Documentation
VyOS Documentation
VPN on VyOS
L2TP/IPsec VPN

L2TP/IPsec VPN

L2TP (Layer 2 Tunneling Protocol) combined with IPsec provides remote access VPN with broad client support. L2TP/IPsec is built into most operating systems (Windows, macOS, iOS, Android), which makes it a popular choice for remote access VPN without the need to install third-party software.

Overview

What is L2TP/IPsec

L2TP (Layer 2 Tunneling Protocol):

  • Layer 2 (Data Link) tunneling protocol
  • Encapsulates PPP frames
  • Does not provide encryption on its own

IPsec:

  • Provides encryption and authentication
  • Protects L2TP traffic
  • ESP (Encapsulating Security Payload) mode

L2TP/IPsec combination:

  • L2TP for tunneling
  • IPsec for security
  • Standardized solution (RFC 3193)

Advantages of L2TP/IPsec

Pros:

  • Native clients in the OS (Windows, macOS, iOS, Android)
  • No third-party software required
  • Good compatibility
  • Simple client configuration
  • Suitable for BYOD (Bring Your Own Device)

Cons:

  • Slower than modern VPNs (WireGuard, OpenVPN)
  • NAT traversal issues (addressed by NAT-T)
  • Aging technology
  • Less secure than modern alternatives
  • Uses UDP 500, 4500, 1701 (may be blocked by firewalls)

When to use L2TP/IPsec

Use L2TP/IPsec when:

  • VPN clients cannot be installed
  • BYOD scenarios
  • Legacy compatibility is required
  • Ease of use for end users is critical

Use alternatives when:

  • Performance matters → WireGuard
  • Cross-platform with performance → OpenVPN
  • Maximum security → WireGuard or OpenVPN

Architecture

L2TP/IPsec components

  1. L2TP Access Concentrator (LAC) - VyOS server
  2. L2TP Network Server (LNS) - VyOS server (same)
  3. IPsec SA - Security Association for encryption
  4. PPP - Point-to-Point Protocol for authentication

Connection process

  1. IPsec IKE negotiation (UDP 500)
  2. IPsec ESP tunnel is created (UDP 4500 with NAT-T)
  3. L2TP tunnel is established (UDP 1701)
  4. PPP negotiation - authentication (CHAP/PAP)
  5. IP address assignment - the client receives an IP

Ports

  • UDP 500 - IKE (Internet Key Exchange)
  • UDP 4500 - IPsec NAT-T (NAT Traversal)
  • UDP 1701 - L2TP
  • ESP (IP Protocol 50) - IPsec encryption

Basic configuration

Simple L2TP/IPsec server

# IPsec configuration for L2TP
set vpn ipsec authentication psk l2tp id '203.0.113.1'
set vpn ipsec authentication psk l2tp id '%any'
set vpn ipsec authentication psk l2tp secret 'MyStrongPSK123!'

# IKE group for L2TP
set vpn ipsec ike-group IKE-L2TP key-exchange 'ikev1'
set vpn ipsec ike-group IKE-L2TP lifetime '3600'
set vpn ipsec ike-group IKE-L2TP proposal 1 dh-group '2'
set vpn ipsec ike-group IKE-L2TP proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-L2TP proposal 1 hash 'sha1'

# ESP group for L2TP
set vpn ipsec esp-group ESP-L2TP lifetime '3600'
set vpn ipsec esp-group ESP-L2TP mode 'transport'
set vpn ipsec esp-group ESP-L2TP pfs 'disable'
set vpn ipsec esp-group ESP-L2TP proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-L2TP proposal 1 hash 'sha1'

# IPsec site-to-site for remote access
set vpn ipsec site-to-site peer l2tp-remote authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer l2tp-remote authentication pre-shared-secret 'l2tp'
set vpn ipsec site-to-site peer l2tp-remote connection-type 'respond'
set vpn ipsec site-to-site peer l2tp-remote ike-group 'IKE-L2TP'
set vpn ipsec site-to-site peer l2tp-remote default-esp-group 'ESP-L2TP'
set vpn ipsec site-to-site peer l2tp-remote local-address '203.0.113.1'
set vpn ipsec site-to-site peer l2tp-remote remote-address '0.0.0.0/0'

# L2TP server
set vpn l2tp remote-access authentication mode 'local'
set vpn l2tp remote-access authentication local-users username alice password 'AlicePass123!'
set vpn l2tp remote-access authentication local-users username bob password 'BobPass456!'

