Last adaption: 04.2026
- Windows 11 has been added to the VPN overview
- Update of the descriptions of the VPN types
This article explains the different techniques for establishing a VPN (Virtual Private Network) connection available in the Securepoint UTM and provides an overview of when to use each of them.
Techniques
WireGuard
| Protocols: | WireGuard |
| Ports: | Standard: 51820/UDP for the first connection, but can use almost any free port |
- WireGuard® is a modern and simple VPN protocol that also impresses with its speed.
- WireGuard dispenses with some complex key exchange procedures and is therefore easier to handle than IPSec, among other things.
- Due to its integration into the Linux kernel, it allows more efficient and resource-saving processing than OpenVPN.
- Settings such as routes, DNS, etc. cannot be "pushed" as with OpenVPN.
As a result, managing Roadwarrior is significantly more complex.
(WireGuard does not support multihoming like SSL-VPN)
SSL VPN
| Protocols: | SSL, TLS |
| Ports: | Standard 1194/UDP; but can use almost any free port and also TCP protocol. |
The Securepoint firewall appliances offer an SSL (Secure Socket Layer) encrypted VPN connection based on the open source project OpenVPN. OpenVPN is characterized by high flexibility, a relatively simple configuration and good encryption of the data and thus a very high security.
Furthermore, OpenVPN usually has no problems with nated connections and can therefore also be used as a very stable alternative to IPSec VPN site-to-site connections.
IPSec VPN
| Protocols: | IKE, ESP, NAT-Traversal |
| Ports: | 500/UDP (IKE), 4500/UDP (NAT-Traversal) |
- IPSec is a very secure VPN standard consisting of different protocols, which can be used for both Site to Site (S2S) and End to Site (E2S, Roadwarrior) connections.
- The advantage is that IPSec is natively supported by many operating systems, although it is not always easy to configure.
- Problems often arise with connections that are NATed to other IP address ranges, as IPSec packets receive a new IP address and source port through NAT. This is where IPSec NAT Traversal comes into play.
- To establish the most stable connection possible, the use of RSA keys instead of a Pre-Shared Key (PSK) for authentication has proven effective.
This is particularly true for connections where the routers that are to establish the VPN connection are positioned behind a NAT router.
L2TP VPN
| Protocols: | L2TP |
| Ports: | 1701/UDP |
The L2TP (Layer 2 Tunneling Protocol) is a combination of the protocols PPTP (Point to Point Tunneling Protocol) and L2F (Layer 2 Forwarding). Since L2TP only supports user authentication but not encryption, it is used in conjunction with the IPSec protocol. L2TP is used specifically to connect standalone computers to networks.
PPTP VPN
PPTP VPN has been proven to be an insecure VPN protocol. It is strongly recommended not to use this protocol anymore. Instead, use SSL VPN, IPSec xAuth or IPSec with L2TP for Roadwarrior connections.
| Protocols: | PPTP, GRE |
| Ports: | 1723/TCP |
The Point-to-Point Tunneling Protocol (PPTP) is usually used for Roadwarrior connections.
The VPN connection is initialized via TCP port 1723 and the data flow is then controlled using the Generic Routing Encapsulation protocol (GRE).
Site to Site VPN connections
VPN type in connection with connection type
The following table shows which VPN technology runs most stable in combination with which Internet connection according to our experience.
| VPN-Art | NAT | ADSL/SDSL | VDSL | Cable connection | LTE | UMTS |
|---|---|---|---|---|---|---|
| WireGuard | without NAT | ADSL/SDSL |
VDSL |
Cable connection |
LTE |
UMTS
|
| NAT on one side | ADSL/SDSL |
VDSL |
Cable connection |
LTE |
UMTS
| |
| NAT on oth sides | ADSL/SDSL |
VDSL |
Cable connection |
LTE |
UMTS
| |
| SSL-VPN | without NAT | ADSL/SDSL |
VDSL |
Cable connection |
LTE |
UMTS
|
| NAT on one side | ADSL/SDSL |
VDSL |
Cable connection |
LTE |
UMTS
| |
| NAT on oth sides | ADSL/SDSL |
VDSL |
Cable connection |
LTE |
UMTS
| |
| IPSec IKEv2 | without NAT | ADSL/SDSL |
VDSL |
Cable connection |
LTE |
UMTS
|
| NAT on one side | ADSL/SDSL |
VDSL |
Cable connection |
LTE |
UMTS
| |
| NAT on oth sides | ADSL/SDSL |
VDSL |
Cable connection |
LTE |
UMTS
| |
| IPSec IKEv1 | without NAT | ADSL/SDSL |
VDSL |
Cable connection |
LTE |
UMTS
|
| NAT on one side | ADSL/SDSL with RSA key |
VDSL |
Cable connection |
LTE |
UMTS with RSA key
| |
| NAT on oth sides | ADSL/SDSL |
VDSL |
Cable connection |
LTE |
UMTS
|
Table explanation
Due to the properties of SSL VPN or OpenVPN, we have found that a stable VPN connection can almost always be set up with this technology.
RSA keys consist of a private and a public key and provide secure authentication. These key pairs can be generated on any Securepoint appliance and the public keys can be exchanged.
Unfortunately, we repeatedly have to make the experience that connections via LTE (Long Term Evolution) are nated by the Internet provider. The connection runs best with a public IP from the provider. Otherwise, VPN connections via IPSec are usually not stable, if they are established at all.
Setting up site-to-site connections
WireGuard
SSL-VPN
IPSec
Roadwarrior or end-to-site VPN connections
VPN type in connection with operating system
Not all operating systems offer the possibility to use all VPN techniques.
The following table provides an overview.
Show / hide Out-of-date versions
Table explanation
- OpenVPN clients are currently available for almost all systems, are easy to set up, stable and secure.
- With the Securepoint Client, the configuration is already included via the user setup.
Therefore, it only needs to be installed (Installer) or started (Portable). - For OpenVPN clients or "Tunnelblick", the finished configuration with the required certificates is downloaded in the user interface and imported into the client. This is also easy to implement.
- With Linux and Unix, it strongly depends on the distribution which IPSec VPN client is included.
- There are repeated problems with the stability of a VPN connection when a router/modem in front of the appliance also has an active firewall. Please deactivate any firewall functionality on these devices.
- Since PPTP VPN is too insecure and L2TP/IPSec under Windows disconnects after 1 hour each, we do not recommend these two methods.
Setting up the Roadwarrior connections
WireGuard
Openvpn
- Configuration of an OpenVPN Roadwarrior connection for Windows
- Setting up the Windows VPN client z SSL-VPN
- Configuration of an OpenVPN Roadwarrior connection for iOS
- Configuration of an OpenVPN Roadwarrior connection for OS X
IPSec
- Configuring a native IPSec connection
- Configuration of an Xauth connection iOS/Android/Greenbow
- IPSec connections with EAP-MSCHAPv2 to a Windows client