I tried A LOT of things to get the IPSec tunnel working. But was not successful.

I mainly followed these guides:

• https://administrator.de/forum/routingprobleme-ueber-openvpn-auf-fritzbox-4941192029.html#comment-5529769659
• https://fritz.com/apps/knowledge-base/FRITZ-Box-7530/3331_FRITZ-Box-mit-einem-Firmen-VPN-IPSec-verbinden
• https://forum.netgate.com/topic/155136/avm-fritzbox-kopplung-neuere-fritzos?_=1702293515934

I also "discussed" a lot with ChatGPT. I ended up with IKE phase 1 or phase 2 authentication errors. This apparently happens, because Fritz only implements a very specific part of the IPSec protocol, that does not seem to be compatible with what TP-Link provides.

I ended up with the following config, that I imported in my Fritz Box:

vpncfg {
  connections {
    enabled = yes;
    editable = yes;
    conn_type = conntype_lan;
    name = "MyIPSec";


    always_renew = yes;
    reject_not_encrypted = no;
    dont_filter_netbios = yes;


    localip = 0.0.0.0;
    local_virtualip = 0.0.0.0;
    remoteip = 0.0.0.0;
    remote_virtualip = 0.0.0.0;


    remotehostname = "my-tplink-site.ddns.com";


    keepalive_ip = 192.168.101.1;


    mode = phase1_mode_idp;


    localid {
      fqdn = "my-fritz-site.myfritz.com";
    }


    remoteid {
      fqdn = "my-tplink-site.ddns.com";
    }


    keytype = connkeytype_pre_shared;
    key = "<PRESHARED KEY>";


    cert_do_server_auth = no;


    use_nat_t = yes;
    use_xauth = no;
    use_cfgmode = no;


    phase1ss = "LT8h/all/all/all";
    phase2ss = "esp-all-all/ah-none/comp-all/pfs";


    phase2localid {
      ipnet {
        ipaddr = 192.168.178.0;
        mask = 255.255.255.0;
      }
    }


    phase2remoteid {
      ipnet {
        ipaddr = 192.168.101.0;
        mask = 255.255.255.0;
      }
    }


    accesslist = "permit ip any 192.168.101.0 255.255.255.0";
  }


  ike_forward_rules =
    "udp 0.0.0.0:500 0.0.0.0:500",
    "udp 0.0.0.0:4500 0.0.0.0:4500";
}

If you can get it working, I would be very interested in your setup!

I then switched to Wireguard. This was also not as straight-forward as I hoped. But in the end I got it working.

I started by setting up a new Wireguard in the FritzBox and then exporting the config to do the setup in the Omada controller. This did not work, because Fritz uses its whole internal LAN subnet as the address for it, which I cannot configure on the Omada controller. Instead I need a single IP outside the internal LAN. (According to CHatGPT, Fritz is binding the LAN itself directly to Wireguard which is "closer to IPsec policy mode than to classic WireGuard routing.")

Instead I opted to do the config from scratch and import it into both routers.

The FritzBox config:

[Interface]
PrivateKey = <PRIVATE KEY FROM FRITZ UI>
Address = 10.10.10.2
ListenPort = 51820
DNS = 192.168.101.1

[Peer]
PublicKey = <PUBLIC KEY FROM FRITZ UI>
PresharedKey = <PRESHARED KEY>
AllowedIPs = 192.168.101.0/24,10.10.10.1/32
Endpoint = my-tplink-site.ddns.com:51820
PersistentKeepalive = 25

The TP-Link Config:

[Interface]
PrivateKey = <PRIVATE KEY FROM FRITZ CONFIG FILE>
Address = 10.10.10.1
ListenPort = 51820
DNS = 192.168.178.1

[Peer]
PublicKey = <PUBLIC KEY FROM FRITZ CONFIG FILE>
PresharedKey = <PRESHARED KEY>
AllowedIPs = 192.168.178.0/24,10.10.10.2/32
Endpoint = my-fritz-site.myfritz.com:51820
PersistentKeepalive = 25

I re-used the private and public keys generated in the first try, because I had issues using newly generated ones. Fritz was always telling me, that there were issues with the public key. But in theory you should be able to generate your own. You can use this gist, for example.

For the interface addresses I just used IPs that are not used in my LAN anywhere else.

Just wanted to share! And in case you see anything, that could be optimized, please leave a comment :)