VPN Configuration Guide

ZyXEL ZyWALL 5 / 2WG

Revision 1.0.0
equinux AG and equinux USA, Inc. 2007 equinux USA, Inc. All rights reserved. Under the copyright laws, this manual may not be copied, in whole or in part, without the written consent of equinux AG or equinux USA, Inc. Your rights to the software are governed by the accompanying software license agreement. The equinux logo is a trademark of equinux AG and equinux USA, Inc., registered in the U.S. and other countries. Every effort has been made to ensure that the information in this manual is accurate. equinux is not responsible for printing or clerical errors. Manual Edition 1.0.0 Created using Apple Pages. www.equinux.com
Apple, the Apple logo, iBook, Mac, Mac OS, MacBook, PowerBook are trademarks of Apple Computer, Inc., registered in the U.S. and other countries. Finder and Mail are trademarks of Apple Computer, Inc. AppleCare is a service mark of Apple Computer, Inc., registered in the U.S. and other countries. FileMaker is a trademark of FileMaker, Inc. equinux shall have absolutely no liability for any direct or indirect, special or other consequential damages in connection with the use of the quick setup guide or any change to the router generally, including without limitation, any lost profits, business, or data, even if equinux has been advised of the possibility of such damages.
Introduction... 5 Prerequisites...6 Configure your ZyXEL router.. 7
Step 1 - Add a new VPN tunnel gateway policy.. 7 Step 2 - Configure your VPN tunnels gateway policy.. 8 Step 3 - Add a network policy.. 9 Step 3 - Configure your network policy... 10 Step 4 - Add a New VPN User...11
Acquire more Licenses.. 30
Configure VPN Tracker.. 12
Step 1 - Create a new Connection... 12 Step 3 - Network Settings... 14 Step 4 - Authentication Settings... 15
Check the VPN connection... 16
Its time to go out!...16 Test your connection.... 16

Host to Everywhere.. 19

Step 2 - Add a new Gateway policy to your ZyXEL Router.20 Step 2 - Configure the new Gateway policy.. 21
Troubleshooting.. 22 Whats next?.. 23
Introduction.... 23 Known Limitations.... 23 Accessing Files.... 24 Accessing a FileMaker Database... 26

Introduction

This document describes how VPN Tracker can be used to establish a connection between a Macintosh running Mac OS X and a ZyXEL ZyWALL VPN router. The ZyXEL ZyWALL firewall is configured as a router connecting a company LAN to the Internet. This paper is only a supplement to, not a replacement for, the instructions that were included with your ZyXEL device. Please be sure to read those instructions and understand them before starting.
EQUINUX SHALL HAVE ABSOLUTELY NO LIABILITY FOR ANY DIRECT OR INDIRECT, SPECIAL OR OTHER CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE USE OF THE HOW-TO OR ANY CHANGE TO THE ROUTER GENERALLY, INCLUDING WITHOUT LIMITATION, ANY LOST PROFITS, BUSINESS, OR DATA, EVEN IF EQUINUX HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Prerequisites

First you have to make sure to use a recent firmware version. The latest release for your ZyXEL firewall can be obtained from http://www.ZyXEL.com/ For this document, firmware version 1.0 was used. Please note: VPN Tracker has been only been tested with the ZyXEL ZyWALL 2WG / ZyWALL 5 and the above firmware version. Please make sure to use the latest firmware version. You will need one VPN Tracker Personal Edition license for each Mac connecting to your ZyXEL device. We recommend one VPN Tracker Professional Edition for the administrators Mac in order to export configuration files to the clients. VPN Tracker is compatible with Mac OS 10.2.5+, 10.3 and 10.4.1+
Configure your ZyXEL router
This section describes the configuration of your VPN router.
Step 1 Add a new VPN tunnel gateway policy
Select VPN from the menu Click the + icon to add a new VPN Tunnel gateway policy
Step 2 Configure your VPN tunnels gateway policy
Name: Enter an arbitrary name for your new tunnel
My Address: Enter your ZyXEL devices IP address Pre-Shared Key: Enter your desired password (pre-shared key), e.g. secretkey Enable Extended Authentication: Check the box and select Server Mode Click Apply

"

Step 3 Add a network policy
Click the Cloud icon to add a new network policy for your VPN connection
Step 3 Configure your network policy
Check the Active box to enable this new policy Name: Enter an arbitrary name (e.g. vpntracker_hosttonetwork) Local Network: Address Type: Select Subnet Address Starting IP Address: Enter the IP address of your office network Ending IP Address / Subnet Mask: Enter your office networks subnet mask Click Apply
Step 4 Add a New VPN User
Select AUTH SERVER from the menu Activate the checkbox for the first user Select a unique user name password

" !

