Mikrotik configuration:
L2TP server:
/interface l2tp-server server
set enabled=yes ipsec-secret=...any.ipsec.secret... use-ipsec=yes service=l2tp
L2TP secret:
/ppp secret
add name=...l2tp.user... password=...l2tp.pass... + local & remote address
IPsec Profile (in debian configuration IKE)
ip ipsec profile print
Flags: * - default
0 * name="default" hash-algorithm=sha1 enc-algorithm=aes-128,3des dh-group=modp2048,modp1024 lifetime=1d proposal-check=obey nat-traversal=yes dpd-interval=2m dpd-maximum-failures=5
IPsec Proposal (in debian configuration ESP)
ip ipsec proposal print
Flags: X - disabled, * - default
0 * name="default" auth-algorithms=sha1 enc-algorithms=3des lifetime=30m pfs-group=modp1024
RaspberryPi install & configuration:
apt install xl2tpd strongswan libstrongswan-extra-plugins
/etc/ipsec.conf
conn %default
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
keyexchange=ikev1
authby=secret
conn myvpn
keyexchange=ikev1
left=%defaultroute
auto=add
authby=secret
type=transport
leftprotoport=17/1701
rightprotoport=17/1701
right=...ipsec.server.ip...
ike=aes-sha1-modp1024!
esp=3des-sha1-modp1024!
/etc/ipsec.secrets
: PSK "...any.ipsec.secret..."
/etc/xl2tpd/xl2tpd.conf
[myl2tp]
lns = ...ipsec.server.ip...
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tpd.client
length bit = yes
/etc/ppp/options.l2tpd.client
ipcp-accept-local
ipcp-accept-remote
refuse-eap
require-chap
noccp
noauth
mtu 1280
mru 1280
noipdefault
#defaultroute
usepeerdns
connect-delay 5000
name ...l2tp.user...
password ...l2tp.pass...
Start:
service strongswan restart
service xl2tpd restart
ipsec up myvpn
...connection 'myvpn' established successfully
echo "c myl2tp" > /var/run/xl2tpd/l2tp-control
ip ad
ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast state UNKNOWN group default qlen 3
link/ppp
inet 172.16.0.250 peer 172.16.0.100/32 scope global ppp0
valid_lft forever preferred_lft forever
ip ro ad A.B.C.D dev ppp0
Links:
L2TP VPN client on Linux Debian
ipsec.conf(5) – Linux man page