# Client IP pool
set vpn l2tp remote-access client-ip-pool start '192.168.255.10'
set vpn l2tp remote-access client-ip-pool stop '192.168.255.50'

# Gateway IP
set vpn l2tp remote-access gateway-address '192.168.255.1'

# DNS for clients
set vpn l2tp remote-access name-server '8.8.8.8'
set vpn l2tp remote-access name-server '1.1.1.1'

# Firewall for L2TP/IPsec
set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 destination port 500,4500,1701
set firewall ipv4 input filter rule 100 protocol udp

set firewall ipv4 input filter rule 101 action accept
set firewall ipv4 input filter rule 101 protocol esp

# NAT for clients
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.255.0/24
set nat source rule 100 translation address masquerade

commit
save

Verifying L2TP/IPsec

# IPsec status
show vpn ipsec sa

# L2TP sessions
show vpn l2tp remote-access sessions

# Connected users
show vpn l2tp remote-access users

# Logs
show log vpn

Authentication

Local authentication

Users are stored in the VyOS configuration:

set vpn l2tp remote-access authentication mode 'local'

# Users
set vpn l2tp remote-access authentication local-users username user1 password 'Pass1!'
set vpn l2tp remote-access authentication local-users username user2 password 'Pass2!'
set vpn l2tp remote-access authentication local-users username user3 password 'Pass3!'

# Static IPs for users
set vpn l2tp remote-access authentication local-users username user1 static-ip '192.168.255.10'
set vpn l2tp remote-access authentication local-users username user2 static-ip '192.168.255.11'

commit

RADIUS authentication

Centralized authentication via RADIUS:

set vpn l2tp remote-access authentication mode 'radius'

# RADIUS servers
set vpn l2tp remote-access authentication radius server 192.168.1.10 key 'RadiusSecret123!'
set vpn l2tp remote-access authentication radius server 192.168.1.11 key 'RadiusSecret123!'

# Timeout
set vpn l2tp remote-access authentication radius timeout 5

# Accounting
set vpn l2tp remote-access authentication radius acct-timeout 5

commit

Require options

# Require MSCHAP-v2
set vpn l2tp remote-access authentication require 'mschap-v2'

# Or CHAP
set vpn l2tp remote-access authentication require 'chap'

# Disallow weak authentication
set vpn l2tp remote-access authentication protocols pap disable
set vpn l2tp remote-access authentication protocols chap disable

commit

Advanced configuration

MTU and MRU tuning

# MTU for L2TP
set vpn l2tp remote-access mtu 1400

# MRU (Maximum Receive Unit)
set vpn l2tp remote-access mru 1400

commit

Recommendation: MTU 1400 to account for IPsec/L2TP overhead.

Idle timeout

# Disconnect clients on inactivity (seconds)
set vpn l2tp remote-access idle-timeout 3600

commit

WINS server

For Windows clients:

set vpn l2tp remote-access wins-server 192.168.1.100

commit

LNS (L2TP Network Server) settings

# Maximum sessions
set vpn l2tp remote-access maximum-sessions 100

# Listen address
set vpn l2tp remote-access outside-address '203.0.113.1'

commit

PPP options

# PPP interface prefix
set vpn l2tp remote-access ppp-options interface-cache 10

# LCP echo for keepalive
set vpn l2tp remote-access ppp-options lcp-echo-failure 3
set vpn l2tp remote-access ppp-options lcp-echo-interval 30

# IPv6 support
set vpn l2tp remote-access ppp-options ipv6 'allow'

commit

Client IP pool with multiple ranges

# Pool 1
set vpn l2tp remote-access client-ip-pool start '192.168.255.10'
set vpn l2tp remote-access client-ip-pool stop '192.168.255.100'

