Menu

Lodestar connection guides

Set up your connection

Both plans support encrypted WireGuard, IKEv2 and compatible L2TP/IPsec. Use WireGuard on phones, tablets, Linux and compatible routers including UniFi, or follow the IKEv2 and L2TP guides below. Choose your connection method and use the personal details from your activated service.

WireGuardiPhone & iPadAndroidRoutersCompare plans

Start here

Know which details to use

One subscription provides one static public IPv4 and one active tunnel at a time. WireGuard is supported on both L2TP 500 and L2TP 1000, including paid, existing and complimentary accounts. Select one connection method in your activated account. Switching methods keeps your public IPv4, plan price and billing date. Your existing broadband or mobile connection is still required.

Order online. Choose L2TP 500 or L2TP 1000. Personal profiles and credentials are available in your account after your service is activated.

The settings below are for IKEv2 and L2TP. For WireGuard, use your personal WireGuard configuration and the WireGuard guide.

VPN server
l2tp.lodestarnetworks.co.uk
IKEv2 Remote ID
l2tp.lodestarnetworks.co.uk; keep this exact server identity.
IKEv2 Local ID
Your personal tunnel username from your account.
IKEv2 authentication
EAP-MSCHAPv2 username and password, with a verified server certificate.
DNS servers
1.1.1.1 and 9.9.9.9, supplied by the connection.
L2TP MTU / MRU
1400 / 1400.
L2TP/IPsec encryption
IKEv1: AES-128 or AES-256 CBC, SHA-256, and DH group 14 (2048-bit). ESP transport: AES-128 or AES-256 CBC with SHA-256. SHA-1 and DH group 2 (MODP1024) are not accepted.
Your public IPv4
Assigned automatically to the tunnel. Do not replace your broadband WAN address or use it as a LAN subnet.
Address family
IPv4 only. Check IPv6 behaviour on your chosen client; this service does not supply an IPv6 address.

Private details stay in your account

When your service is activated, open Your account and connection details and open Tunnel credentials. Confirm your account password to see your tunnel username, tunnel password, assigned IPv4 and personal profile downloads. The tunnel password is separate from your website password.

L2TP/IPsec also needs the private IPsec shared secret shown there. IKEv2 does not use that shared secret. WireGuard uses a separate personal configuration containing your private key. Never post passwords, shared secrets, private keys or personal profile files publicly.

Encrypted WireGuard

WireGuard on both plans

WireGuard is supported on L2TP 500 and L2TP 1000. You can use a compatible WireGuard client on iPhone, iPad, Android, Windows, macOS, Linux including suitable ARM devices, or a router. Your plan's speed ceiling and single active tunnel still apply.

  1. Sign in to your Lodestar account, choose WireGuard under connection options and confirm your account password. Wait for the change to finish. Switching methods disconnects the previous tunnel.
  2. Download your personal WireGuard configuration from your account after confirming your account password. Keep the file private because it contains a private key.
  3. Install the official WireGuard client for your operating system, or use your router's WireGuard VPN Client. Import the supplied configuration file. On Linux, a compatible NetworkManager WireGuard connection or wg-quick can load the file; follow your distribution's instructions and keep the file readable only by your account or root.
  4. Activate the tunnel and send a small amount of traffic. Check for a recent handshake and confirm that traffic routed through Lodestar uses the public IPv4 shown in your account.

Use the supplied Address, DNS, AllowedIPs, endpoint, keys and MTU together. Do not paste your website password, IKEv2 profile or L2TP/IPsec secret into WireGuard. Your device must support the WireGuard client; exact menus and package availability vary by model and operating system.

Routers need traffic routing. A connected WireGuard peer does not automatically send LAN traffic into the tunnel. Choose the devices or networks to route through Lodestar and configure their firewall and NAT rules. Keep the WireGuard endpoint reachable through the original WAN. For a UniFi gateway, follow the steps below.

The service provides IPv4. Check your client's separate IPv6 and disconnected behaviour rather than assuming an always-on connection. A phone's tunnel does not automatically carry traffic from tethered devices.

UniFi WireGuard VPN Client

Connect a UniFi gateway

Use a maintained Next-Gen UniFi Gateway or UniFi Cloud Gateway that offers WireGuard VPN Client. This connects your router to Lodestar. Check your exact model and firmware for that client option.

  1. Choose WireGuard in your activated Lodestar account and download your personal configuration after the switch finishes.
  2. In the UniFi Network application's VPN settings, add a VPN Client, select WireGuard and import the Lodestar configuration file. Apply the settings and check that it connects.
  3. Add a Traffic Route or Policy-Based Route for the LAN devices or networks that should use Lodestar and select the new VPN client. A connected status alone does not route their internet traffic.
  4. From a selected device, confirm the outbound public IPv4 matches your Lodestar account. Keep another way to administer the router while testing routes.
  5. For a server behind the gateway, configure the required inbound port, firewall and destination-NAT rules, then test from another internet connection. Its replies must return through the Lodestar tunnel. Keep router administration private.

