IKEv2 EAP between NordVPN and Vigor Router

Since firmware version 3.9.0, Vigor Router also supports dialing out an IKEv2 EAP VPN tunnel to NordVPN server. This article introduces how to create IKEv2 EAP VPN tunnel from Vigor Router to NordVPN server in this document.

Since firmware version 3.9.0, Vigor Router also supports dialing out an IKEv2 EAP VPN tunnel to NordVPN server. This article introduces how to create IKEv2 EAP VPN tunnel from Vigor Router to NordVPN server in this document.

Note: Vigor2860/2925 support the feature since v3.8.9.4

1. You will need a NordVPN account and download the NordVPN root CA certificate from https://downloads.nordvpn.com/certificates/root.der

2. Get the NordVPN server domain from https://nordvpn.com/servers/
You may get a recommended server by selecting the country you located. In the following picture, de241.nordvpn.com is the hostname of the VPN server.

a screenshot of NordVPN Server settings

3. Log into the router's management page. Go to Certificate Management >> Trusted CA Certificate page, and click IMPORT. Click Choose File to select the root.der file we downloaded in step 2. Then, click Import.

a screenshot of DrayOS Trusted CA settings

4. Wait for few seconds until the router responds “Import Success” and the Certificate Status shows OK

a screenshot of DrayOS Trusted CA settings   

5. Go to VPN and Remote Access >> IPsec Peer Identity, edit a profile to for NordVPN server.

  1. Check Enable this account
  2. Select Accept Any Peer ID
a scressnshot of DrayOS IPsec Peer Identity Settings

6. Go to VPN and Remote Access >> LAN to LAN, click on an available index number, and edit the profile as follows. In Common Settings,

  1. Give it a profile name
  2. Check Enable this profile
  3. Set Call Direction to "Dial-Out"
  4. At Dial-Out Through, select the WAN interface for VPN connection
a screenshot of DrayOS VPN Client Settings

7. In Dial-Out Settings,

  1. Select IKEv2 EAP for the VPN server type
  2. Enter the domain of VPN server we get in step 3 at Server IP address/Hostname
  3. Enter Username (It is the mail address you used for applying the NordVPN account)
  4. Enter Password (It is the one you configured while activating the NordVPN trial service)
  5. Choose "Digital Signature" for IKE Authentication Method, and select the IPsec Peer Identity Profile created in step 6 for Peer ID
  6. Select "AES with Authentication" for IPsec Security Method
  7. Click Advanced
a screenshot of DrayOS VPN Client settings

8. Click Advanced button, In the IKE advanced settings pop-up windows, confgure:

  1. IKE phase 1 proposal as "AES256_SHA1_G14"
  2. IKE phase 2 proposal as "AES256_SHA1"
  3. IKE phase 1 key lifetime as "3600"
  4. IKE phase 2 key lifetime as "1200"
a screenshot of DrayOS IKE advanced settings

9. Click OK to close the window. At TCP/IP Network Settings:

  1. Enter Remote Network IP as "0.0.0.0"
  2. Select Remote Network Mask to "0.0.0.0/00"
  3. Change Routing to NAT for this VPN connection
  4. (optional) Enable Change Default Route to this VPN tunnel option if you want all traffic to NordVPN.
a screenshot of DrayOS VPN Settings

10. After finishing above settings, we can check the VPN status via VPN and Remote Access >> Connection Management page.

a screenshot of DrayOS VPN Dial-Out page

11. (optional) We can create Policy Route via Routing >> Load-Balance/Route Policy to send specific traffic to the NordVPN tunnel. To verify the policy, we can use the command “tracert” to check if the defined traffic is going through the VPN tunnel correctly.

a screenshot of cmd running command tracert

Note: In order to accept large packets from NordVPN, Allow pass inbound fragmented large packets (required for certain games and streaming) should be enabled.

necessary firewall setting

1.  You will need a NordVPN account and download the NordVPN root CA certificate from https://downloads.nordvpn.com/certificates/root.der

2.  Get the NordVPN server domain from https://nordvpn.com/servers/
You may get a recommended server by selecting the country you located in. The following picture,  tw51.nordvpn.com is the hostname of the VPN server.

3. Now, On the Router. Go to Certificate Management>>Trusted CA Certificate page, click upload, and select Local Certificate. Click Choose file to select the root.der file which we download from Step1 After uploading the file, you can see the status shows ok.


4.  VPN and Remote Access >> VPN profile>>IPsec, and click Add, configure the settings at basic page.

  1. Enable the profile
  2. Enable Auto Dial-Out and select Always Dial-Out
  3. Enter the domain of VPN server we get in step 2 at Remote Host
  4. Enter the  NordVPN account and password at Username and password.

5. Switch to Advanced page, and enable Set VPN as Default Gateway

6. Switch to Proposal Page.

  1. Select AES256 G14 as IKE Phase 1 proposalㄡ
  2. Select AES256 with auth as IKE phase 2 proposal.

7. Go to VPN and Remote Access>>Connection Management.

You can check the status of the VPN porfile.

Published On: Jun 04, 2020 

Was this helpful?     


Related Articles