# VyOS does not support multiple pools directly
# Use RADIUS for dynamic IP assignment

commit

Compression

# MPPE encryption (Microsoft Point-to-Point Encryption)
set vpn l2tp remote-access ppp-options mppe 'require-128'

commit

Client configuration

Windows client

Windows 10/11:

  1. Settings → Network & Internet → VPN
  2. Add a VPN connection
  3. VPN provider: Windows (built-in)
  4. Connection name: Company VPN
  5. Server name or address: vpn.company.com or 203.0.113.1
  6. VPN type: L2TP/IPsec with pre-shared key
  7. Pre-shared key: MyStrongPSK123!
  8. User name: alice
  9. Password: AlicePass123!
  10. Save → Connect

PowerShell:

Add-VpnConnection -Name "Company VPN" `
  -ServerAddress "vpn.company.com" `
  -TunnelType L2tp `
  -EncryptionLevel Required `
  -AuthenticationMethod Chap,MSChapv2 `
  -L2tpPsk "MyStrongPSK123!" `
  -Force `
  -RememberCredential `
  -PassThru

macOS client

  1. System Preferences → Network
  2. Click “+” to add a new connection
  3. Interface: VPN
  4. VPN Type: L2TP over IPSec
  5. Service Name: Company VPN
  6. Server Address: vpn.company.com
  7. Account Name: alice
  8. Authentication Settings:
    • User Authentication: Password
    • Machine Authentication: Shared Secret
    • Shared Secret: MyStrongPSK123!
  9. Advanced: Send all traffic over VPN (optional)
  10. Apply → Connect

iOS client

  1. Settings → General → VPN → Add VPN Configuration
  2. Type: L2TP
  3. Description: Company VPN
  4. Server: vpn.company.com
  5. Account: alice
  6. Password: AlicePass123!
  7. Secret: MyStrongPSK123!
  8. Send All Traffic: On
  9. Save → Connect (toggle VPN on)

Android client

  1. Settings → Network & Internet → VPN
  2. Add VPN
  3. Name: Company VPN
  4. Type: L2TP/IPSec PSK
  5. Server address: vpn.company.com
  6. IPSec pre-shared key: MyStrongPSK123!
  7. Username: alice
  8. Password: AlicePass123!
  9. Save → Connect

Linux client (NetworkManager)

# Installation
sudo apt-get install network-manager-l2tp network-manager-l2tp-gnome

# GUI: NetworkManager → Add VPN → L2TP
# Server: vpn.company.com
# Username: alice
# Password: AlicePass123!
# IPSec Settings: Pre-shared key: MyStrongPSK123!

xl2tpd manual:

# Installation
sudo apt-get install xl2tpd strongswan

# /etc/ipsec.conf
conn L2TP-PSK
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=%defaultroute
    leftprotoport=17/1701
    right=203.0.113.1
    rightprotoport=17/1701

# /etc/ipsec.secrets
: PSK "MyStrongPSK123!"

# /etc/xl2tpd/xl2tpd.conf
[lac company]
lns = 203.0.113.1
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tpd.client
length bit = yes

# /etc/ppp/options.l2tpd.client
ipcp-accept-local
ipcp-accept-remote
refuse-eap
require-chap
noccp
noauth
mtu 1400
mru 1400
defaultroute
usepeerdns
connect-delay 5000
name alice
password AlicePass123!

# Connect
sudo ipsec up L2TP-PSK
sudo xl2tpd-control connect company

Split tunnel vs full tunnel

Full tunnel (all traffic through the VPN)

By default L2TP pushes a default route:

# On VyOS (default)
# Clients automatically receive a default route through the VPN

commit

Client (Windows): “Send all traffic over VPN” enabled.

Split tunnel (corporate traffic only)

For split tunnel you must configure the client manually.

Windows PowerShell:

# After connecting, add only the required routes
Add-VpnConnectionRoute -ConnectionName "Company VPN" -DestinationPrefix 192.168.0.0/16
Add-VpnConnectionRoute -ConnectionName "Company VPN" -DestinationPrefix 10.0.0.0/8

# Disable "Send all traffic"
Set-VpnConnection -Name "Company VPN" -SplitTunneling $True

macOS/Linux: Configure routing manually after connecting.

