Connecting to a Ubiquiti Unifi VPN with a Linux machine

connecting_to_a_ubiquiti_unifi_vpn_with_a_linux_machine.txt

This guide assumes that you have already set up a Ubiquiti Unifi VPN following the guide:
https://help.ubnt.com/hc/en-us/articles/115005445768-UniFi-L2TP-Remote-Access-VPN-with-USG-as-RADIUS-Server

To configure a Linux machine to be able to connect remotely I followed these steps. This guide was written for Debian 8.

- In Debian install the "xl2tpd" and "strongswan" packages.

- Edit /etc/ipsec.conf to add the connection:

    conn YOURVPNCONNECTIONNAME
         authby=secret
         pfs=no
         auto=start
         keyexchange=ikev1
         keyingtries=3
         dpddelay=15
         dpdtimeout=45
         dpdaction=clear
         rekey=no
         ikelifetime=3600
         keylife=3600
         type=transport
         left=%defaultroute
         leftprotoport=17/1701
    # Replace IP address with your VPN server's IP
         right=IPADDRESSOFVPNSERVER
         rightprotoport=17/%any
         ike=aes128-sha1-modp2048,aes256-sha1-modp4096,aes128-sha1-modp1536,aes256-sha1-modp2048,aes128-sha1-modp1024,aes256-sha1-modp1536,aes256-sha1-modp1024,3des-sha1-modp1024!
         esp=aes128-sha1-modp2048,aes256-sha1-modp4096,aes128-sha1-modp1536,aes256-sha1-modp2048,aes128-sha1-modp1024,aes256-sha1-modp1536,aes256-sha1-modp1024!


- Edit /etc/ipsec.secrets to add the secret key for this connection:

    IPADDRESSOFVPNSERVER : PSK "SECRETPRESHAREDKEY"
     

- Edit /etc/xl2tpd/xl2tpd.conf to add this connection:

    [lac YOURVPNCONNECTIONNAME]
    lns = IPADDRESSOFVPNSERVER
    ppp debug = yes
    pppoptfile = /etc/ppp/options.l2tpd.client-YOURVPNCONNECTIONNAME
    length bit = yes
    
    
- Create the file /etc/ppp/options.l2tpd.client-YOURVPNCONNECTIONNAME:

    ipcp-accept-local
    ipcp-accept-remote
    noccp
    refuse-eap
    refuse-chap
    noauth
    idle 1800
    mtu 1410
    mru 1410
    defaultroute

    # Uncomment if you want to use the DNS servers of the VPN host:
    #usepeerdns

    debug
    logfile /var/log/xl2tpd.log
    connect-delay 5000
    proxyarp
    name VPNUSERNAME
    password "VPNPASSWORD"
    
    
- Now to connect to the VPN create a script:

    #!/bin/bash

    echo "Connecting to VPN..."

    echo "c YOURVPNCONNECTIONNAME" > /var/run/xl2tpd/l2tp-control

    sleep 10

    # To have all internet traffic routed through the VPN uncomment:
    #ip route add default dev ppp0

    # To only have a remote subnet routed through the VPN uncomment
    # (this line assumes the remote subnet you want routed is 192.168.0.0/24 and the remote VPN end is 10.11.0.1:
    ip route add 192.168.0.0/24 via 10.11.0.1 dev ppp0


- And to disconnect to the VPN create a script:

    #!/bin/bash

    ip route del default dev ppp0
    ip route del 192.168.0.0/24 dev ppp0

    echo "d YOURVPNCONNECTIONNAME" > /var/run/xl2tpd/l2tp-control
    service xl2tpd restart
    
    
- Note that for these scripts I am assuming that the remote subnet we are interested in is 192.168.0.0/24
  and the remote VPN gateway address is 10.11.0.1.

- You can also decide which line to uncomment based on if you want all traffic to be routed through the VPN
  or to just route connections to the 192.168.0.0/24 subnet.

- If you want all traffic routed through the VPN you may want to uncomment the "usepeerdns" line in
  /etc/ppp/options.l2tpd.client-YOURVPNCONNECTIONNAME so that DNS traffic flows through the VPN rather
  than going to the local DNS server.

Sorry, I don't really know what's going on. I haven't tried doing this kind of VPN in a few months so I'm not sure if Ubiquiti has changed something or not. Is there anyone else following this gist who has seen this, or has a VPN that continues to work fine for more than 1 hour?

I have had a working system for a little while now. I am running Mint 20 Ulyana - I upgraded from v18 a while back because I struggled to get the VPN working even though I was trying things people said worked, such as using different network management packages and fiddling with ipsec.conf. The good thing is even when Microsoft releases updates that break it on Windows clients (I think that was early this year), I was unaffected. After the upgrade I have not had to do anything - just create the connection via the GUI and it works perfectly. Have left it on for a whole day when I forgot to disconnect before going to work - come home and still connected. Not really helpful, since it is the standard unhelpful answer - upgrade:-) Peter Bisset

…

On Thu, 27 Oct 2022 at 01:45, Nick Hall ***@***.***> wrote: ***@***.**** commented on this gist. ------------------------------ Sorry, I don't really know what's going on. I haven't tried doing this kind of VPN in a few months so I'm not sure if Ubiquiti has changed something or not. Is there anyone else following this gist who has seen this, or has a VPN that continues to work fine for more than 1 hour? — Reply to this email directly, view it on GitHub <https://gist.github.com/6b23603ce9df2500a4053b280071d1ad#gistcomment-4348808>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADNAIMCDIEDEG7W3C3CK2I3WFFGY3ANCNFSM4M5WWVGQ> . You are receiving this because you commented.Message ID: <nahall/connecting_to_a_ubiquiti_unifi_vpn_with_a_linux_machine. ***@***.***>

will this work on the Unifi UDM as well?

will this work on the Unifi UDM as well?

I would think so but I haven't tried that.