In this page you find:
- Endian Vpn Client Download Mac Software
- Endian Vpn Client Download Mac Installer
- Endian Vpn Client Download Mac Download
The 4i Edge series brings an unparalleled level of hardware performance and features to the Industrial Internet Security and Industrial VPN router market. Switchboard The Endian Switchboard is the heart of the Endian Secure Digital Platform that provides secure remote access to field equipment, data collection and visualization, edge computing.
- Powered and developed by endian.com Privacy Policyendian.com Privacy Policy.
- Download file from user portal Download Configuration for Other OSs in the.ovpn format. Double Click on the configuration file it will open in Tunnelblick. Click on Connect.
- A user friendly OpenVPN client for Microsoft Windows, Linux, and MacOS X can be downloaded from the Endian Network. The Endian UTM Appliance can be set up either as an OpenVPN server or as a client, and even play both roles at the same time, in order to create.
- Vpn client mac free download - NordVPN, Vpn One Click Mac, Free VPN Client, and many more programs.
- When configured as an OpenVPN server, the Endian UTM Appliance can accept remote connections from the uplink and allow a VPN client to be set up and work as if it were a local workstation or server. Starting with version 3.0, the OpenVPN server deployed on the Endian UTM Appliance allows the simultaneous presence of several instances.
In this page appears the list of the Endian UTM Appliance’s connections asOpenVPN clients, i.e., all tunnelled connections to remote OpenVPNservers. For every connection, the list reports the status, the name,any additional option, a remark, and the actions available:
- the server is active or stopped.
- modify the server’s configuration
- remove the configuration and the server.
The status is closed when the connection is disabled, establishedwhen the connection is enabled, and connecting… while theconnection is being established. Beside to enable and to disable aconnection, the available actions are to edit or delete it. In theformer case, a form will open, that is the same as the one that openswhen adding a connection (see below) in which to see and modify thecurrent settings, whereas in the latter case only deletion of thatprofile from the Endian UTM Appliance is permitted.
The creation of a new OpenVPN client connections is straightforwardand can be done in two ways: Either click on the Add tunnelconfiguration button and enter the necessary information about theOpenVPN server to which to connect (there can be more than one) orimport the client settings from the OpenVPN Access Server by clickingon Import profile from OpenVPN Access Server.
There are two types of settings that can be configured for each tunnelconfiguration: The basic one includes mandatory options for the tunnelto be established, while the advanced one is optional and normallyshould be changed only if the OpenVPN server has a non-standardsetup. To access the advanced settings, click on the >>button next to the Advanced tunnel configuration label. The basicsettings are:
A label to identify the connection.
The remote OpenVPN server’s FQDN, port, and protocol in theform myvpn.example.com:port:protocol. The port andprotocol are optional and left on their default values whichare 1194 and udp respectively when not specified. Theprotocol must be specified in lowercase letters.
The server certificate needed for the tunnel connection.Browsing the local filesystem is admitted, to search for thefile, of the path and filename can be entered. If the serveris configured to use PSK authentication (password/username),the server’s host certificate (i.e., the one downloaded fromthe Download CA certificate link in the server’sMenubar ‣ VPN ‣ OpenVPN server section)must be uploaded to the Endian UTM Appliance. Otherwise, to usecertificate-based authentication, the server’s PKCS#12 file(i.e., the one downloaded from the Export CA asPKCS#12 file link on the server’s Menubar ‣VPN ‣ OpenVPN server ‣ Advanced section) must beuploaded.
Insert here the Challenge password, if one was supplied tothe CA before or during thecreation of the certificate. This is only needed whenuploading a PKCS#12 certificate.
If the server is configured to use PSK authentication(password/username) or certificate plus passwordauthentication, provide here the username and password of theaccount on the OpenVPN server.
A comment on the connection.
In this box, that appears when clicking on the >> buttonin the previous box, additional options can be modified, though thevalues in this box should be modified only if the server side has notbeen configured with standard values.
One or more (one per line) fallback OpenVPN servers in thesame format used for the primary server, i.e.,myvpn.example.com:port:protocol. The port and protocolvalues default to 1194 and udp respectively when omitted. Ifthe connection to the main server fails, one of these fallbackservers will take over.
Hint
The protocol must be written in lowercase letters.
The device used by the server, which is either TAP or TUN.
