I was able to make L2TP VPN work in debian wheezy Raspbian to be able to use with iphones and mac's natively
I'm sorry I don't have comments for the commands, but I extracted this information on several sites and compiled it here.
If you can improve or comment this in anyway, go ahead!
scenario ( change as you need ):
my pi ip address: 192.168.1.112
my gateway address : 192.168.1.254
Lets start:
first Ports 1701 TCP, 4500 UDP and 500 UDP need to be open in the firewall/router and port forwarded!!
Let's start by putting the ip address of the pi static:
ssh pi@192.168.1.112
sudo nano /etc/network/interfaces
Code: Select all
iface eth0 inet static
address 192.168.1.112
netmask 255.255.255.0
gateway 192.168.1.254
Code: Select all
nameserver 192.168.1.254
Code: Select all
sudo passwd
su
apt-get update
apt-get install openswan xl2tpd ppp lsof
Code: Select all
iptables --table nat --append POSTROUTING --jump MASQUERADE
echo "net.ipv4.ip_forward = 1" | tee -a /etc/sysctl.conf
echo "net.ipv4.conf.all.accept_redirects = 0" | tee -a /etc/sysctl.conf
echo "net.ipv4.conf.all.send_redirects = 0" | tee -a /etc/sysctl.conf
for vpn in /proc/sys/net/ipv4/conf/*; do echo 0 > $vpn/accept_redirects; echo 0 > $vpn/send_redirects; done
sysctl -p
nano /etc/rc.local
Code: Select all
for vpn in /proc/sys/net/ipv4/conf/*; do echo 0 > $vpn/accept_redirects; echo 0 > $vpn/send_redirects; done
iptables --table nat --append POSTROUTING --jump MASQUERADE
nano /etc/ipsec.conf
Code: Select all
version 2.0
config setup
nat_traversal=yes
protostack=netkey
virtual_private=%v4:192.168.0.0/16,%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:!10.25$
oe=off
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
# we cannot rekey for %any, let client rekey
rekey=no
# Apple iOS doesn't send delete notify so we need dead peer detection
# to detect vanishing clients
dpddelay=30
dpdtimeout=120
dpdaction=clear
# Set ikelifetime and keylife to same defaults windows has
ikelifetime=8h
keylife=1h
# l2tp-over-ipsec is transport mode
type=transport
#
left=192.168.1.112
#
# For updated Windows 2000/XP clients,
# to support old clients as well, use leftprotoport=17/%any
leftprotoport=17/1701
#
# The remote user.
#
right=%any
# Using the magic port of "%any" means "any one single port". This is
# a work around required for Apple OSX clients that use a randomly
# high port.
rightprotoport=17/%any
#force all to be nat'ed. because of ios
forceencaps=yes
# Normally, KLIPS drops all plaintext traffic from IP's it has a crypted
# connection with. With L2TP clients behind NAT, that's not really what
# you want. The connection below allows both l2tp/ipsec and plaintext
# connections from behind the same NAT router.
# The l2tpd use a leftprotoport, so they are more specific and will be used
# first. Then, packets for the host on different ports and protocols (eg ssh)
# will match this passthrough conn.
conn passthrough-for-non-l2tp
type=passthrough
left=192.168.1.112
leftnexthop=192.168.1.254
right=0.0.0.0
rightsubnet=0.0.0.0/0
auto=route
nano /etc/ipsec.secrets
Code: Select all
192.168.1.112 %any: PSK "TESTSECRET"
nano /etc/xl2tpd/xl2tpd.conf
Code: Select all
[global]
ipsec saref = yes
listen-addr = 192.168.1.112
[lns default]
ip range = 192.168.1.201-192.168.1.250
local ip = 192.168.1.112
assign ip = yes
require chap = yes
refuse pap = yes
require authentication = yes
name = linkVPN
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
nano /etc/ppp/options.xl2tpd
Code: Select all
ipcp-accept-local
ipcp-accept-remote
ms-dns 192.168.1.254
asyncmap 0
auth
crtscts
lock
idle 1800
mtu 1200
mru 1200
modem
debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
nodefaultroute
connect-delay 5000
nano /etc/ppp/chap-secrets################
Code: Select all
# Secrets for authentication using CHAP
# client server secret IP addresses
user * TESTPASS *
Code: Select all
update-rc.d -f ipsec remove
update-rc.d ipsec defaults
Code: Select all
/etc/init.d/xl2tpd restart ; /etc/init.d/ipsec restart
if you want to install a proxy server that compresses the image files to save bandwith on 3g just install ziproxy!
hint: standard port is 8080.
################ZIPROXY################
apt-get install ziproxy
