L2TP over IPsec Remote VPN

Navigation: Scenarios → L2TP over IPsec VPN

Deploy a TOORCE L2TP VPN server with IPsec encryption and a pre-shared key (secret). Remote Windows and macOS users connect with the built-in OS VPN client — no third-party app required.

Network design

L2TP runs inside IPsec. The client first negotiates IPsec (IKE) using the shared secret, then authenticates to the L2TP server with username/password, and receives an IP from the VPN client pool.

Figure 1 — Remote client → IPsec (PSK) → L2TP → TOORCE firewall → LAN

Protocol stack

Reference addressing

Prerequisites

• WAN interface with public IP (or port-forward UDP 500, 4500, 1701)
• Local user or AD user for VPN authentication
• NAT Gateway or outbound internet rule on WAN

Step 1 — Create VPN user accounts

L2TP authenticates users with username + password after IPsec is established.

1. Go to Auth & Users → Local Users/Groups (or use AD users).
2. Click + Add New user:

3. Optionally create a vpn_users group and assign allowed users.

Step 2 — Configure the L2TP server on TOORCE

1. Go to VPN Tunnels → L2TP VPN.
2. Click + Add New (or Edit the L2TP server record).

Server form fields

3. Click + Create Record / Save.
4. Click Install Policy if prompted.

Important: The pre-shared key on the firewall must match exactly what remote clients enter as Shared Secret (macOS) or Pre-shared key (Windows).

Step 3 — Allow IPsec and L2TP on the firewall

Ensure WAN accepts VPN protocols (often auto-created by Install Policy):

Add an inline rule allowing VPN clients to reach LAN:

Step 4 — Connect from Windows (native VPN)

Windows includes L2TP/IPsec with pre-shared key — no extra software needed.

Add VPN connection

1. Open Settings → Network & Internet → VPN → Add a VPN connection.

Figure 2 — Windows built-in VPN configuration

2. Click Save.
3. Click the VPN connection → Connect.

Windows verification

Step 5 — Connect from macOS (native VPN)

macOS supports L2TP over IPsec in System Settings → Network.

Add VPN configuration

1. Open System Settings → Network → ⋯ → Add VPN Configuration → L2TP over IPSec.

Figure 3 — macOS built-in L2TP over IPsec configuration

2. Click Create / Apply.
3. Click Connect.

macOS verification

Step 6 — Verify on the firewall

Connection flow (packet sequence)

Client                          TOORCE Firewall
  │                                    │
  ├── UDP 500 IKE + PSK ──────────────►│  IPsec Phase 1 (authenticate secret)
  │◄── IKE SA established ─────────────┤
  ├── UDP 4500 ESP (NAT-T) ───────────►│  IPsec Phase 2 (encrypt channel)
  │◄── IPsec tunnel ready ─────────────┤
  ├── UDP 1701 L2TP ───────────────────►│  L2TP tunnel setup
  ├── PPP username/password ───────────►│  User authentication
  │◄── IP 10.9.0.x assigned ───────────┤
  ├── Encrypted traffic to LAN ────────►│  Forward to 192.168.100.0/24

Troubleshooting

Security recommendations

• Use a long, random pre-shared key (20+ characters)
• Use unique passwords per VPN user; enable MFA where supported
• Restrict Allowed Users to the vpn_users group only
• Log VPN sessions and review Logs & Events regularly
• Consider SSL/ZTA VPN for advanced zero-trust remote access

Related topics

• L2TP VPN
• IPSec VPN
• Local Users/Groups
• ZTA/SSL Access
• All Scenarios