This drop-down menu is not available if TUN has been selectedas Device type, because in this case the connection type isalways routed. Available options are routed (i.e., theclient acts as a gateway to the remote LAN) or bridged(i.e., the client firewall appears as part of the remoteLAN). Default is routed.
This field is only available if TAP has been selected asDevice type and the connection type is bridged. Fromthis drop-down menu, select the zone to which this clientconnection should be bridged.
This option is only available if the Connection type isrouted. Tick this checkbox to hide the clients connectedthrough this Endian UTM Appliance behind the firewall’s VPN IPaddress. This configuration will prevent incoming connectionsrequests to the clients. In other words, incoming connectionswill not see the clients in the local network.
Tick this checkbox to avoid receiving DHCP responses from theLAN at the other side of the VPN tunnel that conflict witha local DHCP server.
Compress the traffic passing through the tunnel, enabled bydefault.
The protocol used by the server: UDP (default) or TCP. Set toTCP only if an HTTP proxy should be used: In this case, a formwill show up to configure it.
If the Endian UTM Appliance can access the Internet only through an upstreamHTTP proxy, it can still be used as an OpenVPN client in aGateway-to-Gateway setup, but the TCP protocol for OpenVPN must beselected on both sides. Moreover, the account information for theHTTP upstream proxy must be provided in the text fields:
The HTTP proxy host, e.g., proxy.example.com:port, withthe port defaulting to 8080 if not entered.
The proxy account information: The username and thepassword.
A forged user agent string can be used in some casesto disguise the Endian UTM Appliance as a regular web browser,i.e., to contact the proxy as a browser. This operation mayprove useful if the proxy accepts connections only for sometype of browsers.
Once the connection has been configured, a new box at the bottom ofthe page will appear, called TLS authentication, from which toupload a TLS key file to be used for the connection. These options areavailable:
The key file to upload, searchable on the local workstation.
The MD5 checksum of the uploaded file, which will appear assoon as the file has been stored on the Endian UTM Appliance.
This value is set to 0 on servers and to 1 on clients.
The second possibility to add an account is to directly import theprofile from an OpenVPN Access Server: In this case, the followinginformation must be provided:
A custom name for the connection.
The URL of the OpenVPN Access Server.
Note
Note that the Endian UTM Appliance only supportsXML-RPC configuration of the OpenVPN Access Server,therefore a URL input here has the form:https://<SERVERNAME>/RPC2.
The username and password on the Access Server.
If this checkbox is ticked and the server is running on an SSLencrypted connection, then the SSL certificate will be checkedfor validity. Should the certificate not be valid then theconnection will be immediately closed. This feature might bedisabled when using a self-signed certificate.
A comment to recall the purpose of the connection.
In this page you find:
- OpenVPN server
- IPsec/L2TP
Changed in version 2.5: The VPN module GUI has been partly redesigned.
A VPN allows two separated local networks to directly connect toeach other over potentially unsafe networks such as the Internet. Allthe network traffic through the VPN connection is securely transmittedinside an encrypted tunnel, hidden from prying eyes. Such aconfiguration is called a Gateway-to-Gateway VPN, or Gw2Gw VPN forshort. Similarly, a single remote computer somewhere on the Internetcan use a VPN tunnel to connect to a local trusted LAN. The remotecomputer, sometimes called a Road Warrior, appears to be directlyconnected to the trusted LAN while the VPN tunnel is active.
The Endian UTM Appliance supports the creation of VPNs based either onthe IPsec protocol, which is supported by most operating systems andnetwork equipment, or on the OpenVPN service.
A user friendly OpenVPN client for Microsoft Windows, Linux, and MacOSX can be downloaded from the Endian Network.
The Endian UTM Appliance can be set up either as an OpenVPN server or asa client, and even play both roles at the same time, in order tocreate a network of OpenVPN-connected appliances. The menu itemsavailable in the sub-menu are the following:
- OpenVPN server - set up the OpenVPN server so that clients (bothroadwarriors and other Endian UTM Appliances in a Gateway-to-Gatewaysetup) can connect to one of the local zones.
- OpenVPN client (Gw2Gw) - set up the client-side of aGateway-to-Gateway setup between two or more Endian UTM Appliances
- IPsec/L2TP - set up IPsec-based VPN tunnels and L2TP connections
- VPN Users - manage users of VPN connections.
New in version 2.5: Support for L2TP
Changed in version 2.5: Moved the management of all users under asubmenu.