Menu names and inbound NAT controls vary by firmware. The VPN Server menu is used for remote clients connecting into your own network. Follow VPN Client to connect the gateway to Lodestar.

Ubiquiti's WireGuard VPN Client documentation explains configuration import. Its policy-based routing guide explains selecting traffic for the VPN and the choice of fallback or kill-switch behaviour. Ask hello@lodestarnetworks.co.uk for help with your model and intended LAN access.

Encrypted IKEv2

iPhone & iPad

Use the built-in IKEv2 client on a current iOS or iPadOS version. The personal Apple profile supplies the server, server identity and tunnel username; you enter the tunnel password on the device.

  1. In Safari, sign in to your activated Lodestar account and download the Apple configuration profile from your connection details.
  2. Open Settings / General / VPN & Device Management. Review and install the downloaded Lodestar profile.
  3. Enter your tunnel password when prompted. The download contains no password, IPsec shared secret, private key or trust-root installation.
  4. Connect the Lodestar IKEv2 VPN, then check your public IPv4.

The configuration profile is not device-management enrolment. It may be marked unsigned: review that you downloaded it from your own Lodestar account. This is separate from VPN server certificate validation, which must stay enabled.

Enter the IKEv2 settings manually
Type
IKEv2
Description
Lodestar
Server / Remote ID
l2tp.lodestarnetworks.co.uk in both fields
Local ID
Your tunnel username from your account
User authentication
Username
Username / Password
Your tunnel credentials, not your website login
Proxy
Off, unless you deliberately use your own proxy

Open VPN settings, choose Add VPN Configuration and enter these fields. Do not select certificate-based client authentication or enter an L2TP/IPsec shared secret for IKEv2.

Encrypted IKEv2

Android with strongSwan

The official strongSwan VPN Client provides a consistent IKEv2 setup across supported Android devices. Your personal Android profile sets the server identity and trusted-certificate checks.

  1. Install the official strongSwan VPN Client.
  2. Sign in to your activated Lodestar account and download the Android profile. Open it with strongSwan, or import it from the app.
  3. Enter your tunnel password. Accept Android's request to create the VPN connection.
  4. Connect, then check that your public IPv4 matches your account.
Enter the strongSwan settings manually
Server
l2tp.lodestarnetworks.co.uk
VPN type
IKEv2 EAP (Username/Password)
Username / Password
Your tunnel credentials from your account
CA certificate
Select automatically using the device's trusted certificate authorities
Server identity
l2tp.lodestarnetworks.co.uk, if the advanced identity field is shown

Keep certificate and server identity verification enabled. Use the personal profile if you cannot find the required fields.

Using Android's built-in VPN settings? Some devices offer IKEv2/IPsec MSCHAPv2; others do not expose the required fields. Use the same server and tunnel credentials. Its IPsec identifier is the client identity: enter your tunnel username, rather than the server Remote ID. If it asks for a CA certificate, use the certificate help in your signed-in account. Use strongSwan when the device cannot represent the supplied settings.

Your personal strongSwan profile requests blocking traffic outside the negotiated tunnel while connected. A manually entered profile may behave differently. Neither is a promise of always-on protection while disconnected, or VPN sharing with tethered devices.

Choose the client mode

Compatible routers

Your router must act as an outbound VPN client. A setting that creates a VPN server for remote users is a different role. Confirm your exact model, firmware and protocol before moving LAN traffic.

MikroTik RouterOS: L2TP/IPsec

RouterOS provides an outbound L2TP client with IPsec. Use a maintained release and back up your configuration. Its automatic IPsec settings may use legacy proposals; the simple checkbox setup has not been qualified against this service.

  1. Under PPP / Interfaces, add an L2TP Client.
  2. Set Connect To to l2tp.lodestarnetworks.co.uk. Enter the tunnel username and tunnel password from your account.
  3. Enable Use IPsec and enter the private IPsec Secret from your account. Set Max MTU and Max MRU to 1400. Use MSCHAPv2 if choosing the PPP authentication method.
  4. Configure a dedicated IPsec profile and proposal for this connection: IKEv1 with AES-128 or AES-256 CBC, SHA-256 and DH group 14; ESP transport with AES-128 or AES-256 CBC and SHA-256. Your firmware may require an explicit IPsec peer and policy instead of the automatically generated L2TP settings. Avoid changing a shared default profile used by other VPNs. Ask support about your exact model and firmware if these settings are unavailable.
  5. For the first connection, leave Add Default Route off. Keep the endpoint reachable through your existing WAN. Once connected, configure the routing, firewall and source NAT rules for the LAN traffic you intend to send through Lodestar.
  6. Confirm the negotiated address matches your assigned IPv4. Test outbound traffic, IPsec status and any intended inbound service before moving the rest of your LAN.

