This is a guide for setting up the L2TP service from AAISP on an OpenWrt router. AAISP have an official OpenWrt guide for this but it is outdated and looks to have been originally written for OpenWrt 15.01/15.05 (Chaos Calmer), which is a long unsupported firmware build.
I have previously contacted AAISP about their documentation being out of date, however it has not been changed. It is technically not wrong, but under newer versions of OpenWrt you can simplify some of the configuration compared to the official documentation and there are also a few potential issues you might come across in OpenWrt land which are worth mentioning and saving someone else from bashing their head against a wall for hours, until you realise that the Linux kernel just hates you.
This has been tested on the latest stable OpenWrt 19.07 release branch.
opkg update
opkg install kmod-l2tp kmod-l2tp-eth kmod-l2tp-ip kmod-pppol2tp ppp-mod-pppol2tp xl2tpd luci-proto-ipv6 luci-proto-pppReboot your router to load the new kmods.
If you have multiple WANs and are multi homed, you will want to create a static route to ensure the L2TP connection goes over the right WAN interface. Add the following to your /etc/config/network file.
config route
option interface 'wan'
option target '90.155.53.19'
Change the interface to be whatever wan network interface you want to use. 90.155.53.19 is the IPv4 address of l2tp.aa.net.uk.
Note: Depending on the type of WAN connection being used, you might also need to set a valid gateway value.
Start by adding the following to /etc/config/network.
config interface 'aaisp'
option proto 'l2tp'
option server 'l2tp.aa.net.uk'
option username 'yourusername@a'
option password 'YOURPASSWORD'
option ipv6 '1'
option peerdns '0'
option metric '50'
option checkup_interval '10'
Replace the username and password values with your L2TP tunnel credentials, these can be found at https://control.aa.net.uk/. Setting a metric is advised, it will be important if you have multiple WAN connections, the value can be anything however.
From my experience I found that the tunnel would sometimes go down randomly and not re-establish the connection unless the interface was restarted manually. This is why option checkup_interval '10' is present as this seems to prevent the tunnel from dropping and I haven't needed to manually restart the L2TP interface since. Bonus.
Next you will want to configure the IPv6 side, this can be done with an alias interface, unlike the official documentation, the recommended approach with IPv6 is alias interfaces by using @aaisp as the ifname.
config interface 'aaisp6'
option proto 'dhcpv6'
option ifname '@aaisp'
option reqaddress 'try'
option reqprefix 'auto'
option peerdns '0'
option metric '50'
The IPv6 side is quite straight forward only requiring a DHCPv6 client with default settings which will pick up the prefix configured on your tunnel i.e. a /64 or /48 depending on what you've setup.
This will create a l2tp-aaisp network device, with the IPv4 and IPv6 configuration together.
Restart your network interfaces with /etc/init.d/network restart. You might also want to reboot your router to ensure all interfaces changes are applied.
The easiest method is to assign the two network interfaces to the existing WAN firewall zone. Within your /etc/config/firewall update the firewall entry for the WAN zone to include the AAISP network interfaces.
config zone
option name 'wan'
option output 'ACCEPT'
option masq '1'
option mtu_fix '1'
option forward 'REJECT'
option input 'REJECT'
list network 'wan'
list network 'wan6'
..
list network 'aaisp'
list network 'aaisp6'
Restart the firewall with /etc/init.d/firewall restart
Make sure that you can reach the tunnel endpoint l2tp.aa.net.uk, you can confirm this with traceroute. Sometimes when defining a static route, you may need to explicitly set the network gateway for certain connections. If you are able to reach the tunnel endpoint and still are not able to establish a PPP connection, check to make sure you have allocated your IPv4 and IPv6 prefix on your tunnel through control.aa.net.uk. If all else fails restart your router after applying all the configuration above.
If you have multiple IPv6 network interfaces you may encounter this issue where you get a permission denied error on commands like traceroute, ping etc. This is actually coming from the Linux kernel. The workaround is to add a static IPv6 route like so:
config route6
option interface 'aaisp6'
option target '::/0'
Repeat for any additional IPv6 network interfaces you have.
