Configuring a VPN for Dynamic IP Address Connections Summary A Virtual Private Network (VPN) is a virtual private network that interconnects remote (and often geographically separate) networks through primarily public communication infrastructures such as the Internet. This article explains how to set up a basic IPSEC VPN-terminated tunnel between capable CradlePoint Series 3 routers when the connections on both or either router are configured with publicly routable dynamic IP addresses using a dynamic DNS service. For assistance configuring Series 3 CradlePoint routers where both sides connect using static IP addresses, please refer to this article instead: VPN setup example for static IP address connections This article assumes that the IP address being received from your ISP is a public facing routable address. For assistance configuring Series 3 CradlePoint routers to connect to a VPN where one side does not have a publicly routable IP address, please refer to this article instead: [Link to "VPN NAT-T setup"] Before getting started, first make sure that both CradlePoint routers are online and that your dynamic DNS host is properly resolving to your IP address. For assistance setting up dynamic DNS, please refer to this article: http://knowledgebase.cradlepoint.com/articles/support/setup-dynamic-dns-on-a-series-3-cradlepoint Additionally, you will need to make sure that the local networks of the routers do not match. For example, if Router #1 is already set up using the default network of 192.168.0.1, you would want to change Router #2's local network to use a different private network (such as 192.168.100.1 or 172.16.0.1). For assistance changing the local IP address of a Series 3 CradlePoint router, please refer to this article: How to change the router's local IP address For maximum compatibility, we also recommend making sure that the CradlePoint routers firmwares are upgraded to the most recent version. The most recent CradlePoint firmware files can always be downloaded from http://www.cradlepoint.com/firmware. Configuration Configuration Difficulty: Beginner or Intermediate or Expert Router #1 Router #2 LAN IP 192.168.42.1 192.168.0.1 LAN Netmask 255.255.255.0 255.255.255.0 Dynamic DNS Name cpexample1.no-op.org cpexample2.zapto.org Computer 192.168.42.199 192.168.0.177 Router #1 Configuration: - Step 1: Log into the router's Setup Page. For help with logging in please click here. 1
- Step 2: Click on Internet and select VPN Tunnels from the drop-down menu. - Step 3: Under VPN Tunnels click Add. - Step 4: Enter a Tunnel Name. - Step 5: Enter a Pre-Shared Key. - Step 6: Set the Initiation Mode to your desired setting. o Note: On Demand will leave the tunnel idle until traffic bound for the other side of the tunnel is detected. Always On will keep the tunnel active whenever the WAN connection is active. - Step 7: Click Next. - Step 8: In the Local Networks section click Add and enter the LAN of Router #1 you want to be available across the VPN tunnel. - Step 9: Click Next. 2
- Step 10: Enter the Dynamic DNS Name of Router #2 in the Remote Gateway. - Step 11: In the Remote Networks section click add and enter the LAN of Router #2 you want to be available across the VPN tunnel. - Step 12: Click Next. - Step 13: Set the Exchange Mode to Aggressive. - Step 14: For IKE Phase 1 leave the default settings. - Step 15: Click Next. 3
- Step 16: For IKE Phase 2 leave the default settings. - Step 17: Click Next. - Step 18: For Dead Peer Detection leave the default settings. - Step 19: Click Finish. 4
- Step 20: Verify all settings on the Tunnel Summary Screen. - Step 21: Click Yes to submit your VPN tunnel. 5
- Step 22: Under VPN Tunnels click Enable VPN Service to start the VPN service on the router. Router #2 Configuration: - Step 1: Log into the router's Setup Page. For help with logging in please click here. - Step 2: Click on Internet and select VPN Tunnels from the drop-down menu. - Step 3: Under VPN Tunnels click Add. - Step 4: Enter a Tunnel Name. - Step 5: Enter a Pre-Shared Key. - Step 6: Set the Initiation Mode to your desired setting. o Note: On Demand will leave the tunnel idle until traffic bound for the other side of the tunnel is detected. Always On will keep the tunnel active whenever the WAN connection is active. - Step 7: Click Next. 6
- Step 8: In the Local Networks section click Add and enter the LAN of Router #2 you want to be available across the VPN tunnel. - Step 9: Click Next. - Step 10: Enter the Dynamic DNS Name of Router #1 in the Remote Gateway. - Step 11: In the Remote Networks section click add and enter the LAN of Router #1 you want to be available across the VPN tunnel. - Step 12: Click Next. 7
- Step 13: Set the Exchange Mode to Aggressive. - Step 14: For IKE Phase 1 leave the default settings. - Step 15: Click Next. - Step 16: For IKE Phase 2 leave the default settings. - Step 17: Click Next. 8
- Step 18: For Dead Peer Detection leave the default settings. - Step 19: Click Finish. - Step 20: Verify all settings on the Tunnel Summary Screen. - Step 21: Click Yes to submit your VPN tunnel. 9
- Step 22: Under VPN Tunnels click Enable VPN Service to start the VPN service on the router. 10