Route10 Configuration from Alta Control

1. Log in to manage.alta.inc, or use your local Control address (version 1.0j or later is required for local Control instances).
2. Navigate to the Network section.
3. Open the configuration card for your Route10 by selecting its icon.
4. Switch to the VPN tab and open the IPSec Server settings.
   • Toggle Enable to turn on the VPN.
   • Set the Mode to IKEv2 using the dropdown menu.
   • Enter your desired subnet (e.g., 192.168.42.1/28).
   • Optionally, specify custom DNS servers.
   • Leave IPSec ID blank for now, as this will be used when custom certificates are supported in the future.
   • Save your configuration.
     
5. Find the dynamic hostname generated for your VPN server in the VPN settings:
   • Double-click the full hostname found beside Certificate, and right click or press Ctrl + V to copy it  (e.g., 28ip6hy5z93.k72v8qx1n54.ddns.manage.alta.inc).
   • Use this hostname as the remote ID or IPSec ID when configuring VPN clients.
6. Navigate to the Auth tab, toggle Enable on, and click Save. If Auth is already enabled and users are populated, skip this step and step 7.
7. Add a user:
   • Select Add User.
   • Enter the username and password.
   • Leave WiFi VLAN and IPSec VPN IP blank unless you know their purpose.
   • Repeat for as many users as desired, then save your changes.
     
     Note: Users in Auth are intentionally limited to one active session. Each client device connecting to the VPN requires its own user profile. A comprehensive article on the authentication server is forthcoming, and this article will be updated to include a reference once it becomes available.

Client Configuration

Note: The client configuration steps below use an example hostname. Please be sure to replace the example hostname with the actual hostname from your site, as using the example will result in failure. It is found beside Certificate as mentioned above in step 5.

Windows 11

1. Click Start → Settings → Network & Internet → VPN.
2. Click Add VPN.
3. Fill out the following information:
   1. VPN provider: Windows (built-in).
   2. Connection name: Route10 VPN (or any name you prefer).
   3. Server name or address (DDNS address): 28ip6hy5z93.k72v8qx1n54.ddns.manage.alta.inc
   4. VPN type: IKEv2.
   5. Type of sign-in info: Username and password.
   6. Username: Enter your username
   7. Password: Enter your password
4. Click Save.
5. Back in the VPN settings, click Connect next to your Route10 VPN.

macOS

1. Click System Settings on the dock, or go to the Apple icon in the top-left and select System Settings.
2. Navigate to VPN. (If VPN isn’t present, go to System Settings>Network, and then in the lower right click the … menu)
3. Choose Add VPN Configuration….
4. Select IKEv2.
5. Fill out the following information:
   1. Display name: Route10 VPN (or any name you prefer).
   2. Server address: 28ip6hy5z93.k72v8qx1n54.ddns.manage.alta.inc
   3. Remote ID: 28ip6hy5z93.k72v8qx1n54.ddns.manage.alta.inc
   4. User authentication: Username
   5. Username: Enter your username
   6. Password: Enter your password
6. Click Create.
7. Toggle the connection beside your new VPN profile in the VPN menu to connect.

Ubuntu Desktop (24.04.1 or similar)

1. Open the Terminal and run:
   sudo apt update && sudo apt install -y strongswan network-manager-strongswan libcharon-extra-plugins

2. Exit the terminal.
3. Open Settings → Network (click Network on the left if not loaded by default).
4. Click the + symbol next to VPN.
5. Choose IPSec/IKEv2 (strongSwan).
6. Fill out the following information:
   1. Name: Route10 VPN (or any name you prefer).
   2. Server Address: 28ip6hy5z93.k72v8qx1n54.ddns.manage.alta.inc
   3. Server Identity: 28ip6hy5z93.k72v8qx1n54.ddns.manage.alta.inc
   4. Client authentication: EAP (Username/Password)
   5. Username: Enter your username
   6. (Optional) Beside the password field, click the question mark to choose whether the password is saved for the current user or all users. If enabled, enter password to save.
   7. Enable Request an inner IP address.
   8. (Optional) Enabling Enforce UDP encapsulation can improve compatibility, particularly in NAT Traversal (NAT-T) scenarios, but may not be necessary in all environments.
7. Click Add.
8. Toggle the VPN connection in Settings, or use the control center in the top-right corner.

Android

Native System Client

1. Go to Settings → Connections → More Connection Settings → VPN.
2. Tap the menu (top-right) and select Add VPN Profile.
3. Fill out the following information:
   1. Name: Route10 VPN (or any name you prefer).
   2. Type: IKEv2/IPSec MSCHAPv2
   3. Server address: 28ip6hy5z93.k72v8qx1n54.ddns.manage.alta.inc
   4. IPSec identifier: 28ip6hy5z93.k72v8qx1n54.ddns.manage.alta.inc
   5. Username: Enter your username
   6. Password: Enter your password
4. Tap Save.
5. Tap the VPN and click Connect.

Alternate Client: strongSwan

1. Download the strongSwan client from the Play Store.
2. Open the app and allow permissions.
3. Tap Add VPN Profile.
4. Fill out the following information:
   1. Server: 28ip6hy5z93.k72v8qx1n54.ddns.manage.alta.inc
   2. VPN Type: IKEv2 (Username/Password).
   3. Username: Enter your username
   4. Password: Enter your password
   5. Profile name: Route10 VPN (or any name you prefer).
5. Tap Save.
6. Tap the VPN to connect.

iOS/iPadOS

1. Go to Settings → VPN (or General → VPN & Device Management → VPN if no profiles exist).
2. Tap Add VPN Configuration….
3. Select IKEv2 as the type.
4. Fill out the following information:
   1. Description: Route10 VPN (or any name you prefer).
   2. Server: 28ip6hy5z93.k72v8qx1n54.ddns.manage.alta.inc
   3. Remote ID: 28ip6hy5z93.k72v8qx1n54.ddns.manage.alta.inc
   4. User authentication: Username
   5. Username: Enter your username
   6. Password: Enter your password
5. Tap Done.
6. Select the VPN in the list and toggle the connection on.

Optional (Advanced users only): Add the Root CA for Certificate Verification

1. Obtain the .pem file for the root CA (e.g., Let’s Encrypt ISRG Root X1).
2. Follow the respective OS instructions to install the certificate.
3. Set it as the CA certificate for validation.