Connect your device

Start with your private connection details

In My account, wait for Active, confirm your account password and choose View tunnel credentials. That page supplies Server, IKEv2 Remote ID, Local ID, tunnel username/password, public IPv4, DNS, MTU and the separate L2TP/IPsec secret. Your website password is not your tunnel password.

For WireGuard, use the supplied public IPv4/32 from the downloaded file. IKEv2 and L2TP assign the public address automatically. Leave client address assignment automatic; do not put it on your broadband WAN or ordinary LAN. Keep the original WAN route to the VPN server.

Open the complete device and router guide

WireGuard is supported on every plan

Choose WireGuard in My account, confirm your account password and wait for Active. Download your private WireGuard configuration from your account. Your plan, allocated public IPv4 and service end date stay the same.

1. Install the official WireGuard client, or open your router's outbound WireGuard client.
2. Import Lodestar-WireGuard.conf. Keep this file private because it contains your client private key. Use one device at a time.
3. Keep the supplied server endpoint, keys, public IPv4/32 and MTU1400. Turn off your previous Lodestar VPN before connecting.
4. Connect, check that your outbound public IPv4 matches your account, then test Lodestar Speed Test. Check your separate IPv6 settings because the supplied profile routes IPv4 only.

iPhone, iPad and Android

Open the WireGuard app, add a tunnel and choose the downloaded file. Approve the device's VPN permission and enable the tunnel. WireGuard uses the keys in this file, not your Lodestar account password or L2TP password.

Linux and ARM

Use your distribution's WireGuard and NetworkManager packages where available. Import the file through the network settings. For wg-quick, rename the download to lodestar.conf and place it at /etc/wireguard/lodestar.conf, owned by root with mode 0600. The short name fits Linux interface limits. Start with sudo wg-quick up lodestar and stop with sudo wg-quick down lodestar. DNS integration depends on your distribution. Keep console or alternative access when changing a remote server's default route.

UniFi and other compatible routers

On a supported UniFi gateway, open VPN Client, choose WireGuard and import the configuration. Add a Traffic Route for the devices that should use it; importing a VPN does not route every LAN device automatically. For a LAN server, configure the required inbound firewall and port forwarding, with replies routed through this tunnel. Router management should remain private.

Use the original broadband WAN to reach the supplied UDP51821 endpoint. Throughput depends on the device, its software and your existing connection. An established WireGuard handshake does not confirm LAN forwarding or inbound service reachability.

Connect with the built-in VPN client

The Apple configuration contains your username and the expected server identity. You enter your tunnel password on the device; it is not stored in the download.

1. From an active account, download the Apple profile in Safari.
2. Open Settings, then General > VPN & Device Management. Review and install the downloaded Lodestar profile.
3. Enter your tunnel password when asked. It is separate from your website password.
4. Connect the Lodestar IKEv2 VPN and check that your public IPv4 matches your account.

This is a downloadable configuration profile, not device-management enrolment. Apple may mark the profile itself as unsigned. Review its origin and contents; VPN server certificate verification must remain enabled. Use a current iOS/iPadOS version.

Use strongSwan or native IKEv2

The strongSwan app offers a consistent setup across supported Android devices. The downloaded profile sets the exact server identity and uses trusted certificate authorities.

Some Android VPN clients require a CA certificate. If setup asks for one, sign in to download it from Certificate help and select it for this VPN connection. Keep server identity verification enabled for l2tp.lodestarnetworks.co.uk. Your tunnel username and password are still required.

1. Install the official strongSwan VPN Client.
2. Download your Android profile and open it with strongSwan, or use the app's profile import option.
3. Enter your tunnel password and accept Android's request to create a VPN connection.
4. Connect and verify the public IPv4 shown in your account.

The profile blocks IPv4 and IPv6 traffic outside the negotiated tunnel while connected. This does not provide an always-on guarantee when the VPN is disconnected. Do not assume VPN traffic is shared with tethered devices.

Debian, Ubuntu and Raspberry Pi OS

Use Linux strongSwan with IKEv2 and EAP-MSCHAPv2. A desktop can use the NetworkManager strongSwan plugin; a headless machine can use the interactive charon-cmd client. Both require a verified server certificate for l2tp.lodestarnetworks.co.uk and your tunnel username/password. Do not import the Android .sswan profile into Linux.

Open your active service in My account, confirm your website password and choose View tunnel credentials. The private Linux section supplies the complete settings and a terminal command with your own tunnel username. It does not put your password into a download or URL.

Use a supported release with kernel IPsec/XFRM support. Debian and Ubuntu provide ARM packages, and current Raspberry Pi OS is Debian-based, but individual boards, images and kernel builds have not all been tested. Make the first full-tunnel connection from a local console or with recovery access. The guide covers IPv4 routing, DNS, IPv6 limits and clean disconnection before unattended startup is considered.

MikroTik routers

RouterOS has an outbound L2TP client with optional IPsec. Use a supported RouterOS release and take a configuration backup before changing routes.

