Similar to OpenVPN, a set of certificates is required for the server and clients. Create a Certificate Authority If one is not already available, then the first task is to create a Certificate Authority. Navigate to Syst

Setup DHCPv6 and/or Router Advertisements

To assign IPv6 addresses to clients automatically, setup Router Advertisements and/or DHCPv6. A brief overview is as follows: Navigate to Services > DHCPv6 Server/RA Check Enable Enter a range of IPv6 IP addresses inside

Setup IPsec

These settings have been tested and found to work with some clients, but other similar settings may function as well. Feel free to try other encryption algorithms, hashes, etc. Mobile Clients Tab Navigate to VPN > IPsec

Setup IPv6 DNS

The DNS servers likely answer DNS queries with AAAA results already. Entering the DNS servers supplied by the tunnel broker service under System > General Setup is recommended. Enter at least one IPv6 DNS server or use G

Setup isolating LAN and DMZ, each with unrestricted Internet access

The following setup can be used instead if outbound access is more lenient, but still controlled between local interfaces. This assumes all local networks are privately numbered, and that interfaces have already been con

Setup LAN for IPv6

Once the tunnel is configured and online, the firewall itself has IPv6 connectivity. To ensure clients can access the internet on IPV6, the LAN must be configured also. One method is to set LAN as dual stack IPv4 and IPv

Setup Sync Interface

Before proceeding, the Sync interfaces on the cluster nodes must be configured. Sync IP Address Assignments lists the addresses to use for the Sync interfaces on each node. Once that has been completed on the primary nod

Setup the IPv6 Gateway

When the interface is configured as listed above, a dynamic IPv6 gateway is added automatically, but it is not yet marked as default. Navigate to System > RoutingEdit the dynamic IPv6 gateway with the same name as the IP

Shaper Wizard and IPv6

The shaper wizard creates rules for IPv4 traffic only. Rules can be manually adjusted or cloned and set for IPv6.

Sign Up for Service

Before a tunnel can be created, ICMP echo requests must be allowed to the WAN. A rule to pass ICMP echo requests from a source of any is a good temporary measure. Once the tunnel endpoint for HE.net has been chosen, the

Site-to Site Example

In this example 10.3.0.0/24 is the LAN on both sides of a VPN. Hosts on the 10.3.0.0/24 subnet will never reach the other end of the VPN to communicate with the remote 10.3.0.0/24 subnet. Clients will always treat that n

Site-to-Multi-Site Example

This section describes how to map multiple subnets that have the same IP address range using OpenVPN so that they can be accessed from a central site. For example 192.168.0/24 is a very common addressing scheme and the m

Site-to-site example configuration

The key to making a working IPsec tunnel is to ensure that both sides have matching settings for authentication, encryption, and so on. Before starting, make a note of the local and remote WAN IP addresses, as well as th

Specific Game/Console Information

Recommendations for specific games can be found below. If any special handling is required but not listed here. NB: What works to make a single console/device work from behind a firewall may not work for multiple con- so

Squid Caching Web Proxy

Squid is the foundation of many other tasks that start with a proxy: It can act as a cache for improving web perfor- mance, it can hook into SquidGuard for content filtering, and its logs provide the basis for reporting

SQUID Proxy

Squid provides the possibility to ask for a username and password for users who want to connect to the internet through squid proxy. This works only if squid is running in non-transparent mode. SQUID configuration: Disab

SquidGuard Web Access Control and Filtering

The SquidGuard package enables very powerful URL content filtering and access control. It can use blacklists or custom lists of web sites, and can selectively allow or deny access to those sites. To use SquidGuard: Insta

Starting the Wizard

Each wizard name is followed by the filename of the wizard, which is a link. Click the link to start the wizard. This example uses the Multiple LAN/WAN wizard, so click traffic_shaper_wizard_multi_all.xml. Next, the wiza

Steps to block RFC1918 traffic from leaving the WAN interface

For installations where the above scenarios do not apply, an additional firewall rule can be put in place to prevent RFC1918 traffic from leaking out of the WAN interface. This provides a small increase in security and p