Monitoring and diagnostics

Checking L2TP sessions

# Active sessions
show vpn l2tp remote-access sessions

# Details
show vpn l2tp remote-access users

# Statistics
show vpn l2tp remote-access statistics

Example output:

User      Interface  IP Address       Calling Station  Time
alice     ppp0       192.168.255.10   198.51.100.50    00:15:32
bob       ppp1       192.168.255.11   198.51.100.51    01:23:45

Checking IPsec

# IPsec SA
show vpn ipsec sa

# Peer details
show vpn ipsec sa peer 198.51.100.50

Checking connectivity

# Ping the client
ping 192.168.255.10

# On the client, ping the gateway
ping 192.168.255.1

# Ping through the VPN
ping 192.168.1.10  # Internal resource

Logs

# VPN logs
show log vpn

# Live monitoring
monitor log vpn

# L2TP specific
show log | grep l2tp

# IPsec specific
show log | grep ipsec

tcpdump

# L2TP traffic (after IPsec decryption)
sudo tcpdump -i ppp0 -n

# IPsec ESP (encrypted)
sudo tcpdump -i eth0 esp -n

# IKE negotiation
sudo tcpdump -i eth0 port 500 -n

Troubleshooting

Client cannot connect

Problem: The connection hangs or is refused.

Causes:

  1. Firewall blocks the ports
  2. PSK mismatch
  3. IPsec does not establish
  4. NAT traversal issues

Diagnostics:

# Check the firewall
show firewall ipv4 input filter

# Check the IPsec SA
show vpn ipsec sa

# Check the logs
show log vpn | grep error

Solution:

# Firewall rules
set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 destination port 500,4500,1701
set firewall ipv4 input filter rule 100 protocol udp

set firewall ipv4 input filter rule 101 action accept
set firewall ipv4 input filter rule 101 protocol esp

# Check the PSK
show vpn ipsec authentication psk

commit

IPsec establishes, but L2TP does not work

Problem: The IPsec SA shows UP, but the L2TP tunnel is not created.

Causes:

  1. UDP 1701 is blocked
  2. The L2TP service is not running
  3. Authentication fails

Diagnostics:

# Check the L2TP service
systemctl status xl2tpd

# Check the L2TP port
netstat -ulnp | grep 1701

# Logs
show log vpn | grep l2tp

Solution:

# Restart L2TP
restart vpn l2tp

# Check users
show configuration vpn l2tp remote-access authentication local-users

Authentication fails

Problem: “Authentication failed” on the client.

Causes:

  1. Incorrect username/password
  2. A different auth protocol is required
  3. RADIUS is unavailable

Diagnostics:

# Check users
show configuration vpn l2tp remote-access authentication

# RADIUS test
show vpn l2tp remote-access authentication radius

Solution:

# Check the password
show configuration vpn l2tp remote-access authentication local-users username alice

# Allow different auth protocols
delete vpn l2tp remote-access authentication require

commit

No access to the local network

Problem: The VPN is connected, but there is no access to resources.

Causes:

  1. Firewall blocks VPN clients
  2. NAT is not configured
  3. Routing problems

Diagnostics:

# Check routing
show ip route

# Ping from a VPN client
# On VyOS:
ping 192.168.255.10  # VPN client

# Check firewall forward
show firewall ipv4 forward filter

Solution:

# Firewall for VPN clients
set firewall ipv4 forward filter rule 200 action accept
set firewall ipv4 forward filter rule 200 source address 192.168.255.0/24
set firewall ipv4 forward filter rule 200 destination address 192.168.0.0/16

# NAT
set nat source rule 100 source address 192.168.255.0/24
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 translation address masquerade

commit

Slow performance

Problem: The VPN works, but is slow.

Causes:

  1. MTU issues (fragmentation)
  2. CPU overhead from encryption
  3. Network latency

Solution:

# MTU tuning
set vpn l2tp remote-access mtu 1400
set vpn l2tp remote-access mru 1400

# On the client (Windows PowerShell):
# netsh interface ipv4 set subinterface "Company VPN" mtu=1400 store=persistent

commit

Behind-NAT issues

Problem: L2TP does not work when VyOS is behind NAT.

