L2TP service is live / From £3.50 a month
Lodestar L2TP gives your home network a static public IPv4 without changing broadband provider. Both plans support WireGuard, IKEv2, compatible L2TP/IPsec and plain L2TP with explicit unencrypted opt-in. Use a compatible router or device for remote access, self-hosting or a way out of shared CGNAT.
L2TP service is live and ready to order. Choose your plan, create or sign in to your account, verify your email and complete checkout. After payment is confirmed, we email your order confirmation and activate your service.
Choose your plan
Every plan includes one static public IPv4, unmetered data and one active tunnel. Keep your existing internet connection and choose the speed ceiling that suits your setup.
£3.50per month, monthly rolling
Up to 500/500 Mb/s
For home networks, self-hosting and everyday use.
Speed depends on your router, connection and network conditions.
£4.50per month, monthly rolling
Up to 1000/1000 Mb/s
For faster access lines and capable network equipment.
Check your equipment compatibility.
These are the total monthly prices. Lodestar is not currently VAT registered, so no VAT is added. Your existing internet connection and any equipment are separate. IPv6 is not included. Read the connection guides and service terms before ordering.
No monthly data allowance or usage top-ups. Your plan sets a maximum rate in each direction. Actual speeds depend on your connection, equipment and network conditions.
The tunnel runs over your existing broadband or mobile internet. It cannot increase that connection's speed or fix poor Wi-Fi, congestion or dropouts on the underlying line.
How it works
Once activated, your compatible router or device connects to Lodestar through your existing provider. Traffic sent through the tunnel uses the static public IPv4 assigned to your subscription.
Your public address
Each subscription includes one static public IPv4 for use through one active tunnel. A compatible router can share that address across your devices using its own NAT and port-forwarding settings.
Use your address for a home server, remote-management connection or other agreed service. Your tunnel must be connected, and your firewall, application and any port-forwarding rules must permit access. Check suitability for your intended use before ordering.
Your address stays the same through ordinary reconnections while your service remains active. It is supplied as part of the subscription. These plans include a single IPv4, with no IPv6 prefix, routed IPv4 subnet or BGP service.
Choose the right connection
Both plans offer WireGuard, IKEv2, compatible L2TP/IPsec and plain L2TP with explicit unencrypted opt-in. Select one connection method in your account. Switching methods keeps your public IPv4, plan price and billing date. One connection method can be active at a time.
A username and password authenticate the connection; they do not encrypt its traffic. Plain L2TP is an explicit unencrypted choice. Use HTTPS and other application encryption to protect sensitive information.
WireGuard, IKEv2 and compatible L2TP/IPsec encrypt traffic between your device and Lodestar. WireGuard uses personal keys; IKEv2 uses your tunnel credentials and a verified server certificate. Keep private keys and credentials secure. Application encryption still protects traffic beyond the Lodestar gateway.
Practical limits
All advertised speeds are up to the plan ceiling. Actual performance depends on your access connection, router processing, protocol and network conditions. A minimum speed or dedicated circuit is not included.
A router with gigabit Ethernet may process a tunnel more slowly, especially with encryption. The 1000 plan requires compatible equipment; it does not guarantee simultaneous gigabit upload and download.
NAT, CGNAT and access-network filtering can affect tunnel setup and stability. Some networks block the required UDP traffic. The service has no TCP 443 fallback, so working web browsing alone does not establish compatibility.
Tunnel overhead may require a smaller MTU on your router. Restarts, network changes and idle timeouts can interrupt a connection and require it to reconnect.
This internet tunnel service has no availability SLA. If you need a critical connection, keep an independent way to reach your equipment.
Plan your setup
You will need an existing internet connection and a compatible router or device. Support varies by exact model, firmware and tunnel mode; these are the details to check before ordering.
Use the supplied encrypted IKEv2 profile with your activated service. Follow the iPhone and iPad setup guide and use your personal connection details from your account.
Import your supplied strongSwan IKEv2 profile into the strongSwan VPN Client app. Follow the Android setup guide; built-in VPN options vary by Android version and manufacturer.
Both plans support WireGuard with a personal configuration for a compatible client. This includes current UniFi gateways with a WireGuard VPN Client, as well as other supported routers and the WireGuard apps. Read the WireGuard guide and UniFi setup steps. Check the exact model and firmware for the client mode.
Your provider, whether you use fixed broadband or mobile data, and the upload and download speeds you normally receive.
Choose a speed ceiling suited to your line and equipment. Consider whether you need an encrypted profile and which services you want to reach through the public IPv4.
Set up iPhone, iPad, Android, Linux or a compatible router. Read the public connection fields now; your private credentials and personal profile downloads are available in your account when your service is activated.
Get connected
Choose your plan and create a Lodestar account. Verify your email, complete checkout and retrieve your connection details once your service is active.
Email hello@lodestarnetworks.co.uk. Creating an account does not start a paid subscription. Contact us before ordering if you need help choosing compatible equipment.
Further reading
WireGuard clientsOfficial WireGuard apps and supported operating systems.
UniFi WireGuard VPN ClientUbiquiti gateway client configuration and routing.
RFC 2661Layer Two Tunneling Protocol version 2, including UDP transport and the limits of L2TP security.
RFC 3193Securing L2TP using IPsec, including packet protection and MTU considerations.
RFC 4301The IPsec security architecture.
RFC 7296IKEv2 negotiation and the creation of IPsec security associations.
RFC 3947NAT detection and negotiation for IKE.
RFC 3948UDP encapsulation of IPsec ESP through NAT, including multiple-client considerations.
RFC 3715IPsec and NAT compatibility requirements.
RFC 7383Fragmentation of IKEv2 control messages, distinct from data-path fragmentation.
RFC 4459MTU and fragmentation considerations when tunnelling network packets.
strongSwan forwarding guidancePath MTU and TCP MSS behaviour for forwarded IPsec traffic.
Linux XFRM offloadWhy IPsec processing cost and hardware support can materially affect throughput.
Apple VPN overviewCurrent Apple deployment support and configuration boundaries for IKEv2 and L2TP/IPsec.
Microsoft VPN protocol guidanceCurrent server-side guidance and the legacy position of L2TP for new Windows RRAS deployments.
Android VPN documentationAndroid's platform distinction between current VPN APIs and legacy built-in VPN clients.