If you plan on using your AAISP L2TP tunnel with something like mwan3 which relies on fwmark you may find network traffic being broken quite badly. It was discovered by @aaronjg that tunnel interfaces were being broken by fwmark. A workaround is applying the following custom firewall rule in /etc/firewall.user.
iptables -t mangle -I OUTPUT -d 90.155.53.19 -p udp --dport 1701 --sport 1701 -j RETURN
This prevents packets to the tunnel endpoint being marked which is what breaks the connection when fwmark is used. This isn't directly related to L2TP, but is actually another issue in the Linux kernel. The kernel patches to fix the underlying problem were backported to OpenWrt, but are only present in 19.07.5 and any recent snapshot build which also has the kernel patched. If you are running 19.07.5 or above, you don't need the above firewall rule for older OpenWrt builds, you will need to implement the above firewall rule. Unless you fancy compiling your own image with the kernel patches (brave!).
If your ISP does not offer native IPv4 and is doing IPv4 through CGNAT or some other transitional mechanism, fire your current ISP immediately. If however that is too drastic, you can connect to the AAISP L2TP service over IPv6 with l2tp6.aa.net.uk. This will be useful if you happen to have native IPv6 from your existing provider but your IPv4 is not directly routed to you and instead is being translated through a variety of mechasims on offer such as DS-Lite, 464XLAT and many other IPv6 transition technologies your ISP might be doing. Simply replace the server option with the IPv6 only l2tp6.aa.net.uk hostname. You should still define a static IPv6 route for l2tp6.aa.net.uk like the IPv4 static route if you have multiple IPv6 networks configured on your router.
I cannot confirm this entirely, but related to how L2TP and fwmark has been known to be a problem, in a similar fashion I can have my router experience CPU stalls after just under four hours uptime where the router starts to lockup and become not responsive to pings or anything and will then recover but keep going into this cycle of behaviour if left without intervening. As soon as I disable my L2TP interface, everything is fine. After a while re-enabling the L2TP network interface doesn't cause a problem and this problem won't happen again, until the router gets reset or rebooted.
The system load of the router with mwan3 and L2TP seems to cause an insane load averages and it seems all of the CPU cycles are being taken up, causing the stall and lockup behaviour. The captured kernel messages, indicate it's actually wg-crypt-wg responsible. However disabling my L2TP interface does seem to stop the issue, it is possibly not the main cause but something that also triggers this behaviour. There is a OpenWrt bug report that someone found on 18.06 a while ago: https://bugs.openwrt.org/index.php?do=details&task_id=1837 but there hasn't been any resolution or further information on it. The common factor appears to be fwmark however.
[14652.335220] INFO: rcu_sched self-detected stall on CPU
[14652.340391] 1-...: (1 GPs behind) idle=e1a/140000000000001/0 softirq=1294354/1294355 fqs=3000
[14652.345222] INFO: rcu_sched detected stalls on CPUs/tasks:
[14652.349126]
[14652.354636] (t=6002 jiffies g=566961 c=566960 q=26480)
[14652.356220] 1-...: (1 GPs behind) idle=e1a/140000000000001/0 softirq=1294354/1294355 fqs=3000