Changed in version 2.5.1: Moved IPsec and L2TP under the same menu
When configured as an OpenVPN server, the Endian UTM Appliance can acceptremote connections from the uplink and allow a VPN client to be set upand work as if it were a local workstation or server.
The page opens with the summary of the current server configuration,separated into two boxes: Global settings and Connection status andcontrol. Two additional tabs give access to Advanced settings andto the VPN client download.
Note
Whenever a change to the configuration of the OpenVPN serveroccurs or the way a user interacts with the other users is modified(e.g., by altering the Networks behind client option, see below),the OpenVPN server must be restarted, for the changes to bepropagated to all users. This necessity is shown after somemodification by a small box carrying a message that remembers torestart the server. The connected clients will be disconnected andautomatically reconnected after a short timeout, usually withoutnoticing the interruption.
This page shows two boxes: one that allows to set up some globalsettings, and an informative one that shows the connected clients.
Global settings
The box on the top shows the current settings, that can be changed atwill right from there, by simply modifying the following options,which are all related to the bridged OpenVPN. When the choice is theuse of a routed VPN setup, however, there will be only one optionavailable: VPN Subnet.
Tick this option to run the OpenVPN server in bridged mode,i.e., within one of the existing zones.
Note
If the OpenVPN server is not bridged (i.e., it isrouted), the clients will receive their IP addresses from adedicated subnet. In this case, appropriate firewall rulesin the VPN firewall should be created, tomake sure the clients can access any zone, or someserver/resource (e.g., a source code repository). If theOpenVPN server is bridged, it inherits the firewallsettings of the zone it is defined in.
The last possible IP address in the network of the selectedzone that should be used for the OpenVPN clients.
Note
Traffic directed to this IP pool has to be filteredusing the VPN firewall.
The first time the service is started a new, self-signed CAcertificate for this OpenVPN server is generated, an operation thatmay take a long time. After the certificate has been generated, it canbe downloaded by clicking on the Download CA certificatelink. This certificate must be used by all the clients that want toconnect to this OpenVPN server, otherwise they will not be able toaccess.
After the server has been set up, it is possible to create andconfigure accounts for clients that can connect to the Endian UTM Appliance inthe Accounts tab.
Connection status and control
The box at the bottom shows a list of the currently connected clients,although the list will be empty until the OpenVPN server is runningand clients have been created and have accessed the OpenVPNserver. This box is identical to the one in Menubar‣ Status ‣ OpenVPN connections, and contains for each client, itsname, assigned and real IP address, the traffic (received andtransmitted) in bytes, the connection time, the uptime, and the onlypossible action:
- kill
- Immediately close the connection for that client.
Troubleshooting VPN connections.
While several problem with VPN connections can be easily spotted bylooking at the configuration, one subtle source of connectionshiccups is a wrong value of the MTU size. The Endian UTM Appliancesets a limit of 1450 bytes to the size of the VPN’s MTU, to preventproblems with the common MTU value used by the ISP, whichis 1500. However, some ISP may use a MTU value lower that thecommonly used value, making the Endian MTU value too large andcausing therefore connection issues (the most visible one isprobably the impossibility to download large files). This value canbe modified by accessing the Endian UTM Appliance from the CLI andfollowing these guidelines:
- Write down the MTU size used by the ISP (see link below).
- Login to the CLI, either from a shell or fromMenubar ‣ System ‣ Web Console.
- Edit the OpenVPN template with an editor of choice:nano /etc/openvpn/openvpn.conf.tmpl.
- Search for the string mssfix 1450.
- Replace 1450 with a lower value, for example 1200.
- Restart OpenVPN by calling: restartopenvpn.
In this tab, three boxes allow to specify advanced settings for theOpenVPN server. Among other settings, certificate-based authentication(as opposed to password-based) can be set here.
Hint
For a normal use these settings can be left at their defaultvalues.
Endian Vpn Client Download Mac Software
Advanced settings
The first box contains some global settings about the daemon:
Normally, one client is allowed to connect from one locationat a time. Selecting this option permits multiple clientlogins, even from different locations. However, when the sameclient is connect twice or more, the VPN firewall rules do notapply anymore.
New in version 2.5: An option to allow multipleconnections.
Global push options
In the second box the network setting sent to the client can bemodified. Each option, after having been changed, should be enable byticking the respective checkbox.