L2TP/IPsec requires explicit modern proposals: IKEv1 with AES-128 or AES-256 CBC, SHA-256 and DH group 14 (MODP2048); ESP transport with AES-128 or AES-256 CBC and SHA-256. RouterOS automatic IPsec settings may use SHA-1/DH group 2 and fail. Configure a dedicated compatible IPsec profile and proposal for this connection as required by your firmware; follow the complete device guide before connecting.

1. Add an L2TP Client under PPP Interfaces.
2. Set Connect To to the endpoint supplied in your account. Enter your tunnel username and password.
3. Set Max MTU and Max MRU to 1400. For L2TP/IPsec, enable Use IPsec and enter the private IPsec shared secret from your account. For explicitly enabled plain L2TP, leave IPsec off.
4. Leave Add Default Route off for the first connection test. Keep a route to the tunnel endpoint through your existing WAN. Use peer DNS, or 1.1.1.1 and 9.9.9.9. Set the LAN routing, firewall and NAT policy for the traffic you intend to send through Lodestar.
5. Confirm the negotiated address and test outbound and intended inbound traffic before moving the rest of your LAN.

Router model, firmware, NAT and IPsec proposals affect compatibility and speed. A configuration guide is not a guarantee of gigabit performance.

OpenWrt routers

OpenWrt offers an xl2tpd package for L2TP. Required packages and LuCI options vary by release and device.

1. Confirm that your supported OpenWrt release provides xl2tpd and has sufficient storage.
2. For plain L2TP, create a client interface using protocol l2tp, your server and tunnel credentials, MTU 1400 and IPv6 disabled. Plain access must first be enabled on your Lodestar account.
3. Keep the endpoint reachable over the original WAN. Configure an appropriate firewall zone, LAN forwarding and NAT for the new interface.
4. Test the assigned address and reconnect behaviour before routing your LAN through it.

xl2tpd alone does not encrypt the tunnel. L2TP/IPsec needs a separately configured IPsec client and a verified compatible configuration. Device-specific configuration and validation are required before deployment.

Use a PPP client interface

The pfSense L2TP client is a PPP/WAN interface. The VPN > L2TP screen configures a server and is not the customer connection screen.

1. Back up your configuration. Open Interfaces > Assignments > PPPs and create an L2TP link.
2. Use the existing WAN as the underlying link and enter the endpoint and tunnel credentials supplied by Lodestar. Set MTU/MRU to 1400 where available; leave the PPP Shared Secret field blank.
3. Assign the new PPP interface, then configure gateway, firewall, routing and NAT policy for the intended LAN traffic.
4. Keep the endpoint route on the original WAN. Confirm that the tunnel receives your assigned public IPv4.

This guide is for explicitly enabled plain L2TP, which is unencrypted. Do not enter the L2TP/IPsec PSK into an L2TP tunnel-secret field; they serve different purposes. L2TP/IPsec client compatibility requires separate qualification.

UniFi and other routers

Check the exact model and firmware for an outbound client that supports the protocol you intend to use. A router's L2TP server screen is not a client.

Current UniFi gateways document WireGuard and OpenVPN clients. Lodestar supports WireGuard on every plan. Select WireGuard in My account, download your private configuration and import it into the UniFi WireGuard VPN Client. Configure a Traffic Route for the intended LAN devices. Apple and strongSwan profiles are for IKEv2 clients. OpenVPN is not supplied.

LAN servers and connection checks

The public IPv4 terminates on your VPN client. To publish a private LAN server, configure the router's specific port-forward/destination-NAT and inbound firewall rule, plus a return route through the Lodestar tunnel. A connected VPN indicator does not establish that LAN forwarding is working. Keep router management private.

Test inbound services from a separate internet connection. Check that outbound public IPv4 matches your account. If small requests work but larger transfers stall, check MTU1400 and path-MTU/ICMP handling. Use the DNS supplied by the tunnel, or 1.1.1.1 and 9.9.9.9. IPv6 is not included; check your device's separate IPv6 routing.

WireGuard uses UDP51821. IKEv2 and L2TP/IPsec normally need UDP500/4500; plain L2TP uses public UDP1701. There is no TCP443 fallback. The complete guide explains routing, NAT and model-specific limits.

Your VPN certificate

A CA certificate helps your device check that it is connecting to the real Lodestar server. It is not your password.

Most devices trust our server automatically. Some Android VPN clients require a CA certificate.

If setup asks for a CA certificate, download it below and select it for this VPN connection. Keep server identity verification enabled.

For IKEv2 only. Plain L2TP and L2TP/IPsec do not need this download.

Know which details to use

Your existing internet connection remains necessary. A tunnel cannot remove congestion or outages on that connection. Router CPU, packet size and encryption also affect throughput.

Downloadable profiles require the gateway to present a certificate issued by an authority your device trusts, matching the supplied server identity. They do not install a new CA or bypass verification.

IPv6 service is not currently promised. Verify IPv6 routing and leak behaviour on your chosen device. The account's address must not be attached to more than one active tunnel.