Settings

This section reviews the different settings and configuration options available for IPsec VPN.

Status

IPsec Tunnels

The IPsec Tunnels tab is where you create and manage the IPsec VPN configuration. The main tab display shows a summary of all IPsec tunnels that have been created.

• Tunnel EditorWhen you create a new tunnel or edit and existing tunnel, the tunnel editor screen will appear with the following configurable settings:

Name	Description
Enabled	This checkbox allows you to set a tunnel to either enabled or disabled.
Description	This field should contain a short name or description.
Connection Type	This field allows you to set the connection type to any of the following: Select Tunnel to specify a host-to-host, host-to-subnet, or subnet-to-subnet tunnel. This is by far the most common connection type. Select Transport to specify a host-to-host transport mode tunnel. This connection type is much less common and would generally only be used if you are attempting to establish an IPsec connection to another host which specifically requires this mode.
IKE Version	The IKE version should use either version 1 or version 2. Both endpoints must use the same IKE version.
Connect Mode	This field controls how IPsec manages the corresponding tunnel when the IPsec process re-starts: Select Always Connected to have the tunnel automatically loaded, routes inserted, and connection initiated. Select On Demand to have the tunnel load in standby mode, waiting to respond to an incoming connection request.
Interface	This field allows you to select the network interface that should be associated with the IPsec tunnel on the NG Firewall server. For most situations, choose Active WAN to bind to the active Internet interface. This allows the VPN tunnel to reconnect using a secondary WAN interface in the event of Internet failover. The Active WAN option is available when using the WAN Failover app. Alternatively, you can select a specific interface, or you can manually configure an IP address using the Custom option and manually inputting the IP address.
Any remote host	Enabling this option allows the VPN Server to accept tunnel connections from any IP Address. This option enables the remote side of the tunnel to connect from a dynamic IP address or via a secondary WAN link. This option switches the Connect Mode to On Demand and removes the Remote Host field, as these options are not used when allowing connections from any remote host.
Remote Host	This field should contain the public IP address or DNS name of the host to which the IPsec VPN will be connected. Warning: Using host names with IPsec tunnels can often cause problems, especially if you have enabled the L2TP/Xauth VPN server. We strongly recommend the use of IP addresses in the Remote Host field.
Local Identifier	This field is used to configure the local identifier used for authentication. When this field is blank the value in the *External IP* field will be used.
Remote Identifier	This field is used to configure the remote identifier used for authentication. When this field is blank, the value in the Remote Host field will be used. Important: If the remote host is located behind any kind of NAT device, you may need to use the value %any in this field for a connection to be successfully established.
Local Network	This field is used to configure the local network that will be reachable from hosts on the other side of the IPsec VPN.
Remote Network	This field is used to configure the remote network that will be reachable from hosts on the local side of the IPsec VPN.
Shared Secret	This field should contain the shared secret or PSK (pre-shared key) used to authenticate the connection and must be the same on both sides of the tunnel for the connection to be successful. Because the PSK is used as the encryption key for the session, using long strings of a random nature will provide the highest level of security.
DPD Interval	The number of seconds between R_U_THERE messages. Enter 0 to disable this feature.
DPD Timeout	The number of seconds for a dead peer tunnel to be restarted.
Ping Address	The IP address of a host on the remote network to ping for verifying that the tunnel is connected and routing. Leave blank to disable.
Ping Interval	The time in minutes between ping attempts of the ping address. Leave as 0 to disable. Recommended value is 1 when using a Ping address.
Authentication and SA/Key Exchange	If you leave the Phase 1 and Phase 2 manual configuration checkboxes disabled, IPsec will attempt to automatically negotiate the encryption protocol with the remote peer when creating the tunnel. Given the number of different IPsec implementations and versions and the overall complexity of the protocol, best results can often be achieved by enabling manual configuration of these two options and selecting Encryption, Hash, DH Key Group, and Lifetime values that exactly match the settings configured on the peer device.

VPN Config

GRE Networks

The GRE Networks tab is where you create and manage connections to remote GRE servers. Generic Routing Encapsulation (GRE) is a tunneling protocol that can encapsulate a wide variety of network layer protocols inside virtual point-to-point links over an Internet Protocol network.

