Setup VPN (L2TP/IPSEC) tunnel between Zywall USG and Windows Phone 8.1+, iPhone/iPad or Android Devices

This is complete step-by-step configuration instructions for setting up VPN connectivity (L2TP/IPSEC) between Zywall USG firewall and the client devices including Windows Phone, iPhone/iPad and Android or Win 10 OS.

For those not fully aware about the advantages VPN will give you – it will enable an encrypted pipeline to your home/office network, and you can use all the services/devices in your private network in safe and secure manner, without opening unnecessary ports that would increase the level of vulnerability of your private network.

Examples of VPN usage:

  •  Connect and use internet and online services in encrypted and secure manner from not-trusted environments like cafes and public WiFis.
  •  Stream freely from anywhere your private videos, view your private photos or work with any computer/document that is available in your network.
  •  View and access country-level regulated online materials from your VPN ‘home’ location when traveling abroad.
  •  Connect to you surveillance cameras, wildlife trail cameras or home alarm systems.

Find below step-by-step configuration instructions for enabling above:

Zywall:

1) Setup and ensure/add that ports required by VPN connectivity are defined and available (NO other SERVICES that are utilizing the same ports!):
1

2) Create VPN User (Object/User tab) and VPN Group (ObjectGroup tab), and add created user into the Group:
2

3) Create WAN, L2TP_POOL and LAN addresses accordingly (L2TP range TO BE completely outside any home/external IP range, that might be in use in either end of the VPN tunnel during VPN utilization – otherwise you may expect trouble…):
3 4

4) Create IPSEC VPN gateway (create own or utilize default available, link then to VPN connection created below):
5

4) Detailed configuration example:
5a

5) Create VPN connection that uses above created VPN gateway (you can utilize default available or create own):
6

5) Detailed configuration example:
6a

6) Create L2TP VPN:
7

7) Create required firewall rules. Make sure VPN required services/ports are allowed (for example IKE, default rule in Zywall). Allow from IPSEC/VPN to LAN or to ANY, depending if wanted through VPN access only to LAN or also to internet:
8

Firewall rules has critical role in establishing the tunnel and allowing the traffic through the tunnel. Please find below for VPN connection ‘negotiation handshake’ troubleshooting purposes an example of successful L2TP/IPSEC handshake flow extracted from Zywall log, and the parts where firewall rules play critical role:

L2TP IPSEC connlog zywall

If you have any issues with your firewall, please enable logging for correct steps and investigate the zywall logs – they are extremely useful.

8) Create required routing rules. (IF ‘send all traffic’ through VPN is on (meaning internet through VPN) – you also need to setup the Policy Route that is upper in the table below:
9

9) Keep WAN trunk and SNAT enabled:
10

Client Machine:

10) Configure client machine – below example Windows Phone 8.1+:
11 12

Test Connectivity:

11) Test and confirm VPN by accessing your private network through 4G VPN connection (lock indicator). Also internet addresses are available through VPN, if allowed in firewall and routing table.
13 14

12) Configure client machine – below example for IOS  (IPhone or IPad):

IPADconfig

Test Connectivity:

13) Test and confirm VPN by accessing your private network through VPN connection (lock indicator). Also internet addresses are available through VPN, if allowed in firewall and routing table.

 IPADconnected

 IPADzyxel

  

14) Configure client machine – below example for Android (Lollipop sw):

 Androidconfig AndroidVPNconnections

Test Connectivity:

15) Test and confirm VPN by accessing your private network through VPN connection (lock indicator). Also internet addresses are available through VPN, if allowed in firewall and routing table.

 Androidconnect Androidconnected

 AndroidZyxel

16) Configure client machine – below example for Windows 10 Operating System:

Navigate to:     Start –> Settings –> Network & Internet –> VPN –> Add a VPN connection

Step1 - win10 VPN conf

Then give the required connection details for the connection and hit Save:

Step2 - win10 VPN conf

Now you are able to Connect to the VPN tunnel – through Network Settings or System Tray, and see ‘Connected’ indicator:

Step3 - win10 VPN conf

And that’s it!

Now you have configured the Zyxel Firewall for VPN connection with L2TP/IPSEC and client device being WP or IOS / Android Device or Win10 OS.

If this helped you in getting your VPN connection built, please drop me a post below for confirmation – Thanks!!!    🙂

Feedback

Juha Ketola

Juha Ketola

Author is a passionate IT enthusiast and early adopter. Packed with years of experience leading Enterprise level IT development teams within the biggest companies of Technology industry. Watches closely start-ups and new disruptive innovations in order to stay on the cutting edge. Embraces hands-on IT development and IoT.
Juha Ketola
Link to open Linkedin Profile

85 Responses to Setup VPN (L2TP/IPSEC) tunnel between Zywall USG and Windows Phone 8.1+, iPhone/iPad or Android Devices

  1. Question ,

    i have 3 USG 1000 firewalls first one has firmware 3.00 and the other has 3.30
    i setup the first firewall , this one is online and running, the VPN is working fine !

    the other 2 , i restored the settings from the first firewall, ( these other 2 are offline )
    if i want to connect the default VPN, it gives an error ( 16015 dial a dynamic tunnel has failed crypto )

    is this because it,s not connected to the internet, or is this firmware related ?

    thanks

  2. how to setup the client for using the vpn, but using the internet only local ( so not the zywall connection )
    is this firewall related or routing

  3. Christian Hoechst says:

    Hello Juha,
    have you tried with users from Active Directory?
    I am failing with AD users. Local users are working perfectly.

    Best regards
    Christian

  4. Andy says:

    HI there!
    It works! But when you are connected to a VPN there is no available internet access on the connected device.
    Cheers,
    Andy.



Leave a Reply

css.php