Server address for L2TP/IPSec setup

[trogladyte]

Apologies if this is a noobie question, but I searched and can't find the answer.

My setup is a DS224+ with an RT2600ac router (if it matters). I am running DSM 7.2.2-72806. I have the VPN Server package installed on the NAS utilizing L2TP/IPSec.

A few years back, I had someone set up an L2TP/IPSec remote connection on my laptop to the NAS. It worked flawlessly and was a massive help while I was remote with my flying job. However, last month, the (cheap and nasty) SSD hard drive failed and managed to short out my mobo. Fortunately, I got a new one despite the laptop's age, and it's up and running again.

I was a dumbass, and forgot to write down the details for the setup, so I just changed the Preshared Key, but I cannot figure out what the Server name or address should be. I know it's not the internal 192.168.xxx.xxx one. In the package, there's a dynamic IP in the settings, but it isn't that either. And it isn't my front-facing IP address.

Does anyone know what address or IP I need? Thanks.

This post includes affiliate links. As an Amazon Associate, SynoForum.com may earn a commission if you make a purchase — at no extra cost to you.
It helps support our community! Learn more...

 

[Rusty]

It should be a public IP address or any FQDN (domain name) or DDNS name that you can use to resolve your public IP.

On top of that, you need to make sure that the port forward on the router is still pushing the IPSec traffic internally to your NAS (where the VPN server is), as that is also needed to make the connection work.

 

[fredbert]

With L2TP/IPsec VPN it uses a pre-set group of network ports. That means, for home users with only one Internet IP address, you have to decide which device is going to be the receiving VPN service: VPN Service on the NAS; or, VPN Plus Server on the router.

The ports are:

• L2TP: UDP 1701
• IPsec: UDP 500, 4500

When using VPN Plus Server on the router you just need to ensure the router's firewall is open to accepting inbound requests on these ports. The firewall rule's destination must be 'SRM', to indicate the router.

When using VPN Server on the NAS you need to create port forwarding rules on the router aiming these ports to the NAS's LAN IP. The port forward default setting is to also create the necessary firewall rules. If you have disabled the default setting you will have to create firewall rules too (like above but with the NAS's LAN IP as the destination). You will also need to check the NAS's firewall to ensure that it is allowing inbound requests to VPN Server.

You should have reserved the NAS's LAN IP in the router's DHCP table, so that firewall and port forward rules continue to work directing to the address you configured. This reservation is done in Network Center's Local Network pages, see DHCP Reservation.

To access the L2TP/IPsec VPN from a client device you need to use a pre-shared key (same in both the server and client) plus a user account (username and password) that is allowed to access the service. This differs between DSM and SRM: in DSM use Control Panel / Users; in SRM use VPN Plus Server.

The server name in the client will be anything that resolves to the router's Internet/WAN IP address. If you have a Synology DDNS (or any DDNS) that's keeping track of your dynamically changing ISP assigned address then you can use the FQDN provided by the DDNS service.

If this isn't working then... have you changed ISP since last using the VPN? Does your Internet IP start with 10. or 172.16.-32. or 192.168. (basically is it in a range reserved in RFC 1918 and therefore not routable over the Internet).

 

[trogladyte]

Thanks for the replies. The settings on the NAS have not changed. I just need to set up the laptop connection. As I had not written down the Preshared key previously, I changed that in the NAS setup and added it to the connection dialog box on the laptop.

So, all I need is the server address/IP. I went to ip.liquidweb.com which gives me my forward-facing IP, but that did not work. I'll have to try and get in contact with the original guy, or get someone else to figure it out. This is not my forte.

 

[fredbert]

Do you use the NAS to maintain DDNS access? Check in Control Panel / External Access / DDNS. With DDNS setup you would then use the domain name you selected as the VPN server name.

If you do, or want to add DDNS, you can see the external IP address that the DDNS is mapping to. Hopefully that IP address is the same as your router's WAN IP. If it is not then there is a problem accessing the router from the Internet... the usual reason is the ISP has deployed CG-NAT and isn't providing a unique IP per customer but is often giving a 10. address. Then this is a bigger problem to solve.

Another way to find your outbound IP address is to use a web service that will report it for you. Like DynDNS ...

Current IP Check

Addn: In VPN Server, the dynamic IP address that is defined here is the subnet (though it doesn't say it's used as a subnet) to use to assign private IP addresses to VPN clients. So choose a different private range from your LAN subnet. You don't define the server name in VPN Server, it is assumed to be the IP address or FQDN that you already know when externally accessing the NAS.

 

[trogladyte]

DDNS in DSM is disabled. DDNS is handled by the router. Under ZNetwork Center | Internet | Quickconnect & DDNS I have a Hostname set which has my external IP, and shows "Normal" status. The external IP there is what is reported if I check with DynDNS.

I tried using a different Dynamic IP address, but that didn't help. I'm wondering if I just have the wrong credentials. I just assumed they will be the same as my HAS control panel login. Is that correct?

 

[fredbert]

It should be the same NAS user account details you use. I was mistaken about where VPN Server access privilege is managed; it's in VPN Server usig the Privilege tab. See if your user account still has the access rights.

Also, make sure you have typed the same pre-shared key into VPN Server and your VPN client... typos can happen.

 

[trogladyte]

Used my NAS credentials, and the router ones (as it controls DDNS). Ensured I had UN and PW correct. The hostname in the laptop VPN settings is what is shown in the router cPanel | Network Settings | Internet | Quickconnect & DDNS. Privileges are correct.

I also changed the preshared key; made it shorter and removed special characters. Nada. I'm just done with this. It's my own fault for not writing it all down or screenshotting it all. I'm just going to pay someone to fix it.

Really appreciate all the help.

 

[fredbert]

If you are using the RT2600ac router, just ensure you haven't enable L2TP/IPsec in VPN Plus Server (if you have installed it). Also that the port forwarding is still set up to send to the NAS.

 

[trogladyte]

I have not, and the forwarding I can still see in place. It didn't get altered.

As I mentioned in my opening post, this sort of thing is definitely not my forte - now, ask me to design a great website, yep I can do that!! LOL.

 

[KJE99]

If you are using Windows and using built-in VPN client on laptop, you might have to add a couple of registry settings - shouldn't be needed these days as it was originally for a problem with Vista, but we needed it on early Win10 clients and just left it:
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent /v AssumeUDPEncapsulationContextOnSendRule /t REG_DWORD /d 0x2 /f
and
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\RasMan\Parameters /v ProhibitIpSec /t REG_DWORD /d 0x0 /f

Ports to forward as posted earlier:
For L2TP:
IP Protocol Type=UDP, UDP Port Number=500 <- Used by IKEv1 (IPSec control path)
IP Protocol Type=UDP, UDP Port Number=4500 <- Used by IKEv1 (IPSec control path)
IP Protocol Type=UDP, UDP Port Number=1701 <- Used by L2TP control/data path
IP Protocol Type=ESP (value 50) <- Used by IPSec data path