Establishing a client-to-gateway IPSec tunnel with Shrew Soft VPN client behind a router or NAT firewall

Linksys Gigabit VPN Routers have a client-to-gateway VPN tunnel feature with some VPN client software such as TheGreenBow, SafeNet, Shrew Soft, and IPSecuritas.   To accomplish this setup, your VPN router or server must be on a different LAN IP Address than your home routers, like the illustration below.  

User-added image

Before configuring your VPN client software, make sure that your router is configured for client-to-gateway IPSec group VPN tunnel.  For instructions, click here.

The steps below will show you how to establish a client-to-gateway group VPN tunnel using Shrew Soft installed on a computer behind a router or NAT firewall.
Step 1:
Download and install the Shrew Soft VPN client software on your computer.  To download, click here.

Step 2:
Open the Shrew Soft VPN Access Manager and click on Add.
User-added image

Step 3:
Click on the General tab then use or select the following settings:

Remote Host:
  • Host Name or IP Address:  Enter the host name or IP Address from the server.  In the example below, is the server's WAN IP Address.
  • Auto Configuration:  Set to disabled
Local Host:
  • Adapter Mode:  Use an existing adapter and current address
User-added image
Step 4:
Click on the Client tab then enable the NAT Traversal option and use the default settings for the rest of the options.  Click Save.
User-added image
Step 5:
Click on the Name Resolution tab.  Under the DNS and WINS tabs, uncheck the Enable DNS/Enable WINS boxes and then click Save.  
User-added image

Step 6:
Click on the Authentication tab then use the following settings:
  • Authentication Method:  Mutual PSK
  • Local Identity: 
    • Identification Type:  Fully Qualified Domain Name
    • FQDN String:  Enter the domain name used on the server
NOTE:  If you used USER FQDN on the router, select User Fully Qualified Domain Name on the Identification Type then enter the email address.

Click Save.
User-added image
Step 7:
Under Authentication, click on the Remote Identity tab.  Select IP Address for the Identification Type then enter the remote WAN IP Address in the Address String field.  Click Save.  In the example below, the remote WAN IP Address is  
User-added image
Step 8:
Under Authentication, click on Credentials and enter your secret key in the Pre Shared Key field.  Click Save
User-added image
Step 9:
Click on the Phase 1 tab and enter the Phase 1 settings of the router.  Click Save
User-added image
Step 10:
Click on the Phase 2 tab and enter the Phase 2 settings of the router.  Click Save
User-added image
Step 11:
Click on the Policy tab then set the Policy Generation Level to auto.  Then, uncheck both the Maintain Persistent Security Associations and Obtain Topology Automatically or Tunnel All boxes. 
User-added image
Step 12:
Click on Add then the Topology Entry dialogue box will appear.  Set the following settings:
  • Type:  Include
  • Address and Netmask:  Enter the IP Address and subnet mask of the router 
Click on Ok then click Save.  In the example below, the LAN subnet is
User-added image

Step 13:
Click on the Connect icon on the Shrew Soft VPN Access Manager.
User-added image

User-added image 

To verify the connectivity between the computer using Shrew Soft and the network, check the status of following settings:
  • Check if the client-to-gateway VPN tunnel is connected between the VPN router or server and the computers.
  • Check if the computers can ping the local default gateway of the router or server.
  • Check if the computers connected to the VPN tunnel can ping each other.

Was this support article useful?

Additional Support Questions?
Search Again