Description:

This document describes how to set up a VPN-SSL connection with the OpenVPN Client from an iOS smartphone or tablet to a LANCOM R&S®Unified Firewall (referred to here as the United Firewall).


Requirements:


Scenario:

1) The Unified Firewall is connected directly to the Internet and has a public IPv4 address:

 
2) The Unified Firewall is connected to the Internet via an upstream router:
This scenario also includes the “parallel” solution as described in this article.


Procedure:

The setup for scenarios 1 and 2 are basically the same. Scenario 2 additionally requires port forwarding to be set up on the upstream router (see section 3).

1.) Configuration steps on the Unified Firewall:

1.1) Connect to the Unified Firewall, switch to the menu Certificate Management → Certificates and click on the "+” icon to create a new certificate.

1.2) Enter the following parameters in order to create a CA:

1.3) Create another certificate by clicking on the "+” icon.

1.4) Store the following parameters in order to create a VPN certificate, which is used to authenticate VPN clients at the Unified Firewall:

1.5) Create another certificate by clicking on the "+” icon.

1.6) Store the following parameters in order to create a VPN certificate, which is used to authenticate a particular employee or VPN client:

1.7) Switch to the menu VPN → VPN SSL → VPN SSL Settings

1.8) Enable the VPN SSL service and enter the following parameters:

Optionally you can enter a DNS and/or WINS server, which are assigned to all VPN SSL clients.

If necessary, you can change the Port.

The Address Pool is the range of IP addresses that are assigned to the dial-in VPN SSL clients. This address range must not already be in use as an internal network in the Unified Firewall.

The address pool is the range of IP addresses that are assigned to the dial-in VPN SSL clients. This address range may not already be in use as an internal network in the Unified Firewall.

1.9) Change to the menu VPN → VPN SSL → VPN SSL Connections and click on the “+” icon to create a new VPN SSL connection.

1.10) Enable the VPN connection and enter the following parameters:

With the function Set standard gateway activated, the VPN client can communicate with the Internet via the Internet connection of the Unified Firewall.

The item Client IP allows a fixed IP address to be assigned to the VPN client. If this entry is left empty, the VPN client is given an IP address from the address pool (see step 1.8).

Additional server networks optionally allows the VPN client to access other local networks. In this way, individual employees can be given access to different local networks.

1.11) Edit the VPN SSL connection created in step 1.10 by clicking on the “pencil” icon.

1.12) Click Export client configuration to export the VPN profile together with the certificate.

As of LCOS FX 10.5 you can export the profile directly in the menu VPN → VPN SSL → Connections by clicking on the option Export this connection for a specific connection.

It is possible that you have to click on the double arrow symbol first (right next to the field Filter) to expand the menu, so that the symbol for the profile export is visible.

1.13) Enter the following parameters and then click on Export.

1.14) Click the button to create a new VPN host.

1.15) Save the following parameters:

1.16) In the VPN host click on the "connection" icon and, to open the firewall objects, click on the network object that the OpenVPN client should access.

Repeat this step for every network that the OpenVPN client should be able to access.

1.17) Use the “+” sign to assign the required protocols to the VPN host.

A Unified Firewall uses a deny-all strategy. You therefore have to explicitly allow communication.

1.18) Finally, implement the configuration changes by clicking Activate in the Unified Firewall.

1.19) This concludes the configuration steps on the Unified Firewall.



2) Configuration steps in the OpenVPN client under iOS:

2.1) Open the OpenVPN app and select the option Import profile.

2.2) Choose one of the types of profile import available in the app and import the client configuration exported in step 1.12.

2.3) After a successful import the profile is shown in the profile list and can be connected by using the adjacent switch.


2.4) This concludes the configuration steps in the OpenVPN client.



3) Setting up port and protocol forwarding on a LANCOM router (scenario 2 only):

VPN SSL uses the UDP port 1194 by default. It must be forwarded to the Unified Firewall.

If you are using a router from another manufacturer, ask them about appropriate procedure.

3.1) Open the configuration for the router in LANconfig and switch to the menu item IP-Router → Masq . → Port forwarding table .


3.2) Save the following parameters:


3.3) Write the configuration back to the router.