Learn L2TP IPsec - Site-to-Site L2TP/IPsec

#Introduction

So far we built remote access: one user connects to one server. Episode 12 changes the scenario to site-to-site — two networks separated by the internet connected through two gateways. Every machine at the branch office can talk to machines at headquarters as if they were on the same network.

The site-to-site L2TP/IPsec topology uses two gateways that both act as LNS. Because traffic crosses two different networks, tunnel mode is the correct choice (see episode 5). We will assemble the configuration on both sides, connect them, and then set up routing.

#The Gateway-to-Gateway Topology

#Two Networks, Two LNSes

Imagine headquarters with the 10.10.10.0/24 network and a branch with 192.168.1.0/24. Both gateways have their own public IP:

Kantor Pusat: 10.10.10.0/24  - gateway 203.0.113.10 (LNS)
Kantor Cabang: 192.168.1.0/24 - gateway 198.51.100.20 (LNS)

Traffic from the branch toward headquarters goes through the L2TP/IPsec tunnel built between the two gateways. Because both sides are LNS, the tunnel is initiated from one side acting as a logical LAC — in this example the branch side starts the connection.

#Configuring Both Sides

#Headquarters Side (203.0.113.10)

In Libreswan, the site-to-site connection uses tunnel mode with leftsubnet and rightsubnet:

conn branch-to-hq
    type=tunnel
    left=203.0.113.10
    leftsubnet=10.10.10.0/24
    right=198.51.100.20
    rightsubnet=192.168.1.0/24
    authby=secret
    ikev2=insist
    ike=aes256-sha2;modp2048
    esp=aes256-sha2
    auto=start

Note auto=start — the headquarters gateway actively builds the connection at boot instead of waiting.

#Branch Side (198.51.100.20)

The branch side is the mirror image:

conn branch-to-hq
    type=tunnel
    left=198.51.100.20
    leftsubnet=192.168.1.0/24
    right=203.0.113.10
    rightsubnet=10.10.10.0/24
    authby=secret
    ikev2=insist
    ike=aes256-sha2;modp2048
    esp=aes256-sha2
    auto=start

The secrets on both sides must be consistent. The format in /etc/ipsec.secrets for a host-pair PSK:

203.0.113.10 198.51.100.20 : PSK "psk-site-to-site-yang-kuat"

#Routing and Firewall

#Enabling IP Forwarding

So that the gateways forward traffic between networks, enable kernel forwarding:

sudo sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-ipsec.conf

In addition, set up routing: machines behind the gateway must know that the remote network is reachable through the gateway. Add static routes on every LAN router, or enable dynamic routing — for example OSPF over the ppp0 interface — for larger networks.

#Firewall Rules

Open the required ports and allow the VPN subnets through the firewall:

sudo nft add rule inet filter input udp dport 500 accept
sudo nft add rule inet filter input udp dport 4500 accept
sudo nft add rule inet filter forward ip saddr 192.168.1.0/24 accept
sudo nft add rule inet filter forward ip saddr 10.10.10.0/24 accept

Do not forget to add a MASQUERADE rule or correct return routing, because traffic from the VPN subnets must be able to get back to its origin network.

#Verifying the Connection

#Checking SAs and Pinging Across Networks

After both sides are running, verify from one of the gateways:

sudo ipsec statusall
ping -c 3 198.51.100.20

If the SA is up and the cross-gateway ping succeeds, continue from a machine behind the gateway:

ping -c 3 10.10.10.5

This step tests full routing — not just IPsec — because the packets must enter the tunnel at the gateway and then be forwarded to the destination machine in the other subnet.

#Frequently Encountered Problems

The two most common mistakes in site-to-site deployments. First, the PSK differs between the two sides — the IKE negotiation will fail and the log shows authentication failed. Second, leftsubnet and rightsubnet are swapped — the SA forms but traffic never arrives because the destination subnet does not match. Check both before touching the firewall.

#Closing

Episode 12 built a full site-to-site L2TP/IPsec setup: a two-LNS topology with tunnel mode, mirror configurations on both gateways, a host-pair PSK in ipsec.secrets, IP forwarding and routing, and firewall rules.

Key takeaways:

• Site-to-site uses two LNSes and always uses tunnel mode.
• leftsubnet and rightsubnet define the networks behind the gateways.
• The host-pair PSK must match exactly on both sides.
• Enable net.ipv4.ip_forward on both gateways.
• Open UDP 500 and 4500, then allow the VPN subnets in the firewall.
• Static or dynamic routing is mandatory behind the gateways.

In the next episode, episode 13, we will discuss security analysis and attack vectors — threats such as PSK brute-force and Aggressive Mode, downgrade attacks, and mitigation with IKEv2, certificates, and firewall hardening.