# L2TP/IPsec VPN

> Configure L2TP/IPsec VPN on VyOS: remote access with native Windows/macOS/iOS/Android clients, PSK authentication, RADIUS for Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/vpn/vyos-l2tp/


L2TP (Layer 2 Tunneling Protocol) combined with IPsec provides remote access VPN with broad client support. L2TP/IPsec is built into most operating systems (Windows, macOS, iOS, Android), which makes it a popular choice for remote access VPN without the need to install third-party software.

## Overview

### What is L2TP/IPsec

**L2TP (Layer 2 Tunneling Protocol)**:
- Layer 2 (Data Link) tunneling protocol
- Encapsulates PPP frames
- Does not provide encryption on its own

**IPsec**:
- Provides encryption and authentication
- Protects L2TP traffic
- ESP (Encapsulating Security Payload) mode

**L2TP/IPsec combination**:
- L2TP for tunneling
- IPsec for security
- Standardized solution (RFC 3193)

### Advantages of L2TP/IPsec

**Pros**:
- Native clients in the OS (Windows, macOS, iOS, Android)
- No third-party software required
- Good compatibility
- Simple client configuration
- Suitable for BYOD (Bring Your Own Device)

**Cons**:
- Slower than modern VPNs (WireGuard, OpenVPN)
- NAT traversal issues (addressed by NAT-T)
- Aging technology
- Less secure than modern alternatives
- Uses UDP 500, 4500, 1701 (may be blocked by firewalls)

### When to use L2TP/IPsec

**Use L2TP/IPsec when**:
- VPN clients cannot be installed
- BYOD scenarios
- Legacy compatibility is required
- Ease of use for end users is critical

**Use alternatives when**:
- Performance matters → WireGuard
- Cross-platform with performance → OpenVPN
- Maximum security → WireGuard or OpenVPN

## Architecture

### L2TP/IPsec components

1. **L2TP Access Concentrator (LAC)** - VyOS server
2. **L2TP Network Server (LNS)** - VyOS server (same)
3. **IPsec SA** - Security Association for encryption
4. **PPP** - Point-to-Point Protocol for authentication

### Connection process

1. **IPsec IKE negotiation** (UDP 500)
2. **IPsec ESP tunnel** is created (UDP 4500 with NAT-T)
3. **L2TP tunnel** is established (UDP 1701)
4. **PPP negotiation** - authentication (CHAP/PAP)
5. **IP address assignment** - the client receives an IP

### Ports

- **UDP 500** - IKE (Internet Key Exchange)
- **UDP 4500** - IPsec NAT-T (NAT Traversal)
- **UDP 1701** - L2TP
- **ESP (IP Protocol 50)** - IPsec encryption

## Basic configuration

### Simple L2TP/IPsec server

```bash
# IPsec configuration for L2TP
set vpn ipsec authentication psk l2tp id '203.0.113.1'
set vpn ipsec authentication psk l2tp id '%any'
set vpn ipsec authentication psk l2tp secret 'MyStrongPSK123!'

# IKE group for L2TP
set vpn ipsec ike-group IKE-L2TP key-exchange 'ikev1'
set vpn ipsec ike-group IKE-L2TP lifetime '3600'
set vpn ipsec ike-group IKE-L2TP proposal 1 dh-group '2'
set vpn ipsec ike-group IKE-L2TP proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-L2TP proposal 1 hash 'sha1'

# ESP group for L2TP
set vpn ipsec esp-group ESP-L2TP lifetime '3600'
set vpn ipsec esp-group ESP-L2TP mode 'transport'
set vpn ipsec esp-group ESP-L2TP pfs 'disable'
set vpn ipsec esp-group ESP-L2TP proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-L2TP proposal 1 hash 'sha1'

# IPsec site-to-site for remote access
set vpn ipsec site-to-site peer l2tp-remote authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer l2tp-remote authentication pre-shared-secret 'l2tp'
set vpn ipsec site-to-site peer l2tp-remote connection-type 'respond'
set vpn ipsec site-to-site peer l2tp-remote ike-group 'IKE-L2TP'
set vpn ipsec site-to-site peer l2tp-remote default-esp-group 'ESP-L2TP'
set vpn ipsec site-to-site peer l2tp-remote local-address '203.0.113.1'
set vpn ipsec site-to-site peer l2tp-remote remote-address '0.0.0.0/0'

# L2TP server
set vpn l2tp remote-access authentication mode 'local'
set vpn l2tp remote-access authentication local-users username alice password 'AlicePass123!'
set vpn l2tp remote-access authentication local-users username bob password 'BobPass456!'

# Client IP pool
set vpn l2tp remote-access client-ip-pool start '192.168.255.10'
set vpn l2tp remote-access client-ip-pool stop '192.168.255.50'

# Gateway IP
set vpn l2tp remote-access gateway-address '192.168.255.1'

# DNS for clients
set vpn l2tp remote-access name-server '8.8.8.8'
set vpn l2tp remote-access name-server '1.1.1.1'

# Firewall for L2TP/IPsec
set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 destination port 500,4500,1701
set firewall ipv4 input filter rule 100 protocol udp

set firewall ipv4 input filter rule 101 action accept
set firewall ipv4 input filter rule 101 protocol esp

# NAT for clients
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.255.0/24
set nat source rule 100 translation address masquerade

commit
save
```