GRE Address Pool

This field configures the pool of IP addresses assigned to interfaces created and associated with tunnels added on the GRE Networks tab. The default 198.51.100.0/24 is a private network generally reserved for internal network testing. It was chosen as the default because it is used less frequently than other RFC-1918 address blocks and, thus, is less likely to conflict with existing address assignments on your network. If you use GRE to connect multiple NG Firewall servers, you need to configure a different, unused pool on each server.

The main tab display shows a summary of all GRE Networks that have been created.

Network Editor

When you create a new GRE Network or edit and existing network, the network editor screen will appear with the following configurable settings:

Name	Description
Enable	This checkbox allows you to set a network to either enabled or disabled.
Description	This field should contain a short name or description.
Interface	This field allows you to select the network interface that should be associated with the GRE Network on the NG Firewall server. When you select a valid interface, the Local IP field (see below) will automatically be configured with the corresponding IP address. If, for some reason, you want to manually configure an IP address that is not currently active, you can set the Interface to Custom and manually input the IP address below.
External IP	Use this field to configure the IP address that is associated with the GRE Network on the NG Firewall server. Normally this field will be read-only and will automatically be populated based on the Interface selected above. If you select Custom as the interface, you can then manually enter the local IP address.
Remote Host	This field should contain the public IP address of the host to which the GRE tunnel will be connected.
Remote Networks	This field is used to configure the list of remote network traffic that should be routed across this GRE tunnel. Networks should be entered one per line in CIDR (192.168.123.0/24) format. Note: The subnets in Remote Networks must not conflict with your GRE Address Pool.

IPsec State

The IPsec State tab allows you to see the status of all established IPsec connections. There will typically be two entries per tunnel, one with details about the local side of the connection and another with details about the remote side.

IPsec Policy

The IPsec Policy tab allows you to see the routing table rules associated with each IPsec VPN that is active.

IPsec Log

The IPsec Log tab allows you to see the low level status messages that are generated by the underlying IPsec protocol components. This information can be very helpful when attempting to diagnose connection problems or other IPsec issues.

L2TP Log

The L2TP Log tab allows you to see the low level status messages that are generated by the underlying L2TP protocol daemon. This information can be very helpful when attempting to diagnose connection problems or other L2TP issues.

Reporting

The Reports tab provides a view of all reports and events for all connections handled by IPsec VPN.

Reports

This applications reports can be accessed via the Reports tab at the top or the Reports tab within the settings. All pre-defined reports will be listed along with any custom reports that have been created.

Reports can be searched and further defined using the time selectors and the Conditions window at the bottom of the page. The data used in the report can be obtained on the Current Data window on the right.

Related Topics

OpenVPN

Settings

This section reviews the different settings and configuration options available for OpenVPN.

Status

The Status tab shows you a list of open connections, the time the tunnels were created, and transmit statistics.

Connected Remote Clients

Remote Server Status

Server

The Server tab includes all the configuration for OpenVPN's server functionality.

Site Name is the name of the this OpenVPN site. A random name is chosen so that it is unique. A new name can be given, but it should be unique across all NG Firewall sites in the organization. For example, if the company name is "MyCompany" then "mycompany" is a bad site name if you have multiple NG Firewalls deployed, as it might be used elsewhere. The Site Name must be unique.

Site URL shows the URL that remote clients will use to connect to this server. This is just for reference. Verify that this address will resolve and be publicly reachable from remote networks. This URL can be configured in Config > Network > Hostname .

If Server Enabled is checked, the OpenVPN server will run and accept connections from configured Remote Clients. If unchecked, the OpenVPN server will not run, and no server services will be provided.

Address Space defines an IP network/space for the VPN to use internally. The Address Space must be unique and separate from all existing networks and other address spaces on other OpenVPNs. A default will be chosen that does not conflict with the existing configuration.

NAT OpenVPN Traffic will NAT all traffic from remote networks to local networks to a local address. This helps solve routing and host-based firewall issues. The default and recommended value are enabled.

Username/Password Authentication can be enabled to activate two factor authentication, requiring clients to also provide a username and password when connecting.

Add MFA client configuration can be enabled to activate multi-factor authentication using a TOTP app. This feature uses the Local Directory users and requires each user to be configured with multi-factor authentication and paired with a TOTP app.

Authentication Method is used to select the authentication method for clients when Username/Password authentication is enabled.

Remote Clients

The Remote Clients sub-tab configures all the Remote Clients that can connect to this OpenVPN server. A Remote Client is any entity that connects to this OpenVPN server as a client. This includes both remote desktops, laptops, devices, road warriors, etc. This also includes remote OpenVPNs and remote NG Firewall networks.