Causes:

  1. NAT-T does not work correctly
  2. UDP 4500 issues

Solution:

# NAT traversal
set vpn ipsec options nat-traversal enable

# Verify that UDP 4500 is used
sudo tcpdump -i eth0 port 4500 -n

commit

Security

Security recommendations

  1. Strong PSK:
# At least 20 characters, random
set vpn ipsec authentication psk l2tp secret 'xR9mK2nP5qL8vW3tY7zB4cF1gH6jN0sA'
  1. Strong user passwords:
# At least 12 characters
set vpn l2tp remote-access authentication local-users username alice password 'Str0ng!Pass#2024'
  1. RADIUS instead of local auth:
set vpn l2tp remote-access authentication mode 'radius'
set vpn l2tp remote-access authentication radius server 192.168.1.10 key 'RadiusSecret'
  1. Firewall rate limiting:
set firewall ipv4 input filter rule 100 recent count 5
set firewall ipv4 input filter rule 100 recent time minute 1
  1. Idle timeout:
set vpn l2tp remote-access idle-timeout 1800
  1. Logging:
# Enable verbose logging
set vpn l2tp remote-access ppp-options logging debug

# Monitor
monitor log vpn
  1. IKEv2 instead of IKEv1 (if clients support it):
set vpn ipsec ike-group IKE-L2TP key-exchange 'ikev2'
  1. Restrict by IP:
# Firewall for specific sources
set firewall ipv4 input filter rule 100 source address 198.51.100.0/24

Configuration examples

Example 1: Small office remote access

# IPsec for L2TP
set vpn ipsec authentication psk l2tp id '203.0.113.1'
set vpn ipsec authentication psk l2tp id '%any'
set vpn ipsec authentication psk l2tp secret 'CompanyVPN2024!Secret'

set vpn ipsec ike-group IKE-L2TP key-exchange 'ikev1'
set vpn ipsec ike-group IKE-L2TP lifetime '3600'
set vpn ipsec ike-group IKE-L2TP proposal 1 dh-group '14'
set vpn ipsec ike-group IKE-L2TP proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-L2TP proposal 1 hash 'sha256'

set vpn ipsec esp-group ESP-L2TP lifetime '3600'
set vpn ipsec esp-group ESP-L2TP mode 'transport'
set vpn ipsec esp-group ESP-L2TP pfs 'dh-group14'
set vpn ipsec esp-group ESP-L2TP proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-L2TP proposal 1 hash 'sha256'

set vpn ipsec site-to-site peer l2tp-remote authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer l2tp-remote authentication pre-shared-secret 'l2tp'
set vpn ipsec site-to-site peer l2tp-remote connection-type 'respond'
set vpn ipsec site-to-site peer l2tp-remote ike-group 'IKE-L2TP'
set vpn ipsec site-to-site peer l2tp-remote default-esp-group 'ESP-L2TP'
set vpn ipsec site-to-site peer l2tp-remote local-address '203.0.113.1'
set vpn ipsec site-to-site peer l2tp-remote remote-address '0.0.0.0/0'

# L2TP server
set vpn l2tp remote-access authentication mode 'local'
set vpn l2tp remote-access authentication local-users username admin password 'AdminPass123!'
set vpn l2tp remote-access authentication local-users username alice password 'AlicePass456!'
set vpn l2tp remote-access authentication local-users username bob password 'BobPass789!'

set vpn l2tp remote-access client-ip-pool start '192.168.255.10'
set vpn l2tp remote-access client-ip-pool stop '192.168.255.50'
set vpn l2tp remote-access gateway-address '192.168.255.1'

set vpn l2tp remote-access name-server '192.168.1.1'
set vpn l2tp remote-access name-server '8.8.8.8'

set vpn l2tp remote-access mtu 1400
set vpn l2tp remote-access idle-timeout 3600

# Firewall
set firewall ipv4 input filter rule 110 action accept
set firewall ipv4 input filter rule 110 destination port 500,4500,1701
set firewall ipv4 input filter rule 110 protocol udp

set firewall ipv4 input filter rule 111 action accept
set firewall ipv4 input filter rule 111 protocol esp

set firewall ipv4 forward filter rule 210 action accept
set firewall ipv4 forward filter rule 210 source address 192.168.255.0/24