[14652.370193]
[14652.370195] NMI backtrace for cpu 1
[14652.370198] (detected by 0, t=6002 jiffies, g=566961, c=566960, q=26480)
[14652.371778] CPU: 1 PID: 14 Comm: ksoftirqd/1 Not tainted 4.14.215 #0
[14652.388381] Hardware name: Marvell Armada 380/385 (Device Tree)
[14652.394328] Function entered at [<c010ebf8>] from [<c010a8b8>]
[14652.400185] Function entered at [<c010a8b8>] from [<c0640f94>]
[14652.406042] Function entered at [<c0640f94>] from [<c0646708>]
[14652.411899] Function entered at [<c0646708>] from [<c0646794>]
[14652.417756] Function entered at [<c0646794>] from [<c01766e4>]
[14652.423613] Function entered at [<c01766e4>] from [<c0175a78>]
[14652.429469] Function entered at [<c0175a78>] from [<c0178d04>]
[14652.435326] Function entered at [<c0178d04>] from [<c018806c>]
[14652.441183] Function entered at [<c018806c>] from [<c0179354>]
[14652.447039] Function entered at [<c0179354>] from [<c0179bc8>]
[14652.452896] Function entered at [<c0179bc8>] from [<c010e2e8>]
[14652.458752] Function entered at [<c010e2e8>] from [<c016ab68>]
[14652.464609] Function entered at [<c016ab68>] from [<c0165d98>]
[14652.470466] Function entered at [<c0165d98>] from [<c01662f8>]
[14652.476322] Function entered at [<c01662f8>] from [<c0101464>]
[14652.482179] Function entered at [<c0101464>] from [<c010b54c>]
[14652.488036] Exception stack(0xdf475750 to 0xdf475798)
[14652.493109] 5740: cf87e30e cf87e312 00000008 cf87e30e
[14652.501323] 5760: d1301600 00000002 00010013 00000000 dec2e800 00000081 00000000 d409c850
[14652.509536] 5780: 00000002 df4757a4 c053b364 c063f7a0 20000013 ffffffff
[14652.516178] Function entered at [<c010b54c>] from [<c063f7a0>]
[14652.522035] Function entered at [<c063f7a0>] from [<c053b364>]
[14652.527892] Function entered at [<c053b364>] from [<c053b580>]
[14652.533749] Function entered at [<c053b580>] from [<c056133c>]
[14652.539605] Function entered at [<c056133c>] from [<c053bc00>]
[14652.545462] Function entered at [<c053bc00>] from [<c063a394>]
[14652.551319] Function entered at [<c063a394>] from [<c053b634>]
[14652.557175] Function entered at [<c053b634>] from [<c053bda0>]
[14652.563031] Function entered at [<c053bda0>] from [<c057cb2c>]
[14652.568888] Function entered at [<c057cb2c>] from [<c057c760>]
[14652.574745] Function entered at [<c057c760>] from [<c057d65c>]
[14652.580601] Function entered at [<c057d65c>] from [<c057d398>]
[14652.586457] Function entered at [<c057d398>] from [<bf055a60>]
[14652.592345] Function entered at [<bf055a60>] from [<bf54da34>]
[14652.598233] Function entered at [<bf54da34>] from [<bf53b5cc>]
[14652.604095] Function entered at [<bf53b5cc>] from [<bf53e194>]
[14652.609952] Function entered at [<bf53e194>] from [<bf53e398>]
[14652.615809] Function entered at [<bf53e398>] from [<bf53e53c>]
[14652.621665] Function entered at [<bf53e53c>] from [<c053b634>]
[14652.627522] Function entered at [<c053b634>] from [<c056139c>]
[14652.633379] Function entered at [<c056139c>] from [<c05616ec>]
[14652.639235] Function entered at [<c05616ec>] from [<c053bcac>]
[14652.645091] Function entered at [<c053bcac>] from [<c05ddbf0>]
[14652.650948] Function entered at [<c05ddbf0>] from [<c05dfdd4>]
[14652.656805] Function entered at [<c05dfdd4>] from [<c05df320>]
[14652.662661] Function entered at [<c05df320>] from [<c05e0c48>]
[14652.668518] Function entered at [<c05e0c48>] from [<c053a2f4>]
