Learn L2TP IPsec - xl2tpd & PPP Setup

#Introduction

IPsec is secure and IKE is chosen — but without proper xl2tpd and PPP, users will not get a connection. Episode 11 dissects the last two components on the server side: the L2TP daemon that receives tunnels, and the PPP daemon that serves sessions, authenticates, and assigns IP addresses.

In this episode you assemble the complete configuration of /etc/xl2tpd/xl2tpd.conf, /etc/ppp/options.xl2tpd, and user data in /etc/ppp/chap-secrets. When done, your L2TP/IPsec server is technically functional end-to-end.

#xl2tpd Configuration

#The [lns default] Block

xl2tpd serves two roles: LNS for receiving incoming connections (server) and LAC for making outgoing connections (client). For a remote access server, the LNS configuration:

[global]
ipsec saref = yes
 
[lns default]
ip range = 192.168.42.10-192.168.42.250
local ip = 192.168.42.1
require chap = yes
refuse pap = yes
require authentication = yes
name = l2tpd
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

ip range is the address pool that will be handed out to clients, and local ip is the ppp0 interface address on the server side. ipsec saref = yes enables shared support for IPsec acceleration.

#The [ipsec] Block

If IPsec-related features are enabled, make sure the [ipsec] block is present with the correct values:

[ipsec]
require = yes

The value require = yes forces every L2TP connection to go through IPsec protection — plain L2TP without IPsec will be rejected.

#options.xl2tpd: PPP Options

#Enforcing MS-CHAPv2 and MPPE

The /etc/ppp/options.xl2tpd file contains the options xl2tpd hands to pppd for every session:

ipcp-accept-local
ipcp-accept-remote
ms-dns 8.8.8.8
ms-dns 1.1.1.1
name l2tpd
require-mschap-v2
require-mppe-128
refuse-pap
refuse-chap
proxyarp
nologfd

require-mppe-128 mandates 128-bit MPPE encryption on the PPP link — a key requirement for classic Windows L2TP/IPsec. The proxyarp line makes the server answer ARP on behalf of clients so return traffic can be routed easily.

#Users in chap-secrets

PPP user data is stored in /etc/ppp/chap-secrets. The format is username server password ip-address:

budi l2tpd "rahasia-budi" 192.168.42.50
sari l2tpd "rahasia-sari" 192.168.42.51

The server column must match the name value in options.xl2tpd. The IP column is optional; if empty, the address is taken from ip range.

#IP Address Assignment

#How IP Addresses Are Given Out

When a PPP session is built, the client address is determined in priority order: the fixed address from chap-secrets, then from ip range in [lns default], and rejected if the pool is exhausted. The ppp0 interface on the server gets local ip.

Verify the assignment after a client connects:

ip addr show ppp0
sudo ip route | grep ppp

#Debugging and Service Verification

Enable PPP logging to see the authentication process:

sudo tail -f /var/log/syslog | grep pppd
sudo journalctl -u xl2tpd -f

The pppd logs show the LCP -> Authentication -> IPCP sequence. If authentication fails, the line points straight to the cause — for example MS-CHAPv2 authentication failed from a wrong password.

#Closing

Episode 11 completed the server side: xl2tpd configured as an LNS with require = yes for IPsec, PPP enforced to MS-CHAPv2 with MPPE-128, and client IP addresses handed out from the ip range pool or chap-secrets.

Key takeaways:

• [lns default] defines the IP pool, authentication, and PPP file.
• [ipsec] require = yes rejects L2TP without IPsec protection.
• options.xl2tpd enforces MS-CHAPv2 and MPPE-128.
• PPP users are stored in chap-secrets with the user server pass ip format.
• proxyarp makes return routing to clients easy.
• Client IP addresses come from chap-secrets first, then ip range.

In the next episode, episode 12, we will discuss site-to-site L2TP/IPsec — building a gateway-to-gateway connection between two networks, configuring both sides, static and dynamic routing, and the required firewall rules.