Initially, there are no clients allowed to connect, and a unique entry must be created for each remote client you want to allow to connect to this server.

Groups

These settings will apply to all clients belonging to that group. Many sites will only have one group because all clients need the same settings. However, some clients have some Full Tunnel remote clients and some Split Tunnel remote clients. In this case, you need two groups where each client belongs to the appropriate group.

Exported Networks

Exported Networks is a list of networks reachable through the OpenVPN server for remote clients. Exported Networks are routes pushed to remote clients when they connect, effectively telling remote clients to reach the specified network through the OpenVPN server.

For example, exporting 1.2.3.4/24 will result in all 1.2.3. traffic going through the OpenVPN server.

Client

The Client tab is used to configure which remote servers this OpenVPN will connect to as a client.

Remote Servers

The Remote Servers grid lists the currently configured remote servers that OpenVPN is configured to connect.

To configure a new server to connect to, first login to the remote server and configure a new client as described above and click on the Download Client. After you have downloaded the distribution zip file, return to this OpenVPN and click on the Browse button below the Remote Servers grid. Select the zip file downloaded from the OpenVPN server and then press OK. Next, press the Submit button to upload the zip file to OpenVPN which will add a new entry into the Remote Servers grid based on the configuration in the submitted zip file.

If the remote server requires Username/Password authentication, you will have to edit the configuration, enabled the Username/Password authentication checkbox, and enter the username and password to be used when establishing the connection.

Once connected to a remote server, you can reach their exported networks. They will also be able to reach the networks on this server specified as the Remote Network configuration.

Note: Site to Site connections are not full-tunnel even if selected in the Group for the site to site. Internet traffic on the remote site will exit through its local gateway.

Advanced

The Advanced tab is provided for advanced users who have a detailed knowledge and understanding of OpenVPN and need very specific configuration changes to address unique or unusual situations. It is entirely possible to completely break your OpenVPN configuration with a single wrong character, misplaced space, or by changing a configuration option that probably shouldn't be changed. Changes you make on this page can possibly compromise the security and proper operation of your server and are not officially supported.

Common Settings

At the top of the Advanced page are the Protocol, Port, and Cipher options. These must be the same on both the client and server for connections to work. Since they are the options most frequently modified, they can be easily configured here and will apply to both the client and server.

The Client to Client Allowed checkbox is used to enable or disable traffic passing between OpenVPN clients. When enable, all clients will have full network access to each other when connected. If disabled, traffic will not be allowed to flow between connected clients.

Server Configuration and Client Configuration

If you require changes to other low level parameters, the Server Configuration and Client Configuration grids allow you to effectively have total control of the OpenVPN configuration file that is generated. Both grids work the same way, with each configuration applied to the corresponding server or client openvpn.conf file, respectively.

Both lists contain config items comprised of an Option Name and Option Value pair. By default, all items in both configuration grids are read only. The lists represent the default configuration settings used for the server and client configuration files. The default items cannot be modified or deleted, they can only be excluded. When you exclude an item, it is effectively removed from the resulting configuration file. To change one of the default items, simply add a new item with the same Option Name, and input the Option Value that you want to be used. This will effectively override the default. The same method can also be used to add configuration items that are not included in the default list.

Exclude Default Configuration Item

• This example shows how to disable the comp-lzo option in the server configuration file to turn off compression:
  

Modify Default Configuration Item

This example shows how to change the default keepalive setting in the server configuration file:

Add New Configuration Item

This example shows how to add a socks-proxy setting to the client configuration file:

Reports

The Reports tab provides a view of all reports and events for all connections handled by OpenVPN.

Reports

This application's reports can be accessed via the Reports tab at the top or the Reports tab within the settings. All pre-defined reports will be listed along with any custom reports that have been created.

Reports can be searched and further defined using the time selectors and the Conditions window at the bottom of the page. The data used in the report can be obtained on the Current Data window on the right.

Related Topics

OpenVPN

OpenVPN Reports

Use Cases

Tunnel VPN is used in a wide variety of configurations. Some common scenarios are described below.

Branch Offices

Organizations with one or more small branch offices can use Tunnel VPN to send all internet-bound traffic at the remote small branch through the central site for security and filtering. This alleviates the need to actively manage the security and filtering configuration at the branch offices and allows for easier management at the central site and centralized monitoring and reporting.