[14652.674374] Function entered at [<c053a2f4>] from [<c053c688>]
[14652.680230] Function entered at [<c053c688>] from [<c06228d4>]
[14652.686087] Function entered at [<c06228d4>] from [<c0622dbc>]
[14652.691944] Function entered at [<c0622dbc>] from [<c0623164>]
[14652.697801] Function entered at [<c0623164>] from [<c053a138>]
[14652.703657] Function entered at [<c053a138>] from [<c053a6f8>]
[14652.709514] Function entered at [<c053a6f8>] from [<c053ca4c>]
[14652.715370] Function entered at [<c053ca4c>] from [<c0101628>]
[14652.721227] Function entered at [<c0101628>] from [<c012d098>]
[14652.727083] Function entered at [<c012d098>] from [<c0147528>]
[14652.732940] Function entered at [<c0147528>] from [<c01446cc>]
[14652.738797] Function entered at [<c01446cc>] from [<c01075c8>]
[14652.744656] Sending NMI from CPU 0 to CPUs 1:
[14662.749419] NMI backtrace for cpu 1
[14662.749421] CPU: 1 PID: 14 Comm: ksoftirqd/1 Not tainted 4.14.215 #0
[14662.749422] Hardware name: Marvell Armada 380/385 (Device Tree)
[14662.749423] task: df468a80 task.stack: df474000
[14662.749424] pc : [<c063f7a0>] lr : [<c053b364>] psr: 20000013
[14662.749425] sp : df4757a4 ip : 00000002 fp : d409c850
[14662.749426] r10: 00000000 r9 : 00000081 r8 : dec2e800
[14662.749427] r7 : 00000000 r6 : 00010013 r5 : 00000002 r4 : d1301600
[14662.749428] r3 : cf87e30e r2 : 00000008 r1 : cf87e312 r0 : cf87e30e
[14662.749429] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
[14662.749430] Control: 10c5387d Table: 1134804a DAC: 00000051
[14662.749432] CPU: 1 PID: 14 Comm: ksoftirqd/1 Not tainted 4.14.215 #0
[14662.749433] Hardware name: Marvell Armada 380/385 (Device Tree)
[14662.749434] Function entered at [<c010ebf8>] from [<c010a8b8>]
[14662.749435] Function entered at [<c010a8b8>] from [<c0640f94>]
[14662.749436] Function entered at [<c0640f94>] from [<c06466f0>]
[14662.749437] Function entered at [<c06466f0>] from [<c010dab4>]
[14662.749438] Function entered at [<c010dab4>] from [<c0101494>]
[14662.749439] Function entered at [<c0101494>] from [<c010b54c>]
[14662.749440] Exception stack(0xdf475750 to 0xdf475798)
[14662.749442] 5740: cf87e30e cf87e312 00000008 cf87e30e
[14662.749443] 5760: d1301600 00000002 00010013 00000000 dec2e800 00000081 00000000 d409c850
[14662.749444] 5780: 00000002 df4757a4 c053b364 c063f7a0 20000013 ffffffff
[14662.749445] Function entered at [<c010b54c>] from [<c063f7a0>]
[14662.749446] Function entered at [<c063f7a0>] from [<c053b364>]
[14662.749447] Function entered at [<c053b364>] from [<c053b580>]
[14662.749448] Function entered at [<c053b580>] from [<c056133c>]
[14662.749449] Function entered at [<c056133c>] from [<c053bc00>]
[14662.749451] Function entered at [<c053bc00>] from [<c063a394>]
[14662.749452] Function entered at [<c063a394>] from [<c053b634>]
[14662.749453] Function entered at [<c053b634>] from [<c053bda0>]
[14662.749454] Function entered at [<c053bda0>] from [<c057cb2c>]
[14662.749455] Function entered at [<c057cb2c>] from [<c057c760>]
[14662.749456] Function entered at [<c057c760>] from [<c057d65c>]
[14662.749457] Function entered at [<c057d65c>] from [<c057d398>]
[14662.749458] Function entered at [<c057d398>] from [<bf055a60>]
[14662.749459] Function entered at [<bf055a60>] from [<bf54da34>]
[14662.749460] Function entered at [<bf54da34>] from [<bf53b5cc>]
[14662.749461] Function entered at [<bf53b5cc
[14662.749463] Lost 23 message(s)!
