OpenWrt Forum Archive

Topic: Correct firewall setup for L2TP/IPsec VPN server behind OpenWrt router

The content of this topic has been archived on 8 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Post #1
aXon
26 Sep 2012, 13:50

Hello,

I am running OpenWrt 12.09 beta on a TP-Link WDR4300
My experimental setup is as following:
FreeeBSD server w/ VPN service on 10.0.0.2 <-> OpenWrt router on 10.0.0.1 <-> internet <-> road warrior.
The server is running a MPD5/racoon setup and when I try to connect it does not seem to work properly i.e. the connection times out therefore I thought it has something to do with my firewall setup on the router.
Simple services such as OpenVPN are no problem as all they need are just a single port forward to the server.
But I cannot get the VPN service to work with ports 1701, 500 and 4500 on UDP and am not sure if my firewall settings are correct, as most tutorials only focus on OpenWRT being the VPN server:

config redirect                                          
        option target DNAT                               
        option src 'wan'                                 
        option dest 'lan'                                
        option name 'GRE protocol passthrough'           
        option proto 'gre'                                
        option dest_ip 10.0.0.2   

config redirect                                                          
        option target 'DNAT'                                                    
        option src 'wan'                
        option dest 'lan'           
        option proto 'udp'          
        option src_dport '500'       
        option dest_port '500'      
        option dest_ip 10.0.0.2        
        option name 'IPsec IKE'               
                                              
# IPsec/NAT-T                                 
config redirect                               
        option 'target' 'DNAT'                
        option 'name' 'IPsec NAT-T'           
        option 'src' 'wan'                    
        option dest     lan                     
        option 'proto' 'udp'                  
        option src_dport 4500                 
        option 'dest_port' '4500'                        
        option dest_ip 10.0.0.2  

config redirect                                                          
    option 'target' 'DNAT'                                               
    option 'name' 'L2TP'                                                 
    option 'src' 'wan'                                                   
    option dest lan                                                      
    option 'proto' 'udp'                                                 
    option 'dest_port' '1701'                                            
    option dest_ip 10.0.0.2                                           
    option src_dport 1701

Maybe someone can shed some light on how to setup a proper passthrough to a server behind an OpenWrt router.

cheers,
axon

Post #2
maurer
26 Sep 2012, 16:25

i cannot give you an exact config but i can share my working firewall config - but the l2tp/ipsec is local on the openwrt router:

# IPsec/NAT-T
config 'rule'
        option 'target' 'ACCEPT'
        option 'name' 'IPsec NAT-T'
        option 'src' 'wan'
        option 'proto' 'udp'
        option 'dest_port' '4500'

# IPsec/IKE
config 'rule'
        option 'target' 'ACCEPT'
        option 'name' 'IPsec IKE'
        option 'src' 'wan'
        option 'proto' 'udp'
        option 'dest_port' '500'

# IPsec/ESP
config 'rule'
        option 'target' 'ACCEPT'
        option 'name' 'IPsec ESP'
        option 'src' 'wan'
        option 'proto' 'esp'

# L2TP/ESP
config 'rule'
        option 'target' 'ACCEPT'
        option 'name' 'L2TP ESP'
        option 'src' 'wan'
        option 'proto' 'udp'
        option 'dest_port' '1701'
        option 'extra' '-m policy --strict --dir in --pol ipsec --proto esp'
Post #3
GTA_doum
12 Sep 2017, 17:39

Hello,
I have the same issue as aXon, cannot figure out a config that let a L2TP/IPSec VPN server behind the router to work.
Is there any web page detailing the proper configuration, or anyone has a working config, for a VPN server behind the router?

The discussion might have continued from here.