we can use mschap-v2 in this configuration file, if anyone knows please reply.

options

/etc/ppp/options file use to configure the pppd options.

ipcp-accept-localipcp-accept-remotems-dns  10.10.10.254 ms-wins 10.10.10.254 noccp auth crtscts idle 1800 mtu 1600 mru 1410 defaultroute debug lock proxyarp connect-delay 5000

Please look at the man page of pppd for detail on this file.

chap-secrets

Put your authentication on /etc/ppp/chap-secrets file.

# Secrets for authentication using CHAP# client        server  secret                  IP addresses”username”      “*”     “password”             ”10.10.10.2″

The IP address field is showing the remote tunnel static IP address. You can assign the dynamic IP addresses also by using radius server & dhcp-pppd plugin etc. Same chap-secrets file can be used, if you are using mschap protocol in option file.

Running rp-l2tpd

That’s all from the server configuration side, now you can start the rp-l2tpd server, use the following command.

l2tpd -f -d 65535

“-f” is used to run l2tpd in foreground & “-d 65535” is used to open the debugs at highest level.

rp-l2tpd Client Configuration

The only change in the client configuration is in l2tp.conf file. For client, it is something like this

# Global section (by default, we start in global mode)global# Load handlers load-handler sync-pppd.so load-handler cmd.so # Bind address listen-port 1701 # Configure the sync-pppd handler.  You MUST have a “section sync-pppd” line # even if you don’t set any options. section sync-pppd lac-pppd-opts ”user nameofuser noipdefault ipcp-accept-local ipcp-accept-remote lcp-echo-interval 30 lcp-echo-failure 6″ # Peer section to connect with server section peer # Replace 51.52.53.54 with your VPN server IP address peer 51.52.53.54 port 1701 lac-handler sync-pppd hide-avps no # Configure the cmd handler.  You MUST have a “section cmd” line # even if you don’t set any options. section cmd

In case of option file use the following entries only.

lock noauth

The user name i.e. used in the l2tp.conf file must enter in client’s chap-secrets file.

# Secrets for authentication using CHAP

# client        server  secret                  IP addresses

“username”      “*”     “password”             ”*”

Running L2TP Client

To run the rp-l2tpd client, first start the l2tpd service.

l2tpd -f -d 65535

Then set up the connection with your L2TP VPN server by using following command.

l2tp-control “start-session 51.52.53.54″

If you give the ifconfig command it will show you a ppp0 connection when l2tp is connected.

Stopping L2TP Client

Use the following command to stop the L2TP client session.

l2tp-control stop-session “your-Tunnel-ID your-Session-LAC-ID”

To check what is your Tunnel-ID & Session-LAC-ID, use the following command.

l2tp-control “dump-sessions”

To stop all the connected sessions, use following command.

l2tp-control “exit”