Learn L2TP IPsec - Virtual IP & Address Management

#Introduction

Every VPN client needs an IP address on the internal network — but where does that address come from? Episode 17 discusses address management: Virtual IP allocation through IKE's built-in mechanisms, the address pool on the server side, and full integration with RADIUS for dynamic allocation and accounting.

With properly managed addresses, you can enforce per-user access policies, audit who uses which address, and allocate dedicated subnets based on groups. This is the operational foundation for large-scale deployments.

#Virtual IP: ModeConfig and Configuration Payload

#IKEv1 ModeConfig and IKEv2 CP

Allocating addresses through IKE is called ModeConfig in IKEv1 and Configuration Payload (CP) in IKEv2. The server sends the IP address assigned to the client as part of the negotiation, along with other options such as DNS and address rotation time.

On the server side, the address pool is defined with rightsourceip. When a client receives an address from this pool, its interface is created and routing is set automatically by the IPsec daemon.

#Address Pools in Libreswan

#rightsourceip

Libreswan allocates Virtual IPs with rightsourceip and enables ModeConfig with modecfgserver:

conn vpn-pool
    type=tunnel
    left=%any
    leftsubnet=10.10.10.0/24
    right=%any
    rightaddresspool=192.168.42.10-192.168.42.250
    modecfgserver=yes
    modecfgdns1=8.8.8.8
    modecfgdns2=1.1.1.1

The rightaddresspool=192.168.42.10-192.168.42.250 value is the range of addresses to hand out. Choose a range that does not conflict with your LAN.

#strongSwan

In strongSwan, the pool is defined in the pools block:

pools {
    vpn_pool {
        addrs = 192.168.42.10-192.168.42.250
        dns = 8.8.8.8, 1.1.1.1
    }
}
connections {
    vpn-ikev2 {
        pools = vpn_pool
        ...
    }
}

#RADIUS Integration

#FreeRADIUS for Allocation and Accounting

For enterprise environments, static or per-user allocation is done through RADIUS. The server requests address attributes from FreeRADIUS, which can decide based on user and group. A basic FreeRADIUS configuration:

budi  Cleartext-Password := "rahasia-budi"
      Framed-IP-Address = 192.168.42.50,
      Framed-IP-Netmask = 255.255.255.255,
      Framed-Protocol = PPP

The Framed-IP-Address attribute sets a fixed address for user budi. FreeRADIUS also accepts Accounting packets from the NAS, so you can record the duration and traffic volume of every session.

#Connecting pppd and IPsec to RADIUS

On the PPP side, pppd is connected to RADIUS with the radius module:

plugin radius.so
radius-config-file /etc/ppp/radius.conf
require-mschap-v2

Meanwhile, IKEv2 with EAP-RADIUS connects strongSwan to FreeRADIUS via the eap-radius plugin. The combination of both gives a single source of truth for user credentials.

#Choosing an Allocation Strategy

#When to Use Which

• Static pool (rightsourceip): enough for small-to-medium deployments without many policies.
• Framed-IP in RADIUS: a fixed address per user — useful for audit and IP-based firewalls.
• Dynamic pool + RADIUS group attributes: allocating different subnets per group, for example the finance and engineering divisions.
• Accounting: mandatory for billing, security audits, and anomaly detection.

Verify the allocation after a client connects:

sudo ipsec statusall | grep -E "virtual|pool"
ip addr show ppp0

ppp0 on the client side must show an address taken from the pool.

#Closing

Episode 17 completed address management: Virtual IP via ModeConfig and Configuration Payload, address pools with rightaddresspool, and FreeRADIUS integration for per-user allocation and accounting.

Key takeaways:

• ModeConfig (IKEv1) and Configuration Payload (IKEv2) allocate Virtual IPs.
• rightaddresspool in Libreswan and the pools block in strongSwan define the pool.
• modecfgserver=yes enables ModeConfig in Libreswan.
• FreeRADIUS can allocate fixed addresses via Framed-IP-Address.
• The radius.so module connects pppd to RADIUS.
• Avoid overlap between the Virtual IP subnet and the LAN subnet.

In the next episode, episode 18, we will discuss mobile client support — how to configure L2TP/IPsec on iOS, Android, Windows, and macOS, creating centralized profiles, and troubleshooting connections from devices.