- Push these networks
- The routes to the specified networks defined here are sent tothe connected clients.
- Push these nameservers
- The specified nameservers are sent to the connected clients.
- Push domain
- The search domains used for local name resolution are added tothose of the connected clients.
Note
The options Push these nameservers and Push domain onlywork for clients running the Microsoft Windows operatingsystem.
Authentication settings
The last box concerns the choice of the authentication method amongthe three available, which also determines the configuration optionsavailable.
PSK (username/password)
Endian UTM Appliance‘s default method is PSK (username/password): Theclient authenticates using username and password. To use this method,no additional change is needed, while the other two methods aredescribed below.
By clicking on the Download CA certificate link, thepublic certificate of this OpenVPN server is downloaded. It is neededby the clients to verify the authenticity of the server they areconnecting to. Furthermore, a click on the Export CA asPKCS#12 file link download the certificate in PKCS#12 format (whichshould be kept private), which can be imported into any OpenVPNserver that should be used as a fallback server.
Finally, should this system be a fallback system, two further optionare available:
- PKCS#12
- Use the Browse button to select the certificate filethat exported from the primary server, or provide its pathand name.
- Challenge password
- The password to read the certificate. Leave it empty if thecertificate comes from another Endian UTM Appliance.
X.509 certificate and X.509 certificate & PSK (two factor)
When configuring the X.509-certificate-based authentication method(either certificate only or certificate plus username and password),the configuration becomes a bit more complicated. It is assumed (andrequired) that an independent certificate authority (CA) be employedfor this purpose. It is neither possible nor desired to host such acertificate authority on Endian UTM Appliance.
It is necessary to generate and sign certificates for the server andfor every client using the chosen certificate authority. Thecertificates type must be explicitly specified and be one of “server”and “client” in the “Netscape certificate type” field.
The server certificate file in PKCS#12 format must be uploaded in thissection (specify the Challenge password that has been specified tothe certificate authority before or during the creation of thecertificate).
The client certificates need to have the common name fields equalto their OpenVPN user names.
Warning
When employing certificate-only authentication, a clientwith a valid certificate will be granted access to the OpenVPNserver even if it has no valid account!
Finally, a revocation list (CRL) can be uploaded, in case a clientcertificate has been lost, to revoke that client certificate on theCA.
Click on the link to download the Endian VPN client for MicrosoftWindows, MacOS X, and Linux from the Endian Network. A valid account isneeded to download the client.
In this page appears the list of the Endian UTM Appliance‘s connectionsas OpenVPN clients, i.e., all tunnelled connections to remote OpenVPNservers. For every connection, the list reports the status, the name,any additional option, a remark, and the actions available. The statusis closed when the connection is disabled, and established whenthe connection is enabled. Beside to enable and to disable aconnection, the available actions are to edit or delete it. In theformer case, a form will open, that is the same as the one that openswhen adding a connection (see below) in which to see and modifythe current settings, whereas in the latter case only deletion ofthat profile from the Endian UTM Appliance is permitted.
The creation of a new OpenVPN client connections is straightforwardand can be done in two ways: Either click on the Add tunnelconfiguration button and enter the necessary information about theOpenVPN server to which to connect (there can be more than one) orimport the client settings from the OpenVPN Access Server by clickingon Import profile from OpenVPN Access Server.
Add tunnel configuration
There are two types of settings that can be configured for each tunnelconfiguration: The basic one includes mandatory options for the tunnelto be established, while the advanced one is optional and normallyshould be changed only if the OpenVPN server has a non-standardsetup. To access the advanced settings, click on the >>button next to the Advanced tunnel configuration label. The basicsettings are:
- Connection name
- A label to identify the connection.
- Connect to
- The remote OpenVPN server’s FQDN, port, and protocol in theform myvpn.example.com:port:protocol. The port andprotocol are optional and left on their default values whichare 1194 and udp respectively when not specified. Theprotocol must be specified in lowercase letters.
- Upload certificate
- The server certificate needed for the tunnel connection.Browsing the local filesystem is admitted, to search for thefile, of the path and filename can be entered. If the serveris configured to use PSK authentication (password/username),the server’s host certificate (i.e., the one downloaded fromthe Download CA certificate link in the server’sMenubar ‣ VPN ‣ OpenVPN server section)must be uploaded to the Endian UTM Appliance. Otherwise, to usecertificate-based authentication, the server’s PKCS#12 file(i.e., the one downloaded from the Export CA asPKCS#12 file link on the server’s Menubar ‣VPN ‣ OpenVPN server ‣ Advanced section) must beuploaded.
