With LAN to LAN VPN function, different private networks can be connected together via the internet. Take the following topology as an example, we will learn how to configure the LAN to LAN IPsec VPN.
Step1 Verify the settings needed for IPsec VPN on router
Check the VPN Router A.
Choose the menu Status > System Status and Network > LAN.
Check the VPN Router B.
Choose the menu Status > System Status and Network > LAN.
Step 2 Configure IPsec VPN setting on Router B
(1) Choose the menu VPN > IPSec > IPSec Policy and click Add to load the following page on the VPN router. Configure the basic parameters for the IPsec policy.
· Specify the mode as LAN-to-LAN.
· Specify the Remote Gateway as 10.10.10.20.
· Specify the WAN as WAN1.
· Specify local subnet as 192.168.0.0/24 and remote subnet as 192.168.10.0/24.
· Specify the Pre-shared Key as you like. Here we enter 123456.
(2) Click Advanced Settings to load the following page. In the Phase-1 Settings section, configure the IKE phase-1 parameters.
· Select md5-des-dh1 as the proposal.
· Specify Exchange Mode as Main Mode.
· Specify Negotiation Mode as Responder Mode.
· Specify Local/Remote ID Type as NAME.
Once the router is behind a NAT device, we have to select Aggressive Mode as Exchange Mode and select NAME as Local/Remote ID Type, otherwise, the VPN tunnel can’t be established.
· Specify the local/remote ID as you like. Here we specify the local ID as 123 and remote ID as 321.
(3) In the Phase-2 Settings section, configure the IKE phase-2 parameters. Click OK.
· Specify Encapsulation Mode as Tunnel Mode.
· Select esp-md5-des as the proposal.
Once the router is behind a NAT device, the proposal cannot be specified as ah-md5 or as –sha1, otherwise, the VPN tunnel can’t be established.
Step 3 Configure IPsec VPN setting on Router A
The configuration of Router A is similar to Router B.
(1) Choose the menu VPN > IPSec > IPSec Policy and click Add to load the following page on the VPN router. Configure the basic parameters for the IPsec policy.
(2) Click Advanced Settings to load the following page. In the Phase-1 Settings section, configure the IKE phase-1 parameters.
(3) In the Phase-2 Settings section, configure the IKE phase-2 parameters. Click OK.
Step 4 Verify the connectivity of the IPsec VPN Tunnel.
Regardless of Router A and Router B, choose the menu VPN > IPsec > IPsec SA to load the following page. If the IPsec VPN tunnel is established successfully, it will be shown in the list.
Is this faq useful?
Your feedback helps improve this site.
What’s your concern with this article?
- Dissatisfied with product
- Too Complicated
- Confusing Title
- Does not apply to me
- Too Vague
- Other
We'd love to get your feedback, please let us know how we can improve this content.
Thank you
We appreciate your feedback.
Click here to contact TP-Link technical support.
FAQs
Go to VPN -> IKE -> IKE Policy. Create a Policy Name (here take Test 2 for example). Select Main as Exchange Mode, IP Address as Local ID Type and Remote ID Type, Test 2 as IKE Proposal 1; enter secret as Pre-shared Key, and 28800 as SA Lifetime, the same as Router A's.
How to configure IPSec VPN in TP-Link router? ›
Go to VPN -> IKE -> IKE Policy. Create a Policy Name (here take Test 2 for example). Select Main as Exchange Mode, IP Address as Local ID Type and Remote ID Type, Test 2 as IKE Proposal 1; enter secret as Pre-shared Key, and 28800 as SA Lifetime, the same as Router A's.
How to configure IPSec VPN on router? ›
- Enter ASUS Router App and click [Settings] > [VPN] > [VPN Server] > enable [IPSec VPN] (default is off)
- Enter customized [Pre-Shared Key], and this key is used to provide connection for IPSec VPN client. ...
- Enter customized [Username], [Password], and then click [OK].
If the IP address conflicts with another device on your local network or your network requires a specific IP subnet, you can change it.
- Visit http://tplinkwifi.net, and log in with your TP-Link ID or the password you set for the router.