# NAT
set nat source rule 110 outbound-interface name eth0
set nat source rule 110 source address 192.168.255.0/24
set nat source rule 110 translation address masquerade

commit
save

Example 2: Enterprise with RADIUS

# IPsec (same as above)
# ...

# L2TP with RADIUS
set vpn l2tp remote-access authentication mode 'radius'
set vpn l2tp remote-access authentication radius server 192.168.1.10 key 'RadiusSecret123!'
set vpn l2tp remote-access authentication radius server 192.168.1.11 key 'RadiusSecret123!'
set vpn l2tp remote-access authentication radius timeout 5
set vpn l2tp remote-access authentication radius acct-timeout 5

# Require strong auth
set vpn l2tp remote-access authentication require 'mschap-v2'

# IP pool
set vpn l2tp remote-access client-ip-pool start '10.99.0.10'
set vpn l2tp remote-access client-ip-pool stop '10.99.0.250'
set vpn l2tp remote-access gateway-address '10.99.0.1'

# DNS
set vpn l2tp remote-access name-server '192.168.1.1'
set vpn l2tp remote-access dns-suffix 'company.local'

# WINS for Windows
set vpn l2tp remote-access wins-server '192.168.1.100'

# Performance tuning
set vpn l2tp remote-access mtu 1400
set vpn l2tp remote-access maximum-sessions 200

# PPP keepalive
set vpn l2tp remote-access ppp-options lcp-echo-failure 3
set vpn l2tp remote-access ppp-options lcp-echo-interval 30

commit
save

Best practices

  1. Strong credentials:

    • PSK: 20+ characters, random
    • Passwords: 12+ characters, complexity rules

  2. RADIUS for enterprise:

    • Centralized authentication
    • Accounting and audit
    • Integration with AD/LDAP

  3. MTU optimization:

    • MTU 1400 for L2TP/IPsec
    • MSS clamping for TCP

  4. Firewall protection:

    • Rate limiting on VPN ports
    • Geo-blocking where applicable
    • Connection logging

  5. Monitoring:

    • Track active sessions
    • Alerts on failed authentications
    • Bandwidth monitoring

  6. Idle timeout:

    • Disconnect inactive users
    • Free up IP addresses

  7. Split tunnel:

    • Save bandwidth
    • Reduce latency for non-corporate traffic

  8. Backup VPN:

    • An alternative VPN method (OpenVPN, WireGuard)
    • Different ports/protocols

  9. Documentation:

    • Instructions for users
    • Supported platforms
    • Troubleshooting guide

  10. Regular updates:

    • Rotate the PSK regularly
    • Update user passwords
    • Review access lists

Alternatives to L2TP/IPsec

When to consider alternatives

WireGuard:

  • Significantly faster
  • Modern cryptography
  • Simple configuration
  • Requires a client

OpenVPN:

  • More flexible
  • Better performance
  • Works through an HTTP proxy
  • Requires a client

IKEv2/IPsec:

  • More modern than L2TP
  • Better for mobile (reconnect)
  • Built into iOS/macOS
  • More complex configuration

Conclusion

L2TP/IPsec provides a simple and compatible remote access VPN solution for VyOS. The main advantages:

  • Native clients in most operating systems
  • Ease of use - no software installation required
  • BYOD friendly - works on personal devices
  • Proven technology - standardized and widely supported

Use L2TP/IPsec when:

  • Maximum compatibility is needed
  • Users cannot install software
  • BYOD scenario
  • Legacy support is required

For new deployments, consider WireGuard (performance) or OpenVPN (flexibility), but L2TP/IPsec remains a reliable choice for broad compatibility and ease of use.

Reviewed by OpenNix LLC · Last updated on
OpenVPNFirewall