- PKCS#12 challenge password
- Insert here the Challenge password, if one was supplied tothe CA before or during thecreation of the certificate. This is only needed whenuploading a PKCS#12 certificate.
- Username, Password
- If the server is configured to use PSK authentication(password/username) or certificate plus passwordauthentication, provide here the username and password of theaccount on the OpenVPN server.
- Remark
- A comment on the connection.
Advanced tunnel configuration
In this box, that appears when clicking on the >> buttonin the previous box, additional options can be modified, though thevalues in this box should be modified only if the server side has notbeen configured with standard values.
One or more (one per line) fallback OpenVPN servers in thesame format used for the primary server, i.e.,myvpn.example.com:port:protocol. The port and protocolvalues default to 1194 and udp respectively when omitted. Ifthe connection to the main server fails, one of these fallbackservers will take over.
Hint
The protocol must be written in lowercase letters.
If the Endian UTM Appliance can access the Internet only through an upstreamHTTP proxy, it can still be used as an OpenVPN client in aGateway-to-Gateway setup, but the TCP protocol for OpenVPN must beselected on both sides. Moreover, the account information for theHTTP upstream proxy must be provided in the text fields:
- HTTP proxy
- The HTTP proxy host, e.g., proxy.example.com:port, withthe port defaulting to 8080 if not entered.
- Proxy username, Proxy password
- The proxy account information: The username and thepassword.
- Forge proxy user-agent
- A forged user agent string can be used in some casesto disguise the Endian UTM Appliance as a regular web browser,i.e., to contact the proxy as a browser. This operation mayprove useful if the proxy accepts connections only for sometype of browsers.
Once the connection has been configured, a new box at the bottom ofthe page will appear, called TLS authentication, from which toupload a TLS key file to be used for the connection. These options areavailable:
- TLS key file
- The key file to upload, searchable on the local PC’s file system.
- MD5
- The MD5 checksum of the uploaded file, which will appear assoon as the file has been stored on the Endian UTM Appliance.
- Direction
- This field is set to 0 on servers and to 1 on clients.
Import profile from OpenVPN Access Server
The second possibility to add an account is to directly import theprofile from an OpenVPN Access Server: In this case, the followinginformation must be provided:
The URL of the OpenVPN Access Server.
Note
Note that the Endian UTM Appliance only supportsXML-RPC configuration of the OpenVPN Access Server,therefore a URL input here has the form:https://<SERVERNAME>/RPC2.
The IPsec page contains two tabs (IPsec and L2TP), that allow toset up and configure the IPsec tunnels and to enable the L2TP support,respectively.
The IPsec tab contains three boxes: First, Global settings, servesto enable and configure IPsec. The second, Connection status andcontrol, shows all the connections and allows to add a newone. Finally, the Certificate authorities box allows to manage thecertificates. Note that by adding a new connection, new boxes will beshown, that help in the configuration of the connections’ types and oftheir options.
IPsec in a nutshell.
IPsec is a generic standardised VPN solution,in which the encryption and the authentication tasks are carriedout on the OSI layer 3 as an extension to the IPprotocol. Therefore, IPsec must be implemented in the kernel’s IPstack. Although IPsec is a standardised protocol and it iscompatible to most vendors that implement IPsec solutions, theactual implementation may be very different from vendor to vendor,sometimes causing severe interoperability issues.
Moreover, the configuration and administration of IPsec is usuallyquite difficult due to its complexity and design, while someparticular situations might even be impossible to handle, forexample when there is the necessity to cope with NAT.
Compared to IPsec, OpenVPN is easier to install, configure, andmanage. The Endian UTM Appliance implements an easy to useadministration interface that supports different authenticationmethods. It is suggested to use IPsec only if absolutely needed,for example to support existing IPsec installations or when dealingwith devices that do not support OpenVPN, because ofinteroperability problems that may arise, while the use of OpenVPNis encouraged in all other cases, especially if there is thenecessity to work with NAT.
Global settings
In this box can be done the configuration of the main parameters forthe IPsec configuration:
- Enabled
- Enable IPsec by ticking the checkbox (it is disabled by default).
