Set up VPN for a Ubiquiti EdgeRouter

Next, go to vpn > l2tp > remote-access. Enter a description and set an idle timeout between 30 and 86400 seconds.

Remote access settings

dhcp-interface

• If the port configured in step two​ obtains its IP address via DHCP, enter the port name at dhcp-interface, as shown in the screenshot:
• If the port has a static IP address, leave the field dhcp-interface empty and enter the static IP address into the field outside-address instead
• If the port obtains its IP address via PPPoE, leave dhcp-interface empty and enter “0.0.0.0” into the field outside-address

Go to vpn > l2tp > remote-access > authentication and type “local”into the field labeled “mode”:

VPN users are the users who are authorised to access the VPN tunnel - i.e. staff members or family.

Go to vpn > l2tp > remote-access > authentication > local-users > username and enter the name of at least one VPN user. You can add as many VPN users as you wish.

Add VPN users

Once done, select Update List to add the new user entries to the tree.

➔ Note: You can return to this view to add more users later.

Your added users will now appear in the tree as additional branches under username.

For each new user created, repeat the following steps:

• Select the user
• Enter a password
• Optional: Assign a static IP address to the user (i.e. if you need to identify users by specific IP addresses)

Configure user settings

Remember: Your unique user credentials will be required later in the VPN client to access the VPN connection.

Go to vpn > l2tp > remote-access > client-ip-pool and enter the first address of the client IP pool in the start field. Enter the end of the client IP pool in the stop field:

Enter the client IP pool

Note: Users without a static IP address in ​Step Five​ will obtain a random IP address from this pool each time they connect.

IMPORTANT

The address pool may overlap with the address range of your LAN network but it must not overlap with the DHCP range of any network!

Setting up DNS servers is optional. It is only required if VPN clients need to use specific DNS servers once connected to the VPN, e.g. to be able to access devices within the LAN via hostname. More about DNS.

To add DNS servers, go to vpn > l2tp > remote-access > dns-servers:

Optional: Enter DNS server(s)

Important

If you are using DNS, please ensure to also enter DNS server information when you set up your VPN connection in the VPN client later.

Then, enter an IPsec lifetime into the field lifetime. We recommend 28800 seconds (8 hours).

Locate the Ruleset WAN_LOCAL and select Edit Ruleset via the action button on the right:

Important note

If you have deleted the Ruleset WAN_LOCAL or have replaced it by a new Ruleset, you may have to first create a Ruleset or add the following rules to a different Ruleset. The required rules need to be added to a Ruleset that is attached to the WAN interface with direction local. If your WAN interface is named eth0, the Ruleset table should list eth0/local. The default Ruleset named WAN_LOCAL serves this purpose.

Do not add the rules to a Ruleset bound to direction in, as this only affects traffic whose destination lies within any LAN network but not traffic that terminates at the router itself, as is the case for all VPN traffic.

Step three: Create rules

You will now need to add the following rules. Click Add New Rule to set up a new firewall rule and click Save when done with each rule:

IKE

Description: IKE
Action: Accept
Protocol: UDP
Destination > Port: 500

NAT-T

Description: NAT-T
Action: Accept
Protocol: UDP
Destination > Port: 4500

ESP

Description: ESP
Action: Accept
Protocol: Choose a protocol by name > ESP

L2TP

Description: L2TP
Action: Accept
Protocol: UDP

Now switch to the advanced tab:

IPSec: Match inbound IPSec packets
Destination > Port: 1701

Once you've reviewed the newly-added firewall rules, you can complete the VPN setup and move on to the next step.