### Verifying L2TP/IPsec

```bash
# IPsec status
show vpn ipsec sa

# L2TP sessions
show vpn l2tp remote-access sessions

# Connected users
show vpn l2tp remote-access users

# Logs
show log vpn
```

## Authentication

### Local authentication

Users are stored in the VyOS configuration:

```bash
set vpn l2tp remote-access authentication mode 'local'

# Users
set vpn l2tp remote-access authentication local-users username user1 password 'Pass1!'
set vpn l2tp remote-access authentication local-users username user2 password 'Pass2!'
set vpn l2tp remote-access authentication local-users username user3 password 'Pass3!'

# Static IPs for users
set vpn l2tp remote-access authentication local-users username user1 static-ip '192.168.255.10'
set vpn l2tp remote-access authentication local-users username user2 static-ip '192.168.255.11'

commit
```

### RADIUS authentication

Centralized authentication via RADIUS:

```bash
set vpn l2tp remote-access authentication mode 'radius'

# RADIUS servers
set vpn l2tp remote-access authentication radius server 192.168.1.10 key 'RadiusSecret123!'
set vpn l2tp remote-access authentication radius server 192.168.1.11 key 'RadiusSecret123!'

# Timeout
set vpn l2tp remote-access authentication radius timeout 5

# Accounting
set vpn l2tp remote-access authentication radius acct-timeout 5

commit
```

### Require options

```bash
# Require MSCHAP-v2
set vpn l2tp remote-access authentication require 'mschap-v2'

# Or CHAP
set vpn l2tp remote-access authentication require 'chap'

# Disallow weak authentication
set vpn l2tp remote-access authentication protocols pap disable
set vpn l2tp remote-access authentication protocols chap disable

commit
```

## Advanced configuration

### MTU and MRU tuning

```bash
# MTU for L2TP
set vpn l2tp remote-access mtu 1400

# MRU (Maximum Receive Unit)
set vpn l2tp remote-access mru 1400

commit
```

**Recommendation**: MTU 1400 to account for IPsec/L2TP overhead.

### Idle timeout

```bash
# Disconnect clients on inactivity (seconds)
set vpn l2tp remote-access idle-timeout 3600

commit
```

### WINS server

For Windows clients:

```bash
set vpn l2tp remote-access wins-server 192.168.1.100

commit
```

### LNS (L2TP Network Server) settings

```bash
# Maximum sessions
set vpn l2tp remote-access maximum-sessions 100

# Listen address
set vpn l2tp remote-access outside-address '203.0.113.1'

commit
```

### PPP options

```bash
# PPP interface prefix
set vpn l2tp remote-access ppp-options interface-cache 10

# LCP echo for keepalive
set vpn l2tp remote-access ppp-options lcp-echo-failure 3
set vpn l2tp remote-access ppp-options lcp-echo-interval 30

# IPv6 support
set vpn l2tp remote-access ppp-options ipv6 'allow'

commit
```

### Client IP pool with multiple ranges

```bash
# Pool 1
set vpn l2tp remote-access client-ip-pool start '192.168.255.10'
set vpn l2tp remote-access client-ip-pool stop '192.168.255.100'

# VyOS does not support multiple pools directly
# Use RADIUS for dynamic IP assignment

commit
```