- Debug options
- By clicking on the small + sign, some checkboxes willappear: Show the structure of input messages, Show thestructure of output messages, Show interaction with kernelIPsec support (KLIPS), and Show interaction with DNS. Byticking them, more detailed messages will be logged to the/var/log/messages file.
Connection status and control
Here there is a list of accounts and their connection status. The listshows the name, type, common name, remark, and status of eachconnection. New connections are added by clicking on theAdd button (see below). Possibleactions on each connection are: To restart, to enable or disable ,to edit or to delete it.
Certificate authorities
In the last box of the IPsec main page, the root and host certificatesare shown and the existing certificates can be managed. If root andhost certificates have yet to be generated, a “Not present”message is shown.
Endian Vpn Client Download Mac Installer
Warning
Please note that by resetting the root certificates,not only the certificates but also certificate-basedconnections will be erased.
Generate root/host certificates
The following information shall be entered to create new host and rootcertificates.
- Organization name
- The organization name to use in the certificate. Forexample, if the VPN is connecting together the schools in aschool district, it can be something like “SchoolDistrict of Aberdeen.”
- Endian Firewall hostname
- The hostname used to identify the certificate. It should beeither the FQDN or the REDIP address of the Endian UTM Appliance.
- Your email address
- A contact e-mail address.
- Your department
- The department name.
- City
- The name of the town or city.
- State or province
- The name of the state or province.
- Country
- Country of residence.
The certificates are created after clicking on the Generateroot/host certificates button. The process can take up to severalminutes to complete.
- Subject alt name
- An alternative hostname for identification.
Instead of generating new certificates, a previously created PKCS12certificate file can be upload using the lower box of the page.
- Upload PKCS12 file
- Open the file selection dialogue box by clicking on theBrowse... button and select the PKCS12 file.
- PKCS12 file password
- The password of the certificate, if the file is protected.
- Upload PKCS12 file
- Click this button to upload the PKCS12 file.
Add a tunnel/Connection type
Upon clicking on Add under Connection status and control,a page will open from which to select either a Host-to-Net VirtualPrivate Network, a Net-to-Net Virtual Private Network, or an L2TPHost-to-Net Virtual Private Network. After the choice of the type ofconnection, and one click on the Add button, the page forthe connection editor will open, that contains two boxes grouping thetypes of options: Connection configuration and Authentication.
Connection configuration
The first box is used to configure the network parameters:
The action to perform if a peer disconnects. Available choicesfrom the drop-down menu are to Clear, to Hold, or toRestart the peer.
Note
Unlike in other places, clicking or moving the mouseover the ? will not provide a tooltip, but open a web pagewith a detailed description of the functionalities of the deadpeer detection.
Endian Vpn Client Download Mac Download
Authentication
This box serves to configure the authentication.
Enter a pass phrase to be used to authenticate the other sideof the tunnel. Choose this option for a simple Net-to-NetVPN.
Warning
Do not use PSKs to authenticate Host-to-Netconnections!
Advanced settings
In this page, that opens upon defining and saving a new connection,some advanced setting for that connection can be defined.
Warning
Unexperienced users should not change the followingadvanced settings!
Tick this box to enable IKE aggressive mode. It is suggestedNOT to do so.
Changed in version 2.5: This option was removed from the2.5 version.
See also
On the website help.endian.com, the followingtutorials are available:
- IPsec VPN - How to Create a Roadwarrior Connection (Shrewsoft)
- SSL VPN - How to Create a Net-to-Net Connection
- SSL VPN - How to Create a Net-to-Net Connection (over HTTP)
- IPsec VPN - How to Create a Net-to-Net Connection(Endian-to-Endian)
- SSL VPN - How to Create a Roadwarrior Connection
- IPsec VPN - How to Create a Net-to-Net Connection(Endian-to-Cisco ASA)
L2TP, the Layer 2 Tunnelling Protocol, is described in RFC 2661. Ina nutshell, it is a protocol that allows a tunnel connection thatcarries PPP packets. It is used to support VPN connections usingIPSec.
The following options are available to configure L2TP.
- Enable L2TP
- The checkbox must be ticked to enabled L2TP support in theEndian UTM Appliance.
- Zone
- The zone to which the L2TP connections are directed. Only theactivated zones can be chosen from the drop-down menu.
- L2TP IP pool start address, L2TP IP pool end address
- The IP range from which L2TP users will receive an IP address whenconnecting to the Endian UTM Appliance.