Click Apply

Configure VPN Tracker

This section describes the configuration of VPN Tracker for your ZyXEL router.
Step 1 Create a new Connection
Click on New in the VPN Tracker main window
Step 2 Connection Settings
The pre-defined VPN Tracker connection for the ZyXEL VPN router is based on the default settings for your ZyXEL VPN router. If you changed any of the settings while configuring the device, you might have to adjust the connection type in VPN Tracker.
Select the vendor ZyXEL Select your VPN model (ZyWALL 2WG / ZyWALL 5) Make sure to enable Initiate connection from this end

Step 3 Network Settings

VPN Gateway Address: the public IP address of your VPN Gateway (e.g. 84.181.243.112) Remote Network/Mask: network address and subnet address of your office network
Step 4 Authentication Settings
Pre-shared key: Enter the pre-shared key you used earlier when configuring your ZyXEL device
Make sure to check Enable Extended Authentication (XAUTH)

Check the VPN connection

This section explains how to start and test your VPN connection.

Its time to go out!

You will not be able to test and use your VPN connection from within your Private Network. In order to test your connection, you'll need to connect from a different location. Thats why its now time to go out. Take your MacBook Pro and have a coffee at your favorite Internet cafe or go visit a friend.

Test your connection

To test if everything is setup correctly please follow the steps below: Get access to the Internet Make sure the Internet connection is working; open your Internet browser and try to connect to http://www.equinux.com Start VPN Tracker if its not already running
Select the connection you configured for your ZyXEL device Click on the Start VPN button
Provide the username earlier Click OK

! "

and password

defined

If the light turns red after a few seconds, then please read the Troubleshooting section on the next page If the light turns green, that means youve successfully established a connection

Congratulations! You did it!

Host to Everywhere

Sometimes, you will want to secure all your IP traffic. Both VPN Tracker and your ZyXEL router support this mode.
Step 1 Adjust your VPN Connection
Topology: Select Host to Everywhere from the drop down menu
Step 2 Add a new Gateway policy to your ZyXEL Router
Click the cloud icon to add a new VPN gateway policy
Step 3 Configure the new Gateway policy
Check the Active box to enable this new policy Name: Enter an arbitrary name (e.g. vpntracker_everywhere) Local Network: Address Type: Select Subnet Address Starting IP Address: Enter 0.0.0.0 Ending IP Address / Subnet Mask: Enter 0.0.0.0 Click Apply
Congratulations! You have now secured all of your network traffic.

Troubleshooting

I dont get a green light in the VPN Tracker main window
Make sure that your computer is not connected directly to the Private Network you want to connect to. Make sure, that the Identifiers and the Pre-shared key you've entered in the router configuration match the settings you entered in VPN Tracker. Verify that the public IP address you entered in VPN Tracker matches the public IP address of your router. Download our sample configuration and connect to our test device at http://www.vpntracker.com/connectiontest/ If the test connection could not be established: Make sure, that the internet connection is working and verify, that your local router is not blocking any connection attempts. If the test connection could be established: Check the log file of your remote VPN router for any error messages. If youre still having issues with your connection, then please create some screenshots of your settings on both ends, gather the log files and send them over to our support team at vpntracker@equinux.com.

Whats next?

This section explains the usage of your newly configured VPN connection.
As the VPN connection has now been established, you should be able to access all resources in your Private Network.

Known Limitations

There are some limitations of a VPN connection compared to a direct connection to a Private Network. Bonjour: As Bonjour Chat is not supported over a VPN tunnel, youll need to use iChat server in order to chat remotely. Browsing the network: You cant browse the remote network as youre normally used to. You need to connect to each machine manually, as described on the next page.

Accessing Files

To access files in your Private Network, just follow the steps below: Go to the Finder application In the menu bar, click on Go->Connect To Server.
Enter the IP address of the machine you want to connect to. In our example network this would be the IP address 192.168.0.2 Click on the Connect button Enter your Username and Password to access the files
When connecting to a Windows fileserver youll need to prefix the IP address with smb:// e.g. smb://192.168.0.2 ,.
Accessing a FileMaker Database
To access a database available in your Private Network, just follow the steps below: Start the FileMaker application In the menu bar, click on File->Open Remote

Click on the Add. button

Enter the IP address of the FileMaker Server machine Enter the Favorite Hosts Name for this machine Click on the Save button
Select a database from the list of Available Files and click Open Youre now able to access your FileMaker databases as usual

Acquire more Licenses

If two or more people need to access your Private Network, then you need to acquire more VPN Tracker licenses.
To get more licenses, please contact your reseller and inquire about VPN Tracker Personal Edition. Or point your browser to http://store.equinux.com and buy additional VPN Tracker Personal Edition Licenses online.