- Go to Advanced > Network > LAN.
- Type in a new IP Address appropriate to your needs.
A site-to-site VPN, also called a LAN-to-LAN VPN or a gateway-to-gateway VPN, is used to set up an IPSec tunnel between two gateways, implementing secure access of LANs.
How do I connect to IPsec VPN? ›
How to Set Up an IPsec VPN Client
- Right-click on the wireless/network icon in your system tray.
- Select Open Network and Sharing Center. ...
- Click Set up a new connection or network.
- Select Connect to a workplace and click Next.
- Click Use my Internet connection (VPN).
- Enter Your VPN Server IP in the Internet address field.
Currently, a series of TP-Link Archer WiFi routers support VPN Client, such as Archer AX20, Archer AX1800, Archer AX21, Archer AX73, and Archer AX90. Visit TP-Link VPN Routers list to find the best VPN routers for you.
How do I manually configure a VPN on my router? ›
How to set up a VPN on your router
- Log into your router. You can access your router configuration panel by entering your router's IP address in your browser's URL bar. ...
- Look for the “VPN client” tab in the advanced settings of your router. ...
- Follow your VPN client's guidelines to set up the VPN on your router.
To make a LAN to LAN connection you need the following:
- Set the main router as 192.168. ...
- Enable DHCP letting it give an IP address to all the devices connected to it: 192.168. ...
- Place a second router that comes with an RJ45 cable from the main router's LAN port to the second router LAN port.
IPSec VPN. IPSec VPN is a layer 3 protocol that communicates over IP protocol 50, Encapsulating Security Payload (ESP). It might also require UDP port 500 for Internet Key Exchange (IKE) to manage encryption keys, and UDP port 4500 for IPSec NAT-Traversal (NAT-T).
With the Router powered on, press and hold the WPS/RESET button (more than 10 seconds) until the SYS LED becomes quick-flash from slow-flash. Then release the button and wait the Router to reboot to its factory default settings.
How to connect to TP-Link router via LAN? ›
Advanced Preparations：
- Turn off your modem, router and computer.
- Connect your modem to the WAN port of the TP-Link router via an Ethernet cable; connect a computer to TP-Link router's LAN port via an Ethernet cable.
- Power on your router and computer first and then modem.
Choose Configuration > Remote Access VPN > Network (Client) Access > Group Policy and select the Group Policy in which you wish to enable local LAN access. Then click Edit . Go to Advanced > Split Tunneling . Uncheck the Inherit box for Policy and choose Exclude Network List Below .
Can I use VPN with LAN? ›
Yes. You can use a VPN while connected via Ethernet/cable. The method of connection does not affect the ability to use a VPN. Whether you are connected via Wi-Fi, Ethernet, or any other type of network, you can still use a VPN to encrypt your traffic and protect your online privacy and security.
What are the recommended settings for IPsec VPN? ›
Therefore, we recommend that you enable only the algorithm that you use in both sides of the tunnel – less is better. For IPsec sites with bandwidth greater than 100Mbps, use only the AES 128 GCM-16 or AES 256 GCM-16 algorithms. AES CBC algorithms are only used on sites with bandwidth less than 100Mbps.
What is IPsec VPN in router? ›
IPsec is a group of protocols for securing connections between devices. IPsec helps keep data sent over public networks secure. It is often used to set up VPNs, and it works by encrypting IP packets, along with authenticating the source where the packets come from.
How to configure L2TP VPN in TP-Link? ›
How to configure a L2TP Server on TP-Link Router
- Configuring a L2TP Server on TP-LINK router.
- Access the router's management web page; verify the settings needed on the router.
- Click on VPN->L2TP/PPTP->IP Address Pool, enter Pool Name and IP Address Range, and then click on Add.
How to Setup OpenVPN on TP-Link Routers (Windows)
- Setting Up OpenVPN on a TP-Link Router. ...
- Step 1: Log into your router at tplinkwifi.net. ...
- Step 2: Click Advanced on the top navigation bar.
- Step 3: Click VPN Server, then OpenVPN.
- Step 4: Click Certificate to generate a certificate.
