IKEv2 EAP VPN - Vigor Router to Perfect Privacy [EN]

We will introduce how to create IKEv2 EAP VPN tunnel from Vigor Router to Perfect Privacy VPN server in this document.

( für Deutsch klicken Sie hier )

Perfect Privacy Setup

1. Create and activate an account via https://www.perfect-privacy.com

2. Download the Perfect Privacy Root CA certificate from https://www.perfect-privacy.com/downloads/ipsec_ca.zip

3. Select a VPN-Server: https://www.perfect-privacy.com/de/customer/download/ipsec?system=draytek

perfect-privacy-server perfect-privacy-server perfect-privacy-server perfect-privacy-server

Vigor-Router Setup

1. Go to Certificate Management >> Trusted CA Certificate page and click "IMPORT".

2. Click "Choose File" to select the CA certificate file, then click Import.

import-zertifikat import-zertifikat import-zertifikat import-zertifikat

3. Wait for few seconds. Vigor Router will respond "Import Success” and we can see the Certificate Status is OK.

status-ok status-ok status-ok status-ok

4. Go to VPN and Remote Access >> IPsec Peer Identity page, edit a profile to add an "identity profile" for Perfect Privacy server. Click Enable this account and select "Accept Any Peer ID".

vpn-peer-id vpn-peer-id vpn-peer-id vpn-peer-id

5. Go to VPN and Remote Access >> LAN to LAN, click on an available "index" number and edit the profile as follows:

a. In Common Settings:

  • Give it a profile name and Enable this profile
  • Set Call Direction to Dial-Out
  • Select WAN interface that the VPN will Dial-Out Through.
vpn-common-settings vpn-common-settings vpn-common-settings vpn-common-settings

b. In Dial-Out Setting:

  • Select IPsec Tunnel and "IKEv2"
  • Select IPsec EAP as the "VPN server type"
  • Enter the VPN server IP address/ Hostname
  • Enter the Username and Password. (Username is the mail address you used for applying the Perfect Privacy account)
  • Choose Digital Signature and select the IPsec Peer Identity Profile
  • Select AES with Authentication as IPsec Security
  • Click Advanced button for configuring advanced IKE/ IPsec Settings
lan-to-lan-dial-out lan-to-lan-dial-out lan-to-lan-dial-out lan-to-lan-dial-out

In IKE advanced settings page, please configure:

  • IKE phase 1 proposal: AES256_SHA1_G14
  • IKE phase 2 proposal: AES256_SHA1
  • IKE phase 1 key lifetime: 3600
  • IKE phase 2 key lifetime: 1200
ike-settings ike-settings ike-settings ike-settings

c. In TCP/IP Network Settings:

  • Enter Remote Network IP /Mask as 0.0.0.0/00
  • Select NAT for this VPN connection
  • Enable Change Default Route to this VPN tunnel option if you want all traffics to go with Perfect Privacy server.
lan-to-lan-tcp-ip lan-to-lan-tcp-ip lan-to-lan-tcp-ip lan-to-lan-tcp-ip

6. After finishing above settings, we can check the VPN status via VPN and Remote Access >> Connection Management page.

connection-management connection-management connection-management connection-management

We can create Policy Route via Routing >> Load-Balance/Route Policy to define some specific traffic to go via the Perfect Privacy-VPN tunnel.

load-balance load-balance load-balance load-balance

In addition to Perfect Privacy, VPN configuration is also possible with other VPN providers:

Instruction NordVPN Instruction ExpressVPN