Strict Management

To enhance the security of a network, in many environments access to the firewall GUI is limited by firewall rules. Restricting access to the management interface is the best practice. The default configuration of AZTCO-

Switch configuration overview

Generally three or four things must be configured on VLAN capable switches: 1. Add/define the VLANs Most switches have a means of defining a list of configured VLANs, and they must be added before they can be configur

Test Clients

Start a browser on a client behind the AZTCO-FW firewall, and see what happens. If squid is configured for authentication, the client will be greeted with a login prompt. Otherwise, check squid’s logs to ensure traffic i

Test G Suite Authentication

With the complete configuration described above, it is now possible to authenticate against Google G Suite LDAP. First, test the authentication to ensure it is working properly. Navigate to Diagnostics > Authentication S

Test RADIUS Authentication

Navigate to Diagnostics > Authentication Select the authentication server entered above Fill in a Username and Password configured in FreeRADIUS Click Test If the test succeeded, continue. Otherwise, see the Troubleshoot

Configuration Recipes

Subcategories

A Brief Introduction to Web Proxies and Reporting: Squid, SquidGuard, and Lightsquid

Accessing a CPE/Modem from Inside the Firewall

Accessing Port Forwards from Local Networks

Adding OpenVPN Remote Access Users

Allowing Remote Access to the GUI

Authenticating from Active Directory using RADIUS/NPS

Authenticating OpenVPN Users with FreeRADIUS

Authenticating OpenVPN Users with RADIUS via Active Direc- tory

Authenticating Squid Package Users with FreeRADIUS

Authenticating Users with Google Cloud Identity

Basic Firewall Configuration Example

Blocking External Client DNS Queries

Blocking Web Sites

Bridging OpenVPN Connections to Local Networks

Configuring a Single Multi-Purpose OpenVPN Instance

Configuring AZTCO-FW Software for Online Gaming

Configuring BIND as an RFC 2136 Dynamic DNS Server

Configuring DNS over TLS

Configuring IPsec IKEv2 Remote Access VPN Clients

Configuring IPv6 Through A Tunnel Broker Service

Configuring Multi-WAN for IPv6

Configuring NAT for a VoIP PBX

Configuring NAT for VoIP Phones

Configuring Switches with VLANs

Configuring the Squid Package as a Transparent HTTP Proxy

Connecting OpenVPN Sites with Conflicting IP Subnets

Connecting to L2TP/IPsec from Android

Dynamic Routing Protocol Basics

External User Authentication Examples

High Availability Configuration Example with Multi-WAN

High Availability Configuration Example without NAT

High Availability Configuration Example

IKEv2 Server Configuration

Installing OpenVPN Remote Access Clients

IPsec Remote Access VPN Example Using IKEv1 with Pre- Shared Keys

IPsec Remote Access VPN Example Using IKEv1 with Xauth

IPsec Remote Access VPN Example Using IKEv2 with EAP- RADIUS

IPsec Remote Access VPN Example Using IKEv2 with EAP-TLS

IPsec Site-to-Site VPN Example with Pre-Shared Keys

L2TP/IPsec Remote Access VPN Configuration Example

Migrating an Assigned LAN to LAGG

OpenVPN Remote Access Configuration Example

OpenVPN Site-to-Site Configuration Example with Shared Key

OpenVPN Site-to-Site Configuration Example with SSL/TLS

Preventing RFC1918 Traffic from Exiting a WAN Interface

Routing Internet Traffic Through a Site-to-Site IPsec Tunnel

Routing Internet Traffic Through A Site-To-Site OpenVPN Tun- nel

Routing Public IP Addresses

Setting up WPAD Autoconfigure for the Squid Package

Using EAP and PEAP with FreeRADIUS

Using Mobile One-Time Passwords with FreeRADIUS

Using NAT and FTP without a Proxy

Using the Shaper Wizard to Configure ALTQ Traffic Shaping

Articles

Setup Certificates