IKEv2 EAP VPN - Vigor Router to NordVPN [EN]

In this manual we explain how to establish an IKEv2 EAP VPN tunnel from your vigor router to a NordVPN server.

(für Deutsch klicken Sie hier)

NordVPN Setup

1. Create and activate NordVPN account via https://nordvpn.com

2. Download the NordVPN root CA certificate from https://downloads.nordvpn.com/certificates/root.der

3. Select the preferred NordVPN server from:

  • https://nordvpn.com/servers/
  • You may select the country you located and NordVPN will recommend you a server. (Be sure your recommended server is supporting IKEv2 EAP!)
  • In the following picture, "de241.nordvpn.com" is the recommended NordVPN server.
nord-vpn-server nord-vpn-server nord-vpn-server nord-vpn-server

Vigor-Router Setup

1. Go to Certificate Management >> Trusted CA Certificate page and click "IMPORT".

2. Click "Choose File" to select the root.der file we downloaded from https://downloads.nordvpn.com/certificates/root.der in step 3. Then click Import.

import-zertifikat import-zertifikat import-zertifikat import-zertifikat

3. Wait for few seconds. Vigor Router will respond "Import Success” and we can see the Certificate Status is OK.

status-ok status-ok status-ok status-ok

4. Go to VPN and Remote Access >> IPsec Peer Identity page, edit a profile to add an "identity profile" for NordVPN server. Click Enable this account and select "Accept Any Peer ID".

vpn-peer-id vpn-peer-id vpn-peer-id vpn-peer-id

5. Go to VPN and Remote Access >> LAN to LAN, click on an available "index" number and edit the profile as follows:

a. In Common Settings:

  • Give it a profile name and Enable this profile
  • Set Call Direction to Dial-Out
  • Select WAN interface that the VPN will Dial-Out Through
vpn-common-settings vpn-common-settings vpn-common-settings vpn-common-settings

b. In Dial-Out Setting:

  • Select IPsec EAP as the "VPN server type"
  • Enter the VPN server IP address/ Hostname (It is the server we selected in step 4.)
  • Enter the Username and Password. (Username is the mail address you used for applying the NordVPN account; Password is the one you configured during the activating of your NordVPN account.)
  • Choose Digital Signature and select the "IPsec Peer Identity Profile" we created for NordVPN server in step 8 for Peer ID.
  • Select AES with Authentication as "IPsec Security""
  • Click Advanced button for configuring advanced IKE/ IPsec Settings
lan-to-lan-dial-out lan-to-lan-dial-out lan-to-lan-dial-out lan-to-lan-dial-out

In IKE advanced settings page, please configure:

  • IKE phase 1 proposal: AES256
  • IKE phase 1 proposal Group: G14
  • IKE phase 1 proposal Authentication: SHA1
  • IKE phase 2 proposal: AES256_SHA1
  • IKE phase 1 key lifetime: 3600
  • IKE phase 2 key lifetime: 1200
ike-settings ike-settings ike-settings ike-settings

c. In TCP/IP Network Settings:

  • Enter Remote Network IP /Mask as 0.0.0.0/00
  • Select NAT for this VPN connection
  • Enable Change Default Route to this VPN tunnel option if you want all traffics to go with NordVPN server.
lan-to-lan-tcp-ip lan-to-lan-tcp-ip lan-to-lan-tcp-ip lan-to-lan-tcp-ip

6. After finishing above settings, we can check the VPN status via VPN and Remote Access >> Connection Management page.

connection-management connection-management connection-management connection-management

7. We can create Policy Route via Routing >> Load-Balance/Route Policy to define some specific traffic to go via the NordVPN tunnel.

load-balance load-balance load-balance load-balance

In addition to Perfect Privacy, VPN configuration is also possible with other VPN providers:

Instruction ExpressVPN
Instruction Perfect Privacy