[14728.540841] INFO: rcu_sched self-detected stall on CPU
[14728.546019] 1-...: (5999 ticks this GP) idle=e1e/140000000000001/0 softirq=1294358/1294358 fqs=2999
[14728.555277] (t=6001 jiffies g=566962 c=566961 q=39809)
[14728.560614] NMI backtrace for cpu 1
[14728.564118] CPU: 1 PID: 28700 Comm: kworker/1:0 Not tainted 4.14.215 #0
[14728.570759] Hardware name: Marvell Armada 380/385 (Device Tree)
[14728.576718] Workqueue: wg-crypt-wg 0xbf43a22c [wireguard@bf436000+0x1c000]
[14728.583626] Function entered at [<c010ebf8>] from [<c010a8b8>]
[14728.589483] Function entered at [<c010a8b8>] from [<c0640f94>]
[14728.595340] Function entered at [<c0640f94>] from [<c0646708>]
[14728.601197] Function entered at [<c0646708>] from [<c0646794>]
[14728.607053] Function entered at [<c0646794>] from [<c01766e4>]
[14728.612911] Function entered at [<c01766e4>] from [<c0175a78>]
[14728.618767] Function entered at [<c0175a78>] from [<c0178d04>]
[14728.624624] Function entered at [<c0178d04>] from [<c018806c>]
[14728.630480] Function entered at [<c018806c>] from [<c0179354>]
[14728.636337] Function entered at [<c0179354>] from [<c0179bc8>]
[14728.642193] Function entered at [<c0179bc8>] from [<c010e2e8>]
[14728.648050] Function entered at [<c010e2e8>] from [<c016ab68>]
[14728.653907] Function entered at [<c016ab68>] from [<c0165d98>]
[14728.659764] Function entered at [<c0165d98>] from [<c01662f8>]
[14728.665620] Function entered at [<c01662f8>] from [<c0101464>]
[14728.671477] Function entered at [<c0101464>] from [<c010b54c>]
[14728.677334] Exception stack(0xdd605828 to 0xdd605870)
[14728.682408] 5820: 00000000 dec03fc0 00000003 00000000 cfa53000 cf0a1300
[14728.690621] 5840: 00000000 00000000 00000014 0000004f 00000000 00000014 00000003 dd605878
[14728.698834] 5860: 00000004 c057c0c0 60000013 ffffffff
[14728.703906] Function entered at [<c010b54c>] from [<c057c0c0>]
[14728.709763] Function entered at [<c057c0c0>] from [<c057c644>]
[14728.715619] Function entered at [<c057c644>] from [<c057d65c>]
[14728.721476] Function entered at [<c057d65c>] from [<c057d398>]
[14728.727332] Function entered at [<c057d398>] from [<bf055a60>]
[14728.733211] Function entered at [<bf055a60>] from [<bf54da34>]
[14728.739068] Function entered at [<bf54da34>] from [<bf53b5cc>]
[14728.744925] Function entered at [<bf53b5cc>] from [<bf53e194>]
[14728.750782] Function entered at [<bf53e194>] from [<bf53e398>]
[14728.756638] Function entered at [<bf53e398>] from [<bf53e53c>]
[14728.762495] Function entered at [<bf53e53c>] from [<c053b634>]
[14728.768352] Function entered at [<c053b634>] from [<c056139c>]
[14728.774208] Function entered at [<c056139c>] from [<c053bc00>]
[14728.780065] Function entered at [<c053bc00>] from [<c05ddbf0>]
[14728.785922] Function entered at [<c05ddbf0>] from [<c05dfdd4>]
[14728.791778] Function entered at [<c05dfdd4>] from [<c05df320>]
[14728.797635] Function entered at [<c05df320>] from [<c05e0c48>]
[14728.803491] Function entered at [<c05e0c48>] from [<c053a2f4>]
[14728.809348] Function entered at [<c053a2f4>] from [<c053c688>]
[14728.815204] Function entered at [<c053c688>] from [<c06228d4>]
[14728.821061] Function entered at [<c06228d4>] from [<c0622dbc>]
[14728.826917] Function entered at [<c0622dbc>] from [<c0623164>]
[14728.832774] Function entered at [<c0623164>] from [<c053a138>]
[14728.838630] Function entered at [<c053a138>] from [<c053a6f8>]
[14728.844487] Function entered at [<c053a6f8>] from [<c053ca4c>]