Remote Security Services

There are many cloud-based security services or Cloud Access Security Brokers (CASB) that will enforce policy and security network traffic as it transits from the local infrastructure to the internet.

Tunnel VPN can be configured to send traffic, either in total or selectively, to the desired cloud services. For example, Tunnel VPN can send all port 25 (SMTP) through a specific tunnel to a cloud email archiving service. Alternatively, you could send DNS, web, or all traffic through dedicated cloud services.

SD-WAN

SD-WAN (software-denfined networking) type deployments often need to maintain several tunnels to dedicated CASBs or internet "exit" points. Tunnel VPN allows you to maintain connections to several cloud exit points and prioritize the tunnels such that if one tunnel goes down, the next available tunnel will be leveraged.

When combined with WAN Failover and WAN Balancer, this provides an easy way to ensure the network is always online and the best possible tunnel is being used for connectivity, regardless of cloud services going up or down or individual ISPs or internet connections being up or down.

Privacy

Tunnel VPN can connect to other NG Firewall services or most Privacy VPN services (like NordVPN, ExpressVPN, Private Internet Access, and so on).

Many countries have imposed limits or monitoring on "forbidden" content. This can range from content expressing certain political views, information on historical events, region-locked content, unapproved types of entertainment, or copyrighted material. Also, many locations do not have access to ISPs (or governments) that respect net-neutrality.

For these locations, Tunnel VPN can provide safe encrypted passage to a location that supports freer internet and net neutrality. Rules can either statically determine what traffic goes through a tunnel (specific hosts or ports) or can dynamically shift which traffic uses the tunnel using tags. For example, a host can be switched to using a tunnel once Skype or Bittorrent usage is detected.

Settings

This section reviews the different settings and configuration options available for Tunnel VPN.

Status

The Status tab shows the on/off status of Tunnel VPN.

Tunnels

The Tunnels tab configures the encrypted tunnels to remote servers/services.

First, provide a name and choose the remote provider type. After choosing the provider type, the instructions will describe how to configure the rest of the fields.

On save, all enabled tunnels will attempt to connect to the remote services. The log can be viewed on the Log tab.

Rules

Rules control what traffic is routed through the tunnels. The Tunnel VPN rules are run before any WAN Balancer rules are evaluated and before the routing table is consulted. If a Tunnel VPN rule matches and the tunnel is active, the traffic will exit through the tunnel regardless of the WAN Balancer or routing configuration. In other words, Tunnel VPN takes precedence over any other routing configuration.

The Rules describe how rules work and how they are configured. As with all rules, rules are evaluated in order, and the action is taken from the first matching rule.

Example: Static Rules

• If allow of the following conditions are met:
  • Destination Port is 25
• Perform the following action(s):
  • Destination Tunnel: tunnel-1

This will route all port 25 traffic through tunnel-1. If tunnel-1 is offline, traffic will be routed normally.

Example: Preference Order

• Rule 1: Always (no conditions) perform the following action, Destination Tunnel: 'tunnel-1'
• Rule 2: Always (no conditions) perform the following action, Destination Tunnel: 'tunnel-2'
• Rule 3: Always (no conditions) perform the following action, Destination Tunnel: 'tunnel-3'

Then traffic will always route to tunnel-1. If tunnel-1 is not available it will route to tunnel-2. If tunnel-2 is not available it will route to tunnel-3. If tunnel-3 is not available it will route normally.

Example: Dynamic Rules

Unlike most solutions, NG Firewall also allows for automatic dynamic adjustment of what traffic goes through the tunnel by using tags. Hosts can be tagged manually by tagging the appropriate device or username associated with a host or automatically using trigger rules Events.

This will route any hosts tagged bittorrent-use through tunnel-1. The trigger rule will ensure that any host detected using Bittorrent will automatically be tagged so that each session after the detection will go through the tunnel.

Example: Multiple Triggers

If a host does any of that action, it will automatically be switched to the tunnel (until the tag expires, 10 minutes after the specified activity stops).

Log

This shows the raw OpenVPN log file. Beware: there are often many errors logged by OpenVPN that are not an issue.

This is useful for debugging issues if the tunnels are not initializing correctly to the service providers.

Reports

There are currently no specific reports for Tunnel VPN. However, all traffic is logged using the appropriate tunnel set as the destination interface.

