OpenBSD L2TP/IPSEC VPN (Works with Windows Phone 8.1!)

Now I've got  my OpenBSD router at home I thought I'd have a crack at making a VPN work.
I chose a L2TP over IPSEC VPN because I was lazy and didn't want the hassle of creating certificates. Also Windows Phone 8.1 since Update 2 (GDR2) has supported L2TP/IPSEC, and as this is the primary device I'll be using my VPN with it was a sealed deal.

In OpenBSD to use L2TP / IPSEC you can use the native NPPPD (8) as I have done. I'm a big fan of using the out of the box features, afterall OpenBSD is built for security from the ground up, so using a 3rd party L2TP/IPSEC port wasn't an option, I literally didn't even give it a thought.

If you're looking for L2TP/IPSEC for Android, see my other post here:
http://blog.fuckingwith.it/2016/04/openbsd-l2tpipsec-vpn-for-android.html

With NPPPD there are a bunch of files you'll need to configure in order to make it work.
/etc/npppd/npppd.conf
/etc/npppd/npppd-users
/etc/ipsec.conf
/etc/pf.conf
/etc/sysctl.conf
/etc/rc.conf.local

My npppd.conf file looks something like this, note the reference to the npppd-users file, you can configure multiple VPN's here with different users in different files. You'll see I'm using tun instead of pppx

authentication LOCAL type local {
        users-file "/etc/npppd/npppd-users"
}

tunnel L2TP protocol l2tp {
        listen on 0.0.0.0
        listen on ::
}

ipcp IPCP {
        pool-address 10.0.0.2-10.0.0.254
        dns-servers 8.8.8.8
}

interface tun0 address 10.0.0.1 ipcp IPCP
bind tunnel from L2TP authenticated by LOCAL to tun0

and list of users in the npppd-users file, add as many users you require, you can set them a static IP here too, check the man page for npppd for additional options:

Username:\

        :password=S3cureP4s5vvordz:

and ipsec.conf file should look something like this, the first two lines set macros as you can in pf.conf, this helps as I have a dynamic IP, although I still have some issues if the IP changes and need to run pf.conf, possibly also reloading ipsec.conf rules, you may need to change aes to 3des or something else your device requires, same applies to modp2048 and hmac-sha1, check /var/log/messages after trying to connect your device:

IF_WAN=pppoe0

key="B1gPH4tKEYWITHlotsOfRANDOMstuff"

ike passive esp transport \

        proto udp from $IF_WAN to any port 1701 \

        main auth "hmac-sha1" enc "aes" group modp2048 \

        quick auth "hmac-sha1" enc "aes" \

        psk $key

If you've got a working OpenBSD router using pf.conf as your firewall, you'll need to modify this too, adding tun to your skip statement, NAT rule allowing VPN clients LAN and WAN access, and the last two lines allow the VPN traffic in otherwise the VPN's wouldn't establish:

set skip on { lo, enc, tun }      #Added tun here

match out on $IF_WAN from {$IF_LAN:network, 10.0.0.0/24} nat-to ($IF_WAN:0) \

scrub (no-df max-mss 1440) #Added the network range for the VPN clients

pass quick proto { esp, ah }

pass in proto udp to $IF_WAN:0 port {isakmp, ipsec-nat-t}

You also need to add in some sysctl.conf options:

net.pipex.enable=1            

net.inet.ipcomp.enable=1  

and in rc.conf.local

isakmpd_flags="-K"

ipsec=YES

npppd_flags=""

Now once you've configured your VPN, reboot and try connect your device. You will need to set the username, password and passphrase you had earlier in the npppd-users file. If you have any errors check /var/log/messages log file for hints on what's wrong.

With this configuration I'm able to get 15Mb down and up through the VPN on my Lumia 930, my home FTTP (Fibre To the Premise) connection only has 20Mb upload, so all in its not too shabby taking into count the internet is otherwise in use by my family and the VPN overhead. 

PS: My work where I tested it for optimal performance has a 1Gb dedicated fibre line and I'm connected to a Cisco WAP371 AC wireless router no more than 3 metres away, so that wouldn't slow anything down either.

If you have any issues, just ask and I'll do my best to help, don't post any configuration files without altering sensitive data, like passwords, username and the passphrase.


PS: Thanks go to the guys at the BSD Now podcast for linking to my BSD blog articles :) Keep up the good work guys, I am an occasional listener!