Basic structure to utilize internet VPN by IPsec.
It enables the safe connection among remote hub network.
Configuration example on RTX810
VPN configuration setting with IPsec
RTX810(1)
| Gateway settings | ip route default gateway pp 1 |
|---|---|
| ip route 192.168.2.0/24 gateway tunnel 1 | |
| LAN interface settings | ip lan1 address 192.168.1.1/24 |
| WAN interface settings | pp select 1 |
| pp always-on on | |
| pppoe use lan2 | |
| pp auth accept pap chap | |
| pp auth myname (##User ID##) (##Password##) | |
| ppp lcp mru on 1454 | |
| ppp ipcp ipaddress on | |
| ip pp mtu 1454 | |
| ip pp secure filter in 1020 1030 1040 1041 2000 | |
| ip pp secure filter out 1010 1011 1012 1013 1014 1015 3000 dynamic 100 101 102 103 104 105 106 107 | |
| ip pp nat descriptor 1 | |
| pp enable 1 | |
| VPN (IPsec) settings | tunnel select 1 |
| ipsec tunnel 1 | |
| ipsec sa policy 1 1 esp 3des-cbc sha-hmac | |
| ipsec ike keepalive log 1 off | |
| ipsec ike keepalive use 1 on | |
| ipsec ike local address 1 192.168.1.1 | |
| ipsec ike pre-shared-key 1 text (##KEY##) | |
| ipsec ike remote address 1 (##Opposite Router's WAN Interface Address##) | |
| ipsec ike hash 1 sha | |
| tunnel enable 1 | |
| ipsec auto refresh on | |
| Filter settings | ip filter source-route on |
| ip filter directed-broadcast on | |
| ip filter 1010 reject * * udp,tcp 135 * | |
| ip filter 1011 reject * * udp,tcp * 135 | |
| ip filter 1012 reject * * udp,tcp netbios_ns-netbios_ssn * | |
| ip filter 1013 reject * * udp,tcp * netbios_ns-netbios_ssn | |
| ip filter 1014 reject * * udp,tcp 445 * | |
| ip filter 1015 reject * * udp,tcp * 445 | |
| ip filter 1020 reject 192.168.1.0/24 * | |
| ip filter 1030 pass * 192.168.1.0/24 icmp | |
| ip filter 1040 pass * 192.168.1.1 udp * 500 | |
| ip filter 1041 pass * 192.168.1.1 esp | |
| ip filter 2000 reject * * | |
| ip filter 3000 pass * * | |
| ip filter dynamic 100 * * ftp | |
| ip filter dynamic 101 * * www | |
| ip filter dynamic 102 * * domain | |
| ip filter dynamic 103 * * smtp | |
| ip filter dynamic 104 * * pop3 | |
| ip filter dynamic 105 * * netmeeting | |
| ip filter dynamic 106 * * tcp | |
| ip filter dynamic 107 * * udp | |
| NAT settings | nat descriptor type 1 masquerade |
| nat descriptor masquerade static 1 1 192.168.1.1 udp 500 | |
| nat descriptor masquerade static 1 2 192.168.1.1 esp | |
| DNS settings | dns server (##DNS server Address##) |
| dns private address spoof on | |
| DHCP settings | dhcp scope 1 192.168.1.2-192.168.1.191/24 |
| dhcp service server |
RTX810(2)
| Gateway settings | ip route default gateway pp 1 |
|---|---|
| ip route 192.168.1.0/24 gateway tunnel 1 | |
| LAN interface settings | ip lan1 address 192.168.2.1/24 |
| WAN interface settings | pp select 1 |
| pp always-on on | |
| pppoe use lan2 | |
| pp auth accept pap chap | |
| pp auth myname (##User ID##) (##Password##) | |
| ppp lcp mru on 1454 | |
| ppp ipcp ipaddress on | |
| ip pp mtu 1454 | |
| ip pp secure filter in 1020 1030 1040 1041 2000 | |
| ip pp secure filter out 1010 1011 1012 1013 1014 1015 3000 dynamic 100 101 102 103 104 105 106 107 | |
| ip pp nat descriptor 1 | |
| pp enable 1 | |
| VPN (IPsec) settings | tunnel select 1 |
| ipsec tunnel 1 | |
| ipsec sa policy 1 1 esp 3des-cbc sha-hmac | |
| ipsec ike keepalive log 1 off | |
| ipsec ike keepalive use 1 on | |
| ipsec ike local address 1 192.168.2.1 | |
| ipsec ike pre-shared-key 1 text (##KEY##) | |
| ipsec ike remote address 1 (##Opposite Router's WAN Interface Address##) | |
| ipsec ike hash 1 sha | |
| tunnel enable 1 | |
| ipsec auto refresh on | |
| Filter settings | ip filter source-route on |
| ip filter directed-broadcast on | |
| ip filter 1010 reject * * udp,tcp 135 * | |
| ip filter 1011 reject * * udp,tcp * 135 | |
| ip filter 1012 reject * * udp,tcp netbios_ns-netbios_ssn * | |
| ip filter 1013 reject * * udp,tcp * netbios_ns-netbios_ssn | |
| ip filter 1014 reject * * udp,tcp 445 * | |
| ip filter 1015 reject * * udp,tcp * 445 | |
| ip filter 1020 reject 192.168.2.0/24 * | |
| ip filter 1030 pass * 192.168.2.0/24 icmp | |
| ip filter 1040 pass * 192.168.2.1 udp * 500 | |
| ip filter 1041 pass * 192.168.2.1 esp | |
| ip filter 2000 reject * * | |
| ip filter 3000 pass * * | |
| ip filter dynamic 100 * * ftp | |
| ip filter dynamic 101 * * www | |
| ip filter dynamic 102 * * domain | |
| ip filter dynamic 103 * * smtp | |
| ip filter dynamic 104 * * pop3 | |
| ip filter dynamic 105 * * netmeeting | |
| ip filter dynamic 106 * * tcp | |
| ip filter dynamic 107 * * udp | |
| NAT settings | nat descriptor type 1 masquerade |
| nat descriptor masquerade static 1 1 192.168.2.1 udp 500 | |
| nat descriptor masquerade static 1 2 192.168.2.1 esp | |
| DNS settings | dns server (##DNS server Address##) |
| dns private address spoof on | |
| DNS settings | dhcp scope 1 192.168.2.2-192.168.2.191/24 |
| dhcp service server |
GUI setting
For the internet VPN configuration setting with IPsec, it is required to have internet configuration setting with PPPoE in advance.
Please click here for internet configuration setting with PPPoE.
1. Select [Advanced settings].
2. Press [Configure] on “Configure LAN”.
3. Change the Primary IP address to “192.168.1.1”. Change DHCP scope (no.1) to “192.168.1.2-192.168.1.191/24. Press [Submit].
4. Review the configuration, and press [Execute].
5. Click “Access the new IP address via http”.
6. Select [Advanced settings].
7. Press [Configure] on “Configure VPN connection”.
8. Press [Add] on “TUNNEL[01]”.
9. Select “LAN-to-LAN network over IPsec”, and press [Next].
10. Configure the following items, and press [Submit].
- “authentication key (pre-shared-key)”
- Select “Identify using IP address”, and enter IP address on RTX810(2) WAN interface.
Enter “192.168.2.0/24” on “Configure route information”.
11. Press [Return to top].
Japanese Site