• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar

Rowell Dionicio

Get Techie With It

  • Home
  • About
  • Newsletter
  • Resources
    • Archives
    • Book List
    • YouTube
  • Learn
    • Wi-Fi 6E
    • CCNP Enterprise Core
    • DevNet Associate
    • PCNSA Certified
  • Blog
  • Contact
  • Show Search
Hide Search

UniFi – USG Pro – Configuring Remote Access VPN

March 7, 2020 By Rowell 11 Comments

The Ubiquiti UniFi Security Gateway (USG) Pro makes a great VPN terminator and is ideal firewall for small and medium business. Occasionally, I am configuring the USG Pro for my clients to protect their networks, be the gateway of their network, and also provide VPN capability.

In this guide, I will show you how to configure a Remote Access VPN on the Ubiquiti USG Pro using L2TP. In this setup, I am using the Cloud Key G2 to manage a Ubiquiti USG Pro.

What is L2TP?

Layer 2 Tunneling Protocol (L2TP) is a tunneling protocol used in VPNs. It needs an encryption protocol to protect the traffic being sent through the L2TP tunnel. Read more here.

There are a few components needed to make this work

  • RADIUS Server (on the USG)
  • RADIUS User
  • VPN Network (on the USG)
  • Firewall Rules (allowing L2TP VPN)
  • Device configuration

RADIUS User Configuration

To log in remotely via VPN, you need an account. The first step is to log into your USG or your UniFi management.

Go to Settings and then click on Services

Under RADIUS and Users, click on Create New User.

RADIUS Users

Type out the account name for this user and give it a strong password. (Make sure you keep that in your password manager). Leave the VLAN section blank.

For Tunnel Type, select 3 – Layer Two Tunneling Protocol (L2TP)
For Medium Type, select 1 – IPv4
Click Save

RADIUS Server Configuration

We will need to configure a RADIUS Server on the Ubiquiti USG in order to accept remote VPN connections from various users that we can set up for remote access.

Under RADIUS and Server enable RADIUS Server. Below that, type in a strong Secret and make sure you document that in your password manager.

Leave the defaults for the rest of the options. Then click on Apply.

RADIUS Server Configuration

Configure a Remote Access VPN Network

When users VPN into the network, we need to place them on their own subnet. On the left side navigation, under Settings, click on Networks.

Click on Create a New Network.

Networks

Give the network a descriptive name such as Remote User VPN

For purpose, select Remote User VPN. This will allow us to select a VPN Type.

For VPN Type, select L2TP Server.

Create a strong Pre-Shared Key (You’ll need this key later when configuring your device for remote VPN)

Give the Remote User VPN network a Gateway/Subnet (Do not overlap this with any preconfigured networks. This is a new network.

For Name Server, select auto or manual. Under Manual you will specify the name servers.

Under RADIUS, select the Default RADIUS profile

Click Save

Configuring a Remote User VPN Network

When you selected Remote User VPN and saved the network, it creates the necessary Firewall rules to allow L2TP VPN. View it under Routing & Firewall > Firewall > Rules IPv4 > WAN LOCAL

Firewall Rules for L2TP VPN

Create VPN Profile on Computer

I use macOS so these instructions are specific. Once I get a hold of my Windows Laptop and update it I’ll add a section for Windows.

In macOS we will use the built-in L2TP VPN capabilities.

Open Network Preferences
Click on the + icon on the bottom left to add a new VPN interface

Under Interface, select VPN
For VPN Type, select L2TP over IPsec
Create a descriptive name under Service Name
Click Create

In the configuration of the VPN profile, keep Configuration at Default.

For the Server Address, set the IP address of your USG’s WAN interface

For account name, set it to the RADIUS user you created earlier

Click on Authentication Settings button

For Password, enter the password of the RADIUS user

Under Machine Authentication, select Shared Secret enter the Shared Secret of the RADIUS Server.

Click OK

Configure your user password and the shared secret of the RADIUS server

Back at the VPN Profile configuration window, click Advanced

Under Options, enable “Send all traffic over VPN connection” if you’d like to make this a Full VPN Tunnel.

