Remote access VPN
Lets phones and PCs away from home connect to your LAN or the internet over a VPN. Four methods are available: WireGuard, OpenVPN, IKEv2 and L2TP/IPsec.
Overview
- On the page of the method you want (e.g. REMOTE ACCESS VPN › WireGuard), enable it and apply.
- On REMOTE ACCESS VPN › VPN groups, create groups and apply (skip this if you do not use groups).
- On REMOTE ACCESS VPN › VPN users, add users and register their devices (peers and clients) or VPN passwords.
- Import the configuration file, QR code or configuration profile on each device.
What needs applying and what takes effect immediately
| Action | Takes effect |
|---|---|
| Server settings of each method (enabled/disabled, port, tunnel network, endpoint) | When you apply and confirm |
| Adding, changing or deleting VPN groups | When you apply and confirm |
| Adding, changing, disabling or deleting VPN users | Immediately when you press Save etc. |
| Adding or deleting peers and clients, VPN passwords, the L2TP pre-shared key | Immediately |
Saving server settings or groups adds them to the pending changes. Use Review changes at the top of the page to apply, then Confirm within 5 minutes (Applying changes).
Adding or removing users and devices does not disconnect anyone else. Only the user you changed, disabled or deleted is disconnected (they reconnect with the new settings, or are refused).
A newly created group can be selected for users after it has been applied.
VPN listeners and the firewall
When a method is enabled, the router accepts its listening port automatically. No firewall changes are needed.
| Method | Listens on | Default |
|---|---|---|
| WireGuard | UDP (listen port) | 51820 |
| OpenVPN | UDP or TCP (port) | UDP 1194 |
| IKEv2, L2TP/IPsec | UDP 500 and 4500 | Fixed |
- Where a connected device can go is set by Allowed destinations of the user or group. Of the router itself, VPN clients can reach only DNS and ping.
- If the WAN uses MAP-E, the WireGuard and OpenVPN ports must be inside the assigned port range. Otherwise the configuration cannot be applied.
If the WAN uses MAP-E or DS-Lite, IKEv2 and L2TP/IPsec cannot be reached from outside over IPv4 (UDP 500 and 4500 cannot be received). They work over IPv6. To connect over IPv4 from outside, use WireGuard or OpenVPN.
VPN groups
A group sets Allowed VPN methods, Allowed destinations and Expiry for all its members. Example: "Family" can reach the internet and the LAN, "Guests" only the internet.
- On REMOTE ACCESS VPN › VPN groups, press Add group.
- Fill in the fields, press Save, and apply.
| Field | Description |
|---|---|
| Group name | Starts with a lowercase letter, up to 15 characters. Cannot be changed later. e.g. family |
| Display name (optional) | Name shown in lists. e.g. Family |
| Allowed VPN methods | Methods that can be used to connect (WireGuard, OpenVPN, IKEv2, L2TP/IPsec) |
| Allowed destinations | Zones reachable after connecting. Allowing Internet sends all of the device's traffic through the VPN |
| Expiry | Members are refused after this date. Leave blank for no expiry |
A group with members cannot be deleted.
VPN users
VPN users are for VPN access only and cannot sign in to the web UI. They are separate from admin users.
- On REMOTE ACCESS VPN › VPN users, enter the username, display name (optional), group and expiry (optional) in the row below the list, and press Add user.
- Click a user in the list to open its details. Register devices and the VPN password there.
| Field | Description |
|---|---|
| Username | Lowercase letters, digits, _, . and -, up to 32 characters |
| Group | Allowed VPN methods and destinations come from the group. With No group (set individually), set them per user |
| Expiry | Connections are refused after this date (it can be used until the end of that day). Leave blank for no expiry |
| Allowed VPN methods / Allowed destinations | Clear Use group settings to give this user different values. The list then shows Overridden |
| Devices | Number of WireGuard peers and OpenVPN clients |
- Disable stops connections but keeps the user. A connected user is disconnected. Enable restores access.
- Delete removes the user and all of its peers and clients.
- When Status is Disabled, the reason is shown in parentheses (expired, no methods or destinations set, etc.).
VPN password
The password for IKEv2 and L2TP/IPsec. WireGuard and OpenVPN use keys and certificates instead. It is separate from the admin password.
- In the user's VPN password section, enter 8–64 characters and press Save, or press Generate.
- Show displays the current password. Delete removes it, and the user can no longer connect with IKEv2 or L2TP.
- Spaces,
"and\are not allowed.