### Compression

```bash
# MPPE encryption (Microsoft Point-to-Point Encryption)
set vpn l2tp remote-access ppp-options mppe 'require-128'

commit
```

## Client configuration

### Windows client

**Windows 10/11**:

1. Settings → Network & Internet → VPN
2. Add a VPN connection
3. VPN provider: Windows (built-in)
4. Connection name: Company VPN
5. Server name or address: `vpn.company.com` or `203.0.113.1`
6. VPN type: L2TP/IPsec with pre-shared key
7. Pre-shared key: `MyStrongPSK123!`
8. User name: `alice`
9. Password: `AlicePass123!`
10. Save → Connect

**PowerShell**:
```powershell
Add-VpnConnection -Name "Company VPN" `
  -ServerAddress "vpn.company.com" `
  -TunnelType L2tp `
  -EncryptionLevel Required `
  -AuthenticationMethod Chap,MSChapv2 `
  -L2tpPsk "MyStrongPSK123!" `
  -Force `
  -RememberCredential `
  -PassThru
```

### macOS client

1. System Preferences → Network
2. Click "+" to add a new connection
3. Interface: VPN
4. VPN Type: L2TP over IPSec
5. Service Name: Company VPN
6. Server Address: `vpn.company.com`
7. Account Name: `alice`
8. Authentication Settings:
   - User Authentication: Password
   - Machine Authentication: Shared Secret
   - Shared Secret: `MyStrongPSK123!`
9. Advanced: Send all traffic over VPN (optional)
10. Apply → Connect

### iOS client

1. Settings → General → VPN → Add VPN Configuration
2. Type: L2TP
3. Description: Company VPN
4. Server: `vpn.company.com`
5. Account: `alice`
6. Password: `AlicePass123!`
7. Secret: `MyStrongPSK123!`
8. Send All Traffic: On
9. Save → Connect (toggle VPN on)

### Android client

1. Settings → Network & Internet → VPN
2. Add VPN
3. Name: Company VPN
4. Type: L2TP/IPSec PSK
5. Server address: `vpn.company.com`
6. IPSec pre-shared key: `MyStrongPSK123!`
7. Username: `alice`
8. Password: `AlicePass123!`
9. Save → Connect

### Linux client (NetworkManager)

```bash
# Installation
sudo apt-get install network-manager-l2tp network-manager-l2tp-gnome

# GUI: NetworkManager → Add VPN → L2TP
# Server: vpn.company.com
# Username: alice
# Password: AlicePass123!
# IPSec Settings: Pre-shared key: MyStrongPSK123!
```

**xl2tpd manual**:
```bash
# Installation
sudo apt-get install xl2tpd strongswan

# /etc/ipsec.conf
conn L2TP-PSK
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=%defaultroute
    leftprotoport=17/1701
    right=203.0.113.1
    rightprotoport=17/1701

# /etc/ipsec.secrets
: PSK "MyStrongPSK123!"

# /etc/xl2tpd/xl2tpd.conf
[lac company]
lns = 203.0.113.1
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tpd.client
length bit = yes

# /etc/ppp/options.l2tpd.client
ipcp-accept-local
ipcp-accept-remote
refuse-eap
require-chap
noccp
noauth
mtu 1400
mru 1400
defaultroute
usepeerdns
connect-delay 5000
name alice
password AlicePass123!

# Connect
sudo ipsec up L2TP-PSK
sudo xl2tpd-control connect company
```

## Split tunnel vs full tunnel

### Full tunnel (all traffic through the VPN)

By default L2TP pushes a default route:

```bash
# On VyOS (default)
# Clients automatically receive a default route through the VPN

commit
```

**Client (Windows)**: "Send all traffic over VPN" enabled.

### Split tunnel (corporate traffic only)

For split tunnel you must configure the client manually.