Click OK and then click on Apply

L2TP VPN Options

Test Remote Access VPN

Click on Connect

If successful, status will change to Connected, you’ll see how long you’ve been connected, and you’ll have an IP address from when you configured it on the Remote Access VPN network.

macOS L2TP over IPSec configuration

Now try accessing your local resources.

At the time of this writing, Ubiquiti doesn’t offer any way to easily see the status of remote access VPN users on the GUI dashboard.

The closest thing is an Event where my laptop shows that it has connected to the LAN, but you would assume that’s a local Ethernet connection.

My laptop, cts, connecting via remote VPN but triggering this event notification

The only way to tell the status is through the CLI of the USG using show vpn remote-access and show vpn ipsec sa

$ show vpn remote-access
Active remote access VPN sessions:

User       Time      Proto Iface   Remote IP       TX pkt/byte   RX pkt/byte
-------- – – ----- – – - – – - –   – ----------- – – -- – – -- – – -- – – ----
rowell     00h00m14s L2TP  l2tp0   192.168.3.1       326 105.5K    425  62.0K

The Remote IP is the Remote VPN network that I created earlier.

$ show vpn ipsec sa
remote-access: #6, ESTABLISHED, IKEv1, 5df87ceee4a88d30:ba926ce41288578c
  local  ‘x.x.x.x’ @ x.x.x.x
  remote '172.20.3.6' @ 12.9.250.183
  AES_CBC-256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048
  established 330s ago
  remote-access: #7, INSTALLED, TRANSPORT-in-UDP, ESP:AES_CBC-128/HMAC_SHA1_96
    installed 330 ago
    in  c7a3bef9, 1458020 bytes,  9236 packets,     0s ago
    out 0e0bf674, 9496201 bytes, 10136 packets,    29s ago
    local  x.x.x.x/32[udp/l2f]
    remote 12.9.250.183/32[udp/51184]

I’ve sanitized the local IP address. The local address is the WAN of the USG.
The remote IP address is my private IP and what my WAN IP is at the hotel I’m at.

For troubleshooting purposes, you could issue show vpn log tail to see the last 10 VPN log messages. tail is optional, it will continue to update the last 10 log messages and you can use that for troubleshooting someones connection.

$ show vpn log tail
Mar  7 07:10:12 12[IKE] <remote-access|6> closing CHILD_SA remote-access{7} with SPIs c7a3bef9_i (1548107 bytes) 0e0bf674_o (9631239 bytes) and TS x.x.x.x/32[udp/l2f] === 12.9.250.183/32[udp/51184]
Mar  7 07:10:12 04[IKE] <remote-access|6> deleting IKE_SA remote-access[6] between x.x.x.x[x.x.x.x]...12.9.250.183[172.20.3.6]
Mar  7 07:10:15 08[KNL] interface l2tp0 deleted
Mar  7 07:10:56 07[IKE] <7> 12.9.250.183 is initiating a Main Mode IKE_SA
Mar  7 07:10:57 04[IKE] <remote-access|7> IKE_SA remote-access[7] established between x.x.x.x[x.x.x.x]...12.9.250.183[172.20.3.6]
Mar  7 07:10:57 02[IKE] <remote-access|7> CHILD_SA remote-access{8} established with SPIs cb2f14f2_i 02e5c731_o and TS x.x.x.x/32[udp/l2f] === 12.9.250.183/32[udp/64282]
Mar  7 07:11:00 16[KNL] 10.255.255.0 appeared on ppp0
Mar  7 07:11:00 06[KNL] 10.255.255.0 disappeared from ppp0
Mar  7 07:11:00 05[KNL] 10.255.255.0 appeared on ppp0
Mar  7 07:11:00 02[KNL] interface l2tp0 activated

Thoughts

Overall, it was simple to configure remote access VPN if you are familiar with configuring it on other network devices. Ubiquiti could help others with a more simplified wizard to eliminate the number of sections you need to jump through to complete remote access VPN.

Additionally, Ubiquiti needs to add a status of remote VPN users in their dashboard to avoid having to use the CLI.

Share this:

  • Facebook
  • LinkedIn
  • Twitter

Related

Filed Under: Networking Tagged With: ubiquiti, unifi, usg

About Rowell

Wi-Fi expert. Coffee addict ☕️. Tech nerd. Business owner.

