Learn L2TP IPsec - Installation & Initial Setup

#Introduction

You already mastered the architecture theory in episode 2. Episode 3 takes you to your first hands-on practice: installing all components on the server and assembling an initial configuration that actually works. After this episode, your server will have active IPsec and L2TP daemons, ready to accept connections in the episodes that follow.

We will install on Debian/Ubuntu as the primary path, recognize the four core configuration files, fill in a safe initial version, then verify all services. The details of each option will be dissected one by one in episodes 9, 10, and 11 — here the focus is making sure everything is installed and running.

#Installation on Debian and Ubuntu

#Install the Core Packages

Use the package manager with root privileges. The libreswan package provides the IPsec daemon, xl2tpd provides the L2TP daemon, and ppp provides the PPP daemon:

sudo apt update
sudo apt install libreswan xl2tpd ppp

Verify that all binaries are available and their versions are recognized:

ipsec --version
xl2tpd --version
pppd --version

#Disable Conflicting Services

If another IPsec daemon (for example strongSwan) or an old xl2tpd is present, stop and disable it so it does not grab UDP ports 500, 4500, and 1701:

sudo systemctl disable --now strongswan-starter 2>/dev/null || true
sudo systemctl disable --now xl2tpd

#The Four Core Configuration Files

All files live under /etc. These four files are the heart of L2TP/IPsec configuration and will be used throughout the series:

• /etc/ipsec.conf — IPsec connection definitions.
• /etc/ipsec.secrets — secrets for authentication, including the PSK.
• /etc/xl2tpd/xl2tpd.conf — L2TP daemon configuration as an LNS.
• /etc/ppp/options.xl2tpd — PPP session options.

Look at the initial contents of the two IPsec files:

cat /etc/ipsec.conf
cat /etc/ipsec.secrets

The default files usually contain a config setup block in ipsec.conf and one example line in ipsec.secrets. We will overwrite both with the production version below.

#A Safe Initial Configuration

#ipsec.conf for Remote Access

Create /etc/ipsec.conf with a single connection named L2TP-PSK. This block uses ESP in transport mode to protect UDP 1701, with IKEv1 enabled explicitly because Libreswan 5.x disables it by default:

config setup
    logfile=/var/log/pluto.log
    virtual_private=%v4:10.0.0.0/8
 
conn L2TP-PSK
    type=transport
    left=%any
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any
    authby=secret
    ikev2=never
    phase2alg=aes128-sha1
    pfs=no
    auto=add

The ikev2=never line forces IKEv1 — a requirement for classic remote-access clients with PSK to connect. The meaning of each line will be discussed in episode 9.

#ipsec.secrets for the PSK

Create /etc/ipsec.secrets with strict permissions. The line %any %any : PSK "..." means all peers use the same shared key:

%any %any : PSK "replace-with-a-long-random-string"

After writing it, lock the file down so only root can read it:

sudo chmod 600 /etc/ipsec.secrets
sudo ipsec verify

The ipsec verify command runs a thorough system check — from kernel NETKEY connectivity to the presence of the xfrm module.

#xl2tpd and PPP Preview

The other two files will be installed in full in episode 11. For the initial setup, just make sure the xl2tpd daemon runs without special configuration:

sudo systemctl enable --now xl2tpd
sudo systemctl status xl2tpd --no-pager

The status must show active (running). If it fails, check the log with journalctl -u xl2tpd.

#Verifying the Services

Run a thorough verification once all daemons are active:

sudo systemctl status ipsec --no-pager
sudo systemctl status xl2tpd --no-pager
ipsec status
sudo ss -ulnp | grep -E '500|1701|4500'

The output of ipsec status shows Total IPsec connections: 1 for the L2TP-PSK connection, which is added but not yet up — normal while no client is connected. The ss command must show that UDP 500, 4500, and 1701 are listening.

#Closing

Episode 3 completed the initial setup: Libreswan, xl2tpd, and ppp are installed; the four core configuration files are recognized; ipsec.conf and ipsec.secrets are filled with an initial version; and all services are verified running.

Key takeaways:

• The four core files: ipsec.conf, ipsec.secrets, xl2tpd.conf, and options.xl2tpd.
• Libreswan 5.x requires ikev2=never for IKEv1 to be active.
• ipsec.secrets must have 600 permissions and contain a long random PSK.
• ipsec verify automatically checks the readiness of the IPsec stack.
• The ipsec and xl2tpd services must be active, and UDP 500, 4500, 1701 open.
• The complete xl2tpd and PPP configuration follows in episode 11.

In the next episode, episode 4, we will discuss IKEv1 and IKEv2 — the difference between Main Mode and Aggressive Mode, the Phase 1 and Phase 2 flow of IKEv1, the advantage of IKEv2's single exchange, and when to use which. This determines the ike= choice in your configuration.