**Windows PowerShell**:
```powershell
# After connecting, add only the required routes
Add-VpnConnectionRoute -ConnectionName "Company VPN" -DestinationPrefix 192.168.0.0/16
Add-VpnConnectionRoute -ConnectionName "Company VPN" -DestinationPrefix 10.0.0.0/8

# Disable "Send all traffic"
Set-VpnConnection -Name "Company VPN" -SplitTunneling $True
```

**macOS/Linux**: Configure routing manually after connecting.

## Monitoring and diagnostics

### Checking L2TP sessions

```bash
# Active sessions
show vpn l2tp remote-access sessions

# Details
show vpn l2tp remote-access users

# Statistics
show vpn l2tp remote-access statistics
```

Example output:
```
User      Interface  IP Address       Calling Station  Time
alice     ppp0       192.168.255.10   198.51.100.50    00:15:32
bob       ppp1       192.168.255.11   198.51.100.51    01:23:45
```

### Checking IPsec

```bash
# IPsec SA
show vpn ipsec sa

# Peer details
show vpn ipsec sa peer 198.51.100.50
```

### Checking connectivity

```bash
# Ping the client
ping 192.168.255.10

# On the client, ping the gateway
ping 192.168.255.1

# Ping through the VPN
ping 192.168.1.10  # Internal resource
```

### Logs

```bash
# VPN logs
show log vpn

# Live monitoring
monitor log vpn

# L2TP specific
show log | grep l2tp

# IPsec specific
show log | grep ipsec
```

### tcpdump

```bash
# L2TP traffic (after IPsec decryption)
sudo tcpdump -i ppp0 -n

# IPsec ESP (encrypted)
sudo tcpdump -i eth0 esp -n

# IKE negotiation
sudo tcpdump -i eth0 port 500 -n
```

## Troubleshooting

### Client cannot connect

**Problem**: The connection hangs or is refused.

**Causes**:
1. Firewall blocks the ports
2. PSK mismatch
3. IPsec does not establish
4. NAT traversal issues

**Diagnostics**:
```bash
# Check the firewall
show firewall ipv4 input filter

# Check the IPsec SA
show vpn ipsec sa

# Check the logs
show log vpn | grep error
```

**Solution**:
```bash
# Firewall rules
set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 destination port 500,4500,1701
set firewall ipv4 input filter rule 100 protocol udp

set firewall ipv4 input filter rule 101 action accept
set firewall ipv4 input filter rule 101 protocol esp

# Check the PSK
show vpn ipsec authentication psk

commit
```

### IPsec establishes, but L2TP does not work

**Problem**: The IPsec SA shows UP, but the L2TP tunnel is not created.

**Causes**:
1. UDP 1701 is blocked
2. The L2TP service is not running
3. Authentication fails

**Diagnostics**:
```bash
# Check the L2TP service
systemctl status xl2tpd

# Check the L2TP port
netstat -ulnp | grep 1701

# Logs
show log vpn | grep l2tp
```

**Solution**:
```bash
# Restart L2TP
restart vpn l2tp

# Check users
show configuration vpn l2tp remote-access authentication local-users
```

### Authentication fails

**Problem**: "Authentication failed" on the client.

**Causes**:
1. Incorrect username/password
2. A different auth protocol is required
3. RADIUS is unavailable

**Diagnostics**:
```bash
# Check users
show configuration vpn l2tp remote-access authentication

# RADIUS test
show vpn l2tp remote-access authentication radius
```

**Solution**:
```bash
# Check the password
show configuration vpn l2tp remote-access authentication local-users username alice

# Allow different auth protocols
delete vpn l2tp remote-access authentication require

commit
```

### No access to the local network

**Problem**: The VPN is connected, but there is no access to resources.

**Causes**:
1. Firewall blocks VPN clients
2. NAT is not configured
3. Routing problems

**Diagnostics**:
```bash
# Check routing
show ip route

# Ping from a VPN client
# On VyOS:
ping 192.168.255.10  # VPN client

# Check firewall forward
show firewall ipv4 forward filter
```

**Solution**:
```bash
# Firewall for VPN clients
set firewall ipv4 forward filter rule 200 action accept
set firewall ipv4 forward filter rule 200 source address 192.168.255.0/24
set firewall ipv4 forward filter rule 200 destination address 192.168.0.0/16

# NAT
set nat source rule 100 source address 192.168.255.0/24
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 translation address masquerade

commit
```