A PPP profile named “encryption” does not prove IPsec is active. Check the IPsec security association. Router CPU, firmware and encryption affect speed; Ethernet port speed does not establish tunnel throughput.

pfSense: plain L2TP PPP client

This is an unencrypted option and requires plain L2TP to be explicitly enabled for your Lodestar service.

  1. In your activated account, enable Allow unencrypted plain L2TP, confirm your account password and wait for the connection-option update to finish. The change may disconnect an existing tunnel.
  2. Back up the configuration. Open Interfaces / Assignments / PPPs and add an L2TP link.
  3. Use your existing WAN as the underlying link. Enter the Lodestar server and your tunnel username/password; set MTU/MRU to 1400 where available. Leave Shared Secret blank.
  4. Assign the PPP interface, then configure its gateway, firewall, LAN routing and outbound NAT for the traffic you want to send through it.
  5. Keep the endpoint route on the original WAN. Confirm the negotiated public IPv4 and test reconnection.

VPN / L2TP configures a server, not this client. The PPP Shared Secret field is L2TP tunnel authentication, not the IPsec PSK. Do not paste the Lodestar IPsec shared secret there. L2TP/IPsec client use on pfSense needs separate qualification.

OpenWrt: plain L2TP client

Check that your supported OpenWrt release provides xl2tpd and that the device has enough storage. Package and LuCI options vary by release.

  1. In your activated account, enable Allow unencrypted plain L2TP, confirm your account password and wait for the connection-option update to finish. The change may disconnect an existing tunnel.
  2. Create an interface with protocol l2tp, the Lodestar server, your tunnel credentials, MTU 1400 and IPv6 disabled. Initially leave it out of the default route.
  3. Keep the endpoint reachable on the original WAN. Configure the new interface's firewall zone, LAN forwarding and source NAT.
  4. Verify the assigned IPv4, outbound traffic and reconnection before routing your LAN through it.

xl2tpd alone is unencrypted. L2TP/IPsec requires a separately configured, compatible IPsec client and device-specific validation.

WireGuard routers, including Ubiquiti UniFi: WireGuard is supported on both plans. Use your router's outbound WireGuard client with the personal configuration from your Lodestar account. Follow the WireGuard guide and UniFi instructions; check your model and firmware for client support.

Default L2TP/IPsec clients need a compatibility check. MikroTik automatic settings and older built-in Apple or Windows L2TP/IPsec clients may propose algorithms this service does not accept. Their stock settings have not been qualified by Lodestar. Use the supplied IKEv2 profile on iPhone, iPad and Android; confirm router support for the encryption settings above before ordering.

These vendor-supported client modes are configuration starting points. They do not mean every router model or firmware has been tested by Lodestar. Contact hello@lodestarnetworks.co.uk with your model, firmware, provider and intended use if you need confirmation.

After connecting

Check your connection

  1. Confirm your address. Use an IPv4 address-check service from the device or LAN whose traffic you routed into the tunnel. It should show the static IPv4 in your Lodestar account.
  2. Confirm the tunnel. For WireGuard, check the recent handshake and increasing traffic counters while using the connection. For IKEv2 and L2TP/IPsec, check an active IPsec connection. Plain L2TP provides no tunnel encryption.
  3. Test inbound access separately. For a LAN server, allow only the required application ports in your router's firewall and NAT rules. Replies must return through Lodestar. Test from another internet connection, not the same LAN.
  4. Try a reconnect. Check recovery after disconnecting and reconnecting before relying on remote access. Keep an independent way to manage the router while changing routes.

A VPN on a phone connects that phone; it does not automatically publish a server on your home LAN. A router connection needs deliberate routing, firewall and port-forwarding rules.

Troubleshooting & sources

If it will not connect

  • Check that the service is active, that you used the tunnel credentials and that another device is not already connected.
  • Check the device's date/time, exact server identity and certificate trust. If a client requires a CA, use Certificate help in your signed-in account, download the supplied public CA and compare its SHA-256 fingerprint with the account page. Do not turn off certificate verification or enable global certificate trust to bypass an error.
  • Try a different access network. WireGuard needs UDP access to the endpoint and port in your personal configuration. IPsec normally needs outbound UDP 500/4500 and replies. Plain L2TP uses public UDP 1701. There is no TCP 443 fallback; working web access alone does not prove the VPN traffic is allowed.
  • If only some traffic works, review MTU, DNS, route selection and IPv6 behaviour. Your plan is a speed ceiling; it cannot increase the speed of the underlying connection.

For support, share your device model, operating-system/firmware version, selected protocol and the error text. Remove passwords, shared secrets and personal profile contents from screenshots.

Vendor documentation

Compare plans and service details or start your L2TP order. Existing customers can sign in to their account for private connection details and profiles once their service is active.