- Enable debug
- Tick this checkbox to let L2TP produce more verbose logs.
See also
On the website help.endian.com, there are severaltutorials available, that help in the set up of the Endian UTM Applianceas IPsec server and smartphones as clients:
- Setup of a VPN with IPsec and an L2TP tunnel
- Connecting to an Endian UTM via L2TP (IPSec) using Android
- Connecting to an Endian UTM via L2TP (IPSec) using iOS
- Connecting to an Endian UTM via L2TP (IPSec) using Windows 7
Changed in version 2.5: This configuration page was moved fromMenubar ‣ VPN ‣ OpenVPN server ‣ Accountsand its layout was improved.
The box in this page contains the list of OpenVPN users, which isinitially empty. The only available action is therefore toAdd new User, while the list contains the list of theaccounts already defined with some information on it: The account’sname, a remark, whether it is an OpenVPN or L2TP user, the networksused by the account, its status and the available actions.
Click on Add new User to add a VPN account. In the form thatwill show up, the following options can be specified for each user:
Add User
- Name
- The login name of the user
- Enabled
- Tick the checkbox to enable the user, i.e., to allow her toconnect to the OpenVPN server on the Endian UTM Appliance.
- Password, Confirm password
- The password for the user, to be entered twice. The passwordsare actually not shown: To see them, tick the two checkboxeson their right.
- Remark
- An additional comment.
Under the VPN protocols panel, two checkboxes allow to chose theprotocol used for the VPN connection:
Tick this checkbox to allow the L2TP protocol to be used.
Note
This option can not be selected if no L2TP tunnelhas yet been configured. In such a case, aninformative message appears as a hyperlink: Uponclicking on it, the IPsec connection editoropens. Once done, it will be possible to allow a VPNuser to connect using the L2TP Protocol.
Right below, it is possible to specify more advanced settings foreach of the protocols that the user shall use. A click on theAdvanced Settings hyperlink shows two more hyperlinks:Clicking on each of them reveals a new panel in which to configurefurther settings for the connection.
OpenVPN Options
- direct all client traffic through the VPN server
- If this option is checked, all the traffic from the connectingclient, regardless of the destination, is routed through theuplink of the Endian UTM Appliance. The default is to route all thetraffic whose destination is outside any of the internal zones(such as Internet hosts) through the client’s uplink.
- Push only global options to this client
- For advanced users only. Normally, when a client connects,tunneled routes to networks that are accessible via VPN areadded to the client’s routing table, to allow it to connect tothe various local networks reachable from the Endian UTM Appliance. Thisoption should be enabled if this behaviour is not wanted, butthe client’s routing tables (especially those for the internalzones) should be modified manually.
- Push route to blue zone, Push route to orange zone
- When this option is active, the client will have access to theblue or the orange zone. These options have no effect if thecorresponding zones are not enabled.
- Networks behind client
- This option is only needed if this account is used as a clientin a Gateway-to-Gateway setup. In the box should be writtenthe networks laying behind this client that should be pushedto the other clients. In other words, these networks will beavailable to the other clients.
- Push only these networks
- The local network routes that should be pushed to theclient. This options overrides all automatically pushed routes
- Static IP addresses
- Dynamic IP addresses are assigned to clients, but a static IPaddress provided here will be assigned to the client wheneverit connects.
- Enable push these nameservers
- Assign custom nameservers on a per-client basis here. Thissetting (and the next one) can be defined, but enabled ordisabled at will.
- Enable push domains
- Assign custom search domains on a per-client basis here.
- One-to-One NAT
- In the two textfield below it is possible to specify customone-to-one NAT-ed sources and destinations.
Note
When planning to have two or more branch offices connectedthrough a Gateway-to-Gateway VPN, it is good practice to choosedifferent subnets for the LANs in the different branches. Forexample, one branch might have a GREEN zone with the192.168.1.0/24 subnet while the other branch uses192.168.2.0/24. Using this solution, several possible sourcesfor errors and conflicts will be avoided. Indeed, severaladvantages come for free, including: The automatic assignment ofcorrect routes, without the need for pushing custom routes, nowarning messages about possibly conflicting routes, correct localname resolution, and easier WAN network setup.
L2TP Options
- IPsec Tunnel
- This drop-down menu allows to choose the tunnel that will beemployed by the user, among those already defined.