### Slow performance

**Problem**: The VPN works, but is slow.

**Causes**:
1. MTU issues (fragmentation)
2. CPU overhead from encryption
3. Network latency

**Solution**:
```bash
# MTU tuning
set vpn l2tp remote-access mtu 1400
set vpn l2tp remote-access mru 1400

# On the client (Windows PowerShell):
# netsh interface ipv4 set subinterface "Company VPN" mtu=1400 store=persistent

commit
```

### Behind-NAT issues

**Problem**: L2TP does not work when VyOS is behind NAT.

**Causes**:
1. NAT-T does not work correctly
2. UDP 4500 issues

**Solution**:
```bash
# NAT traversal
set vpn ipsec options nat-traversal enable

# Verify that UDP 4500 is used
sudo tcpdump -i eth0 port 4500 -n

commit
```

## Security

### Security recommendations

1. **Strong PSK**:
```bash
# At least 20 characters, random
set vpn ipsec authentication psk l2tp secret 'xR9mK2nP5qL8vW3tY7zB4cF1gH6jN0sA'
```

2. **Strong user passwords**:
```bash
# At least 12 characters
set vpn l2tp remote-access authentication local-users username alice password 'Str0ng!Pass#2024'
```

3. **RADIUS instead of local auth**:
```bash
set vpn l2tp remote-access authentication mode 'radius'
set vpn l2tp remote-access authentication radius server 192.168.1.10 key 'RadiusSecret'
```

4. **Firewall rate limiting**:
```bash
set firewall ipv4 input filter rule 100 recent count 5
set firewall ipv4 input filter rule 100 recent time minute 1
```

5. **Idle timeout**:
```bash
set vpn l2tp remote-access idle-timeout 1800
```

6. **Logging**:
```bash
# Enable verbose logging
set vpn l2tp remote-access ppp-options logging debug

# Monitor
monitor log vpn
```

7. **IKEv2 instead of IKEv1** (if clients support it):
```bash
set vpn ipsec ike-group IKE-L2TP key-exchange 'ikev2'
```

8. **Restrict by IP**:
```bash
# Firewall for specific sources
set firewall ipv4 input filter rule 100 source address 198.51.100.0/24
```

## Configuration examples

### Example 1: Small office remote access

```bash
# IPsec for L2TP
set vpn ipsec authentication psk l2tp id '203.0.113.1'
set vpn ipsec authentication psk l2tp id '%any'
set vpn ipsec authentication psk l2tp secret 'CompanyVPN2024!Secret'

set vpn ipsec ike-group IKE-L2TP key-exchange 'ikev1'
set vpn ipsec ike-group IKE-L2TP lifetime '3600'
set vpn ipsec ike-group IKE-L2TP proposal 1 dh-group '14'
set vpn ipsec ike-group IKE-L2TP proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-L2TP proposal 1 hash 'sha256'

set vpn ipsec esp-group ESP-L2TP lifetime '3600'
set vpn ipsec esp-group ESP-L2TP mode 'transport'
set vpn ipsec esp-group ESP-L2TP pfs 'dh-group14'
set vpn ipsec esp-group ESP-L2TP proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-L2TP proposal 1 hash 'sha256'

set vpn ipsec site-to-site peer l2tp-remote authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer l2tp-remote authentication pre-shared-secret 'l2tp'
set vpn ipsec site-to-site peer l2tp-remote connection-type 'respond'
set vpn ipsec site-to-site peer l2tp-remote ike-group 'IKE-L2TP'
set vpn ipsec site-to-site peer l2tp-remote default-esp-group 'ESP-L2TP'
set vpn ipsec site-to-site peer l2tp-remote local-address '203.0.113.1'
set vpn ipsec site-to-site peer l2tp-remote remote-address '0.0.0.0/0'

# L2TP server
set vpn l2tp remote-access authentication mode 'local'
set vpn l2tp remote-access authentication local-users username admin password 'AdminPass123!'
set vpn l2tp remote-access authentication local-users username alice password 'AlicePass456!'
set vpn l2tp remote-access authentication local-users username bob password 'BobPass789!'

set vpn l2tp remote-access client-ip-pool start '192.168.255.10'
set vpn l2tp remote-access client-ip-pool stop '192.168.255.50'
set vpn l2tp remote-access gateway-address '192.168.255.1'

set vpn l2tp remote-access name-server '192.168.1.1'
set vpn l2tp remote-access name-server '8.8.8.8'

set vpn l2tp remote-access mtu 1400
set vpn l2tp remote-access idle-timeout 3600

# Firewall
set firewall ipv4 input filter rule 110 action accept
set firewall ipv4 input filter rule 110 destination port 500,4500,1701
set firewall ipv4 input filter rule 110 protocol udp

set firewall ipv4 input filter rule 111 action accept
set firewall ipv4 input filter rule 111 protocol esp

set firewall ipv4 forward filter rule 210 action accept
set firewall ipv4 forward filter rule 210 source address 192.168.255.0/24

# NAT
set nat source rule 110 outbound-interface name eth0
set nat source rule 110 source address 192.168.255.0/24
set nat source rule 110 translation address masquerade

commit
save
```