Reader Interactions

Comments

  1. ccwind1 says

    December 7, 2020 at 8:48 am

    This is an excellent, step by step guide to setting up a VPN on the Unify USG, and connecting from a Mac.

    A couple of things which would be awesome.

    1.) Screenshots/Instructions for setting up the Windows client
    2.) Screenshots/Instructions for RDP into a Windows machine after connecting to the VPN

    Reply
    • Rowell says

      December 7, 2020 at 9:12 am

      Thanks for the feedback. I’ll get ahold of a Windows machine and replicate the steps for that OS.

      Reply
  2. Jon says

    July 9, 2021 at 2:40 am

    Would love for a step-by-step guide for debian based linux as well. Got the serverside part done, but can’t get my linux client to connect.

    Reply
  3. Jin Verdale says

    September 20, 2021 at 4:56 pm

    Hello. This is very useful indeed, thanks.
    I have a question: Once I am connected to my remote USG (in another town) via the VPN, how do I access those devices connected to that USG (it is in the 192.168.1.1 network while my VPN is on 192.168.4.1 network – followed your instructions not to overlap my VPN with any existing network). I am new at this kind of thing, but there must be a way to link these 2 networks so that I can see my devices by typing their IP addresses. Or is this not how it works?
    Many thanks

    Reply
    • Rowell says

      September 21, 2021 at 7:29 am

      Hi Jin, you may need to create a firewall rule to allow traffic between those two subnets.

      Reply
      • Jin Verdale says

        September 21, 2021 at 9:42 am

        Hi Rowell. Do I create this rule on the USG Routing and Firewall settings, LAN IN/OUT I presume? Many thanks

        Reply
  4. NICK CLARKE says

    October 4, 2021 at 2:43 am

    Hi, Did you manage to do a windows config? having issues with connectivity

    Reply
  5. Christos Kassianides says

    October 18, 2021 at 7:57 am

    I have setup the VPN but when two users, each with their own credentials, try to login to the VPN from the same location, it only allows one of them to connect.

    Is this normal?

    Reply
  6. Dav says

    October 27, 2021 at 6:15 pm

    Pretty good article but at which point does the encryption take place? I don’t see that mentioned anywhere. If this VPN is not encrypted, how do we go about encrypting it?

    Reply
  7. Dave Henderson says

    November 1, 2021 at 4:38 pm

    Dav: L2TP – Layer 2 Tunneling Protocol is a version is IPsec – Encrypted network data

    Christos: I don’t have an answer, I have never tried connecting from one location twice, generally L2TP is used for end-users on a one-off connection. Where more than one person is needing access, we setup a site-to-site tunnel on the router at that location, bypassing the computer needing to connect with VPN.

    Reply
  8. websific says

    April 8, 2022 at 6:04 pm

    These instructions didnt work for my USG PRO 4 but I was trying to use an iPhone as the VPN client

    Reply

Leave a Reply to Dav Cancel reply

Primary Sidebar

Recent Posts

  • 6 GHz Frame Captures with EtherScope nXG
  • Manage Cisco Catalyst in the (Meraki) Cloud
  • Q1 2022 Income Report
  • First Look at Ekahau AI Pro – Network Simulator
  • PAN-OS Configuration Management – PCNSA

Categories

  • bschool
  • Certifications
  • Coding
  • DevNet Associate
  • Events
  • Lab
  • Networking
  • Personal
  • Podcasting
  • Professional
  • Reviews
  • Security
  • Short Stories
  • Uncategorized
  • Wireless

Archives

  • June 2022
  • May 2022
  • January 2022
  • December 2021
  • November 2021
  • August 2021
  • July 2021
  • April 2021
  • February 2021
  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • June 2020
  • May 2020
  • April 2020
  • March 2020
  • February 2020
  • January 2020
  • December 2019
  • November 2019
  • October 2019
  • August 2019
  • June 2019
  • May 2019
  • April 2019
  • March 2019
  • February 2019
  • January 2019
  • November 2018
  • September 2018
  • August 2018

Copyright © 2022 · Written by Rowell Dionicio · You're awesome.

 

Loading Comments...