WireGuard
Server settings
- On REMOTE ACCESS VPN › WireGuard, tick Enable.
- Change fields if needed, press Save, and apply.
| Field | Description |
|---|---|
| Listen port | UDP port that accepts connections from peers. Default 51820 |
| Tunnel network | Address range for peers. The router uses the first address (.1). Default 10.10.0.0/24 |
| Endpoint | Host name or IP address peers connect to; shared with OpenVPN and IKEv2. If blank, the WAN IPv4 address is used. e.g. vpn.example.com |
| MTU | Largest packet size inside the tunnel. Defaults to 1380 if blank |
Peer status on the right shows the Latest handshake and traffic of each peer.
Adding a device
- In the user's WireGuard peers section, enter a peer name (e.g. iphone) and press Add peer.
- The configuration file and QR code are shown.
- Phone: scan the QR code with the WireGuard app.
- PC: press Download configuration to save the .conf file and import it into the WireGuard app.
- To see it again later, press Config / QR code on the peer's row.
The configuration file contains the device's private key. Do not share it. Create one peer per device.
The routes in the file (AllowedIPs) are built from the allowed destinations. If you change the allowed destinations, import the configuration file on the device again.
OpenVPN
Server settings
- On REMOTE ACCESS VPN › OpenVPN, tick Enable.
- Change fields if needed, press Save, and apply.
| Field | Description |
|---|---|
| Protocol | UDP normally. Use TCP when connecting from networks that block UDP (slower) |
| Port | Port that accepts connections from clients. Default 1194 |
| Tunnel network | Address range for clients. Default 10.11.0.0/24 |
| Endpoint | Shared with WireGuard |
Connected clients on the right shows where each client connects from, since when, and its traffic.
Adding a device
- In the user's OpenVPN clients section, enter a client name (e.g. laptop) and press Add client.
- Press Download configuration to save the .ovpn file and import it into an app such as OpenVPN Connect. The certificate and key are included in the file.
Authentication uses the certificate only (no username or password prompt). Do not share the file.
IKEv2
Clients connect with the built-in VPN of iPhone, Mac and Windows, using the VPN user name and VPN password.
Server settings
- On REMOTE ACCESS VPN › IKEv2, tick Enable, press Save, and apply.
- Applying creates the Server certificate.
| Field | Description |
|---|---|
| Tunnel network | Address range for connected clients. Default 10.12.0.0/24 |
| Endpoint | Shared with WireGuard and OpenVPN. It is written in the server certificate, so configure clients with this name |
| Server certificate | Issued by the router's own CA. Reissued when the names or addresses change |
| CA certificate | Download it with Download CA certificate. Used on Windows and Android |
Client setup
Set a VPN password for the user first.
- iPhone, iPad, Mac: in the VPN user's details, press Download profile and open the file on the device to install it. It installs the CA certificate and the VPN settings. Tick Include the password if you do not want to be asked for it when connecting.
- Windows: install the CA certificate into "Trusted Root Certification Authorities" of the local computer, then run the PowerShell commands shown under Client setup on the IKEv2 page. Example:
Add-VpnConnection -Name "FELIXXRT" -ServerAddress "vpn.example.com" -TunnelType Ikev2 -AuthenticationMethod Eap -EncryptionLevel Required
Set-VpnConnectionIPsecConfiguration -ConnectionName "FELIXXRT" -AuthenticationTransformConstants GCMAES256 -CipherTransformConstants GCMAES256 -EncryptionMethod GCMAES256 -IntegrityCheckMethod SHA256 -DHGroup ECP256 -PfsGroup ECP256 -Force
- Android: in the strongSwan app, choose "IKEv2 EAP (Username/Password)" and import the CA certificate.
Connected devices appear under Connected clients on the right.
L2TP/IPsec
VPN for older devices; use IKEv2 on newer ones. Authentication uses a pre-shared key (shared by everyone) plus the VPN user name and VPN password.
- On REMOTE ACCESS VPN › L2TP/IPsec, tick Enable, press Save, and apply.
- Enter a key of 8 or more characters in Pre-shared key and press Save, or press Generate.
- On the device, choose "L2TP/IPsec with pre-shared key", then enter the router address, the pre-shared key, and the user name and VPN password.
| Field | Description |
|---|---|
| Tunnel network | Address range for connected clients. Default 10.13.0.0/24 |
| Pre-shared key | Shared by all users. Spaces, " and \ are not allowed. Changing it requires updating every client |
Android 12 and later cannot create new L2TP/IPsec connections.