### Example 2: Enterprise with RADIUS

```bash
# IPsec (same as above)
# ...

# L2TP with RADIUS
set vpn l2tp remote-access authentication mode 'radius'
set vpn l2tp remote-access authentication radius server 192.168.1.10 key 'RadiusSecret123!'
set vpn l2tp remote-access authentication radius server 192.168.1.11 key 'RadiusSecret123!'
set vpn l2tp remote-access authentication radius timeout 5
set vpn l2tp remote-access authentication radius acct-timeout 5

# Require strong auth
set vpn l2tp remote-access authentication require 'mschap-v2'

# IP pool
set vpn l2tp remote-access client-ip-pool start '10.99.0.10'
set vpn l2tp remote-access client-ip-pool stop '10.99.0.250'
set vpn l2tp remote-access gateway-address '10.99.0.1'

# DNS
set vpn l2tp remote-access name-server '192.168.1.1'
set vpn l2tp remote-access dns-suffix 'company.local'

# WINS for Windows
set vpn l2tp remote-access wins-server '192.168.1.100'

# Performance tuning
set vpn l2tp remote-access mtu 1400
set vpn l2tp remote-access maximum-sessions 200

# PPP keepalive
set vpn l2tp remote-access ppp-options lcp-echo-failure 3
set vpn l2tp remote-access ppp-options lcp-echo-interval 30

commit
save
```

## Best practices

1. **Strong credentials**:
   - PSK: 20+ characters, random
   - Passwords: 12+ characters, complexity rules

2. **RADIUS for enterprise**:
   - Centralized authentication
   - Accounting and audit
   - Integration with AD/LDAP

3. **MTU optimization**:
   - MTU 1400 for L2TP/IPsec
   - MSS clamping for TCP

4. **Firewall protection**:
   - Rate limiting on VPN ports
   - Geo-blocking where applicable
   - Connection logging

5. **Monitoring**:
   - Track active sessions
   - Alerts on failed authentications
   - Bandwidth monitoring

6. **Idle timeout**:
   - Disconnect inactive users
   - Free up IP addresses

7. **Split tunnel**:
   - Save bandwidth
   - Reduce latency for non-corporate traffic

8. **Backup VPN**:
   - An alternative VPN method (OpenVPN, WireGuard)
   - Different ports/protocols

9. **Documentation**:
   - Instructions for users
   - Supported platforms
   - Troubleshooting guide

10. **Regular updates**:
    - Rotate the PSK regularly
    - Update user passwords
    - Review access lists

## Alternatives to L2TP/IPsec

### When to consider alternatives

**WireGuard**:
- Significantly faster
- Modern cryptography
- Simple configuration
- Requires a client

**OpenVPN**:
- More flexible
- Better performance
- Works through an HTTP proxy
- Requires a client

**IKEv2/IPsec**:
- More modern than L2TP
- Better for mobile (reconnect)
- Built into iOS/macOS
- More complex configuration

## Conclusion

L2TP/IPsec provides a simple and compatible remote access VPN solution for VyOS. The main advantages:

- **Native clients** in most operating systems
- **Ease of use** - no software installation required
- **BYOD friendly** - works on personal devices
- **Proven technology** - standardized and widely supported

Use L2TP/IPsec when:
- Maximum compatibility is needed
- Users cannot install software
- BYOD scenario
- Legacy support is required

For new deployments, consider WireGuard (performance) or OpenVPN (flexibility), but L2TP/IPsec remains a reliable choice for broad compatibility and ease of use.