All reports (Application Control, Web Filter.) are viewed and filtered per tunnel by adding a Destination Interface condition where the value equals the tunnel ID.

Related Topics

OpenVPN

OpenVPN Reports

Settings

This section reviews the different settings and configuration options available for WireGuard VPN.

Status

The Status tab shows the status of the WireGuard VPN service

• Local Service Information

This section displays information about the local WireGuard service, such as the public key, endpoint address and port, peer address, and the list of local networks.

• Enabled Tunnels

This section shows a list of active WireGuard tunnels.

Remote Client Configuration

These fields are used when generating the Remote Client configuration.

• DNS Server

IP Address of local DNS server that will be added to client configuration. It is initially populated using the first defined DHCP DNS Server Override address is used it found. If not, the IP address of your first non-WAN interface is used.

• Networks

These are networks added to the client's allowed IP list. It is initially populated with all known local networks discovered from non-WAN interfaces (and their aliases) and static routes.

Peer IP Address Pool

• Assignment

Used to select the method for address pool assignment. Can be set for Automatic to allow the system to automatically select an unused network space or Self-assigned to configure a user entered network space.

• Network Space

Shows the automatically assigned networks space or allows editing the self-assigned network space.

• New Network Space

Click when using Automatic assignment to select a new random network space.

Tunnels

The Tunnels tab is where you create and manage WireGuard VPN tunnels. Each tunnel in the table has options to view the client configuration or edit the tunnel.

For a step by step guide to setting up WireGuard VPN tunnels, see Setting up WireGuard VPN site-to-site connections in NG Firewall.

• Remote Client

Clicking this icon will display a window showing the recommended client configuration in both Quick Reference (QR) Code, which many WireGuard mobile apps can scan with the devices camera and import a text file suitable for copying and pasting into the remote client.

• Tunnel Editor

When you add a tunnel or edit and existing tunnel, the tunnel editor screen will appear with the following configurable settings:

Note: You can copy the configuration from a remote NG Firewall peer and paste it into any of the configurable fields. The screen automatically populates all of the relevant fields from the remote side. This simplifies the configuration of tunnels and is recommended to avoid misconfiguration.

Name	Description
Enabled	This checkbox allows you to set a tunnel toenabled or disabled.
Description	This field should contain a short name or description.
Remote Public Key	This field is for the public key of the tunnel peer.
Remote Endpoint Type	This field controls the endpoint type for the peer. Select Roaming if the remote endpoint is a mobile device using the WireGuard app or if the remote network is used for client access only and does not host any resources. Select Static for a traditional site to site tunnel configuration where each network hosts resources that must be accessible over the virtual private network.
Remote Endpoint IP Address	Sets the IP address for a static endpoint.
Remote Endpoint Port	Sets the port for a static endpoint.
Remote Peer IP Address	This field sets the IP address that will be used by the remote peer.
Remote Networks	This field is used to configure the list of remote networks that should be routed across this WireGuard tunnel. Networks should be entered per line in CIDR (192.168.123.0/24) format.
Monitor Ping IP Address	The IP address of a host on the remote network to ping for verifying that the tunnel is connected. Leave blank to disable.
Monitor Ping Interval	The time in seconds between attempts to ping the configured ping monitor address.
Monitor Alert on Tunnel Up/Down	When enabled, CONNECT and DISCONNECT alerts will be generated when the configured ping monitor transitions from reachable to unreachable and unreachable to reachable.
Monitor Alert on Ping Unreachable	When enabled, UNREACHABLE alerts will be generated for each monitor ping that fails when the target is unreachable.
Local Service Information	This section includes information from the Status tab that is useful when doing copy/paste configuration between peers.

WireGuard VPN client

The WireGuard VPN client app is available for download on a variety of mobile devices and desktop operating systems, including iOS, macOS, Android, Windows, and Linux.The download links for each supported OS are available from the WireGuard Website.

For a step by step setup guide, refer to the KB article Setting up WireGuard VPN on mobile devices and desktops.

Reporting

The Reports tab provides a view of all reports and events for all connections handled by WireGuard VPN.

Reports

This application's reports can be accessed via the Reports tab at the top or the Reports tab within the settings. All pre-defined reports will be listed along with any custom reports that have been created.

Reports can be searched and further defined using the time selectors and the Conditions window at the bottom of the page. The data used in the report can be obtained on the Current Data window on the right.

Related Topics

IPsec VPN

OpenVPN