Learn L2TP IPsec - Automation & IaC

#Introduction

Typing configuration by hand over and over is the biggest source of errors in VPN infrastructure. Episode 20 discusses automation and Infrastructure as Code (IaC): how to define an entire L2TP/IPsec deployment as code that can be repeated, audited, and applied consistently.

The end goal is simple: replace three new VMs or production servers with a single command, ensure the result is identical every time, and have credentials and certificates managed centrally.

#Ansible for Provisioning

#Roles for Libreswan, strongSwan, and xl2tpd

Ansible is a great fit for provisioning because VPN configuration is deterministic text files. A playbook structure with centralized variables:

- hosts: vpn_servers
  become: true
  vars:
    ipsec_psk: "{{ vault_ipsec_psk }}"
    ppp_pool: "192.168.42.10-192.168.42.250"
  tasks:
    - name: Install paket VPN
      apt:
        name: [libreswan, xl2tpd, ppp]
        state: present
    - name: Deploy ipsec.conf
      template:
        src: ipsec.conf.j2
        dest: /etc/ipsec.conf
      notify: restart ipsec
  handlers:
    - name: restart ipsec
      systemd:
        name: ipsec
        state: restarted

The Jinja2 template ipsec.conf.j2 uses variables so one template serves many environments. Store the PSK in Ansible Vault — never in a plaintext playbook.

#Terraform for Infrastructure

#Defining Infrastructure as Code

Terraform manages the infrastructure side: VMs, networks, firewalls, and DNS. An example with a cloud provider:

resource "hcloud_server" "vpn" {
  name        = "vpn-prod-01"
  image       = "ubuntu-24.04"
  server_type = "cx21"
  location    = "fsn1"
}
 
resource "hcloud_firewall_rule" "vpn" {
  firewall_id = hcloud_firewall.vpn.id
  direction   = "in"
  protocol    = "udp"
  port        = "500"
  source_ips  = ["0.0.0.0/0"]
}

Firewall rules are written as code, so UDP ports 500, 4500, and 1701 are documented and reviewable in a pull request. Combine it with Ansible: Terraform creates the servers, Ansible installs the configuration inside them.

#Centralized Management

#RADIUS and LDAP

The more servers there are, the more important a single source of truth for users becomes. FreeRADIUS can validate credentials against LDAP, so users do not have to be recreated on every server. pppd uses the radius module, and strongSwan uses eap-radius — both point to the same FreeRADIUS.

#Certificate Automation with ACME

Expired certificates are preventable downtime. ACME — the protocol used by Let's Encrypt — automates issuing and renewal. For IPsec, issue the server certificate automatically:

sudo certbot certonly --standalone -d vpn.example.com

After renewal, run a hook that imports the new certificate into NSS or charon:

certbot renew --deploy-hook "ipsec auto --reload"

The certbot renew --deploy-hook line reloads the IPsec configuration every time the certificate is renewed.

#Building a Deploy Pipeline

#From Commit to Production

Chain all the tools into a pipeline that runs automatically: Terraform provisions the infrastructure, Ansible installs and configures, CI validates changes, and monitoring keeps everything healthy. At the end of the line is GitOps: every change goes through git, every change is audited.

IaC practice checklist:

• One repository for configuration, templates, and encrypted secrets.
• Ansible Vault or a cloud secret manager for all credentials.
• Jinja2 templates for configurations that differ per environment.
• Terraform for VMs, networks, firewalls, and DNS.
• ACME for automatic certificate renewal.
• CI pipeline that runs validation before deploy.

#Closing

Episode 20 automated the entire deployment lifecycle: Ansible roles for the three daemons, Terraform infrastructure as code, centralized user management via RADIUS and LDAP, and automatic certificate renewal via ACME.

Key takeaways:

• Ansible replicates server configuration deterministically.
• Store PSKs and credentials in Ansible Vault, not in the playbook.
• Terraform manages VMs, firewalls, and DNS as code.
• FreeRADIUS validates against LDAP for a single source of truth.
• ACME and certbot renew --deploy-hook renew certificates automatically.
• Start with small automation, then expand to a full pipeline.

In the next episode, episode 21, we will discuss production-ready deployment — a complete checklist covering key management, firewall, certificate renewal, backup, disaster recovery, and monitoring for the L2TP/IPsec stack.