@Pete-S said in ZeroTier vs VPN: @Kelly said in ZeroTier vs VPN: In the strictest sense ZT is a VPN. It is just a one to one IaaS that is routed through the cloud on ZT's systems instead of your edge. You can achieve the same effective security through rules on most VPN servers. ZT just makes it simpler, and reduces your ongoing effort assuming that 1 to 1 or 1 to few is your primary access model. I haven't used it but why does ZT makes it easier? You have to install it on every machine you want access to, right? And I assume you have to setup some kind of routing on a computer if you want access to something on the network where you can't install ZT, like an appliance or something like an ilo interface. With an OpenVPN (SSL VPN) connection through the firewall you have a routable VPN and no NAT problems. You can put whatever access to whatever resources you want without installing anything anywhere. And you have everything in one place. I though ZT was a peer to peer network. So it would make most sense when there are no LAN or central resources and everything is spread out. But that not the network layout in this case. You do have to install it on every machine. It is easier in the sense that to achieve the same level of lockdown paired with user specific access you would need to do a fair bit of work on your edge and keep it maintained. Deploying software to clients should be pretty straightforward if you're using quality tools: https://chocolatey.org/packages/zerotier-one.

@Pete-S said in Packet loss when connected to L2TP/IPsec VPn: @Romo said in Packet loss when connected to L2TP/IPsec VPn: This same issue is happening today once again, VPN is connecting properly but I can't properly reach anything properly on the local lan or the internet. You should just buy a new edge router to exclude any hardware issues. Valid option. The cost is minimal compared to the time you are spending.

@Romo said in Smb transfer through IPSec/L2TP VPN get's terminated.: @wrx7m Probably a lot less since during that time nothing else would be running. While currently the whole office was working regularly. Can you manually run the morning job to see what happens?

@romo said in EdgeRouter L2TP VPN can't pass IKE phase 1: A DNAT rule was the culprit of everything, it was redirecting the traffic and not letting it reach WAN_LOCAL. FINALLY SOLVED!!!!!!!!!!!!!!!!!!!!!!!!! As reminder for anyone that could encounter a similar issue: DNAT rules are evaluated before firewall rules. Yes, this is a known function of VyOS/EdgeOS. But nothing was ever posted baout DNAT rules in use, so I assumed there were none. There are not by default.

@gjacobse said in Help troubleshooting L2TP over IPSEC VPN connections.: jeeze,.. that is a sad state to think that we have nbeen fighting this for that long,... @JaredBusch @scottalanmiller Can a cron be set to restart the ipsec every 24 hours? Yes.

@bbigford said in Does any one have a EdgeRouter 4 online and can test L2TP: Any insight on maybe why that worked? I've had issues with the default group on another manufacturer, but I wouldn't think 14 was default. It worked prior to changing to DH 14 on my iPhone. I had to add a proposal with DH 14 for Windows 10 to work.

@scottalanmiller posted here too https://mangolassi.it/topic/16567/dell-machines-unable-to-vpn-due-to-smartbyte-bloatware

Did you use the Libreswan or Strongswan setting in your previous post?

No problem!

@coliver said: Do VPN connections get created/torn down with every communication? Or are they persistent until the device disconnects? Normally neither. They are normally persistent until a certain amount of time, then they tear down when idle. Might be hours or days. That way they don't remain absolutely forever, but normally a very long time.

@gjacobse said: I was informed that he is about 20' from the router on Wireless, but that TWC is to be onsite today to setup / move the equipment and then he will be within 5' of it. Just hope it's not to close and overloads the wireless radio's.

We recently had to set up an L2TP tunnel for our apple devices, since the last iOS 10 update took PPTP out of the picture. It was a huge PITA too, because I didn't figure out for a while that the secondary tunnel wouldn't let me reuse existing user accounts in our Watchguard.... that was some fun trial and error. And the WG how-tos never specified anything about needing different user accounts. It sucks to do all the steps right and then get login errors... makes ya feel like an amateur.