Connecting to a Ubiquiti Unifi VPN with a Linux machine

connecting_to_a_ubiquiti_unifi_vpn_with_a_linux_machine.txt

This guide assumes that you have already set up a Ubiquiti Unifi VPN following the guide:
https://help.ubnt.com/hc/en-us/articles/115005445768-UniFi-L2TP-Remote-Access-VPN-with-USG-as-RADIUS-Server

To configure a Linux machine to be able to connect remotely I followed these steps. This guide was written for Debian 8.

- In Debian install the "xl2tpd" and "strongswan" packages.

- Edit /etc/ipsec.conf to add the connection:

    conn YOURVPNCONNECTIONNAME
         authby=secret
         pfs=no
         auto=start
         keyexchange=ikev1
         keyingtries=3
         dpddelay=15
         dpdtimeout=45
         dpdaction=clear
         rekey=no
         ikelifetime=3600
         keylife=3600
         type=transport
         left=%defaultroute
         leftprotoport=17/1701
    # Replace IP address with your VPN server's IP
         right=IPADDRESSOFVPNSERVER
         rightprotoport=17/%any
         ike=aes128-sha1-modp2048,aes256-sha1-modp4096,aes128-sha1-modp1536,aes256-sha1-modp2048,aes128-sha1-modp1024,aes256-sha1-modp1536,aes256-sha1-modp1024,aes256-sha1,3des-sha1-modp1024,3des-sha1!
         esp=aes128-sha1-modp2048,aes256-sha1-modp4096,aes128-sha1-modp1536,aes256-sha1-modp2048,aes128-sha1-modp1024,aes256-sha1-modp1536,aes256-sha1-modp1024,aes128-sha1,aes256-sha1,3des-sha1!


- Edit /etc/ipsec.secrets to add the secret key for this connection:

    IPADDRESSOFVPNSERVER : PSK "SECRETPRESHAREDKEY"
     

- Edit /etc/xl2tpd/xl2tpd.conf to add this connection:

    [lac YOURVPNCONNECTIONNAME]
    lns = IPADDRESSOFVPNSERVER
    ppp debug = yes
    pppoptfile = /etc/ppp/options.l2tpd.client-YOURVPNCONNECTIONNAME
    length bit = yes
    
    
- Create the file /etc/ppp/options.l2tpd.client-YOURVPNCONNECTIONNAME:

    ipcp-accept-local
    ipcp-accept-remote
    noccp
    refuse-eap
    refuse-chap
    noauth
    idle 1800
    mtu 1410
    mru 1410
    defaultroute

    # Uncomment if you want to use the DNS servers of the VPN host:
    #usepeerdns

    debug
    logfile /var/log/xl2tpd.log
    connect-delay 5000
    proxyarp
    name VPNUSERNAME
    password "VPNPASSWORD"
    
    
- Now to connect to the VPN create a script:

    #!/bin/bash

    echo "Connecting to VPN..."

    echo "c YOURVPNCONNECTIONNAME" > /var/run/xl2tpd/l2tp-control

    sleep 10

    # To have all internet traffic routed through the VPN uncomment:
    #ip route add default dev ppp0

    # To only have a remote subnet routed through the VPN uncomment
    # (this line assumes the remote subnet you want routed is 192.168.0.0/24 and the remote VPN end is 10.11.0.1:
    ip route add 192.168.0.0/24 via 10.11.0.1 dev ppp0


- And to disconnect to the VPN create a script:

    #!/bin/bash

    ip route del default dev ppp0
    ip route del 192.168.0.0/24 dev ppp0

    echo "d YOURVPNCONNECTIONNAME" > /var/run/xl2tpd/l2tp-control
    service xl2tpd restart
    
    
- Note that for these scripts I am assuming that the remote subnet we are interested in is 192.168.0.0/24
  and the remote VPN gateway address is 10.11.0.1.

- You can also decide which line to uncomment based on if you want all traffic to be routed through the VPN
  or to just route connections to the 192.168.0.0/24 subnet.

- If you want all traffic routed through the VPN you may want to uncomment the "usepeerdns" line in
  /etc/ppp/options.l2tpd.client-YOURVPNCONNECTIONNAME so that DNS traffic flows through the VPN rather
  than going to the local DNS server.