[14728.850343] Function entered at [<c053ca4c>] from [<c0101628>]
[14728.856200] Function entered at [<c0101628>] from [<c012d124>]
[14728.862057] Function entered at [<c012d124>] from [<c012d1ec>]
[14728.867913] Function entered at [<c012d1ec>] from [<bf43a594>]
[14728.873797] Function entered at [<bf43a594>] from [<c013ed04>]
[14728.879654] Function entered at [<c013ed04>] from [<c013f1c4>]
[14728.885511] Function entered at [<c013f1c4>] from [<c01446cc>]
[14728.891367] Function entered at [<c01446cc>] from [<c01075c8>]
[14728.897227] INFO: rcu_sched detected stalls on CPUs/tasks:
[14728.902747] 1-...: (6001 ticks this GP) idle=e1e/140000000000000/0 softirq=1294358/1294358 fqs=2999
[14728.912007] (detected by 0, t=6002 jiffies, g=566962, c=566961, q=39809)
[14728.918830] Sending NMI from CPU 0 to CPUs 1:
[14728.923291] NMI backtrace for cpu 1
[14728.923293] CPU: 1 PID: 28700 Comm: kworker/1:0 Not tainted 4.14.215 #0
[14728.923294] Hardware name: Marvell Armada 380/385 (Device Tree)
[14728.923295] Workqueue: wg-crypt-wg 0xbf43a22c [wireguard@bf436000+0x1c000]
[14728.923297] task: d0329a40 task.stack: dd604000
[14728.923298] pc : [<c065a454>] lr : [<bf53dcc4>] psr: 20000013
[14728.923299] sp : dd6059f0 ip : 00000001 fp : c0902d00
[14728.923300] r10: c0904ed8 r9 : c0904ad0 r8 : d017cd00
[14728.923301] r7 : d1339514 r6 : bf540294 r5 : cf14fe40 r4 : d13394c0
[14728.923302] r3 : 00000361 r2 : 00000362 r1 : 00000000 r0 : d1339514
[14728.923303] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
[14728.923304] Control: 10c5387d Table: 12fe404a DAC: 00000051
[14728.923305] CPU: 1 PID: 28700 Comm: kworker/1:0 Not tainted 4.14.215 #0
[14728.923306] Hardware name: Marvell Armada 380/385 (Device Tree)
[14728.923308] Workqueue: wg-crypt-wg 0xbf43a22c [wireguard@bf436000+0x1c000]
[14728.923309] Function entered at [<c010ebf8>] from [<c010a8b8>]
[14728.923310] Function entered at [<c010a8b8>] from [<c0640f94>]
[14728.923311] Function entered at [<c0640f94>] from [<c06466f0>]
[14728.923312] Function entered at [<c06466f0>] from [<c010dab4>]
[14728.923313] Function entered at [<c010dab4>] from [<c0101494>]
[14728.923314] Function entered at [<c0101494>] from [<c010b54c>]
[14728.923315] Exception stack(0xdd6059a0 to 0xdd6059e8)
[14728.923317] 59a0: d1339514 00000000 00000362 00000361 d13394c0 cf14fe40 bf540294 d1339514
[14728.923318] 59c0: d017cd00 c0904ad0 c0904ed8 c0902d00 00000001 dd6059f0 bf53dcc4 c065a454
[14728.923319] 59e0: 20000013 ffffffff
[14728.923320] Function entered at [<c010b54c>] from [<c065a454>]
[14728.923321] Function entered at [<c065a454>] from [<bf53dcc4>]
[14728.923322] Function entered at [<bf53dcc4>] from [<bf53e398>]
[14728.923323] Function entered at [<bf53e398>] from [<bf53e53c>]
[14728.923324] Function entered at [<bf53e53c>] from [<c053b634>]
[14728.923325] Function entered at [<c053b634>] from [<c056139c>]
[14728.923326] Function entered at [<c056139c>] from [<c053bc00>]
[14728.923327] Function entered at [<c053bc00>] from [<c05ddbf0>]
[14728.923327] Function entered at [<c05ddbf0>] from [<c05dfdd4>]
[14728.923328] Function entered at [<c05dfdd4>] from [<c05df320>]
[14728.923329] Function entered at [<c05df320>] from [<c05e0c48>]
[14728.923330] Function entered at [<c05e0c48>] from [<c053a2f4>]
[14728.923331] Function entered at [<c053a2f4>] from [<c053c688>]
[14728.923332] Function entered at [<c053c6
[14728.923334] Lost 13 message(s)!