Howto l2tp/IPsec VPNServer (PSK MS-Chap for now)

[dashnu]

There is a bug on bugs.gentoo. Downgrade gawk to sys-apps/gawk-3.1.3-r2 or patch.

http://bugs.gentoo.org/show_bug.cgi?id=94681
_________________
write quit bang

[dtmf]

How would I go about downgrading or getting the patchs. The patchs sound like the best option, any help would be great.

[dashnu]

if you are not sure how to patch just do this for now..

[dtmf]

That worked now I have a new problem. Not sure how to fix it.

[dashnu]

post your ipsec.conf
_________________
write quit bang

[dtmf]

[Henning Rogge]

Can I use this documentation without a fixed IP ?

[dashnu]

Try to take out the following..

[dtmf]

for the ipsec.sercets file I have

[dashnu]

try your external ip instead of 0.0.0.0
_________________
write quit bang

[dtmf]

I tried it with my internal ip address then tried to connect from in side my network. Still have the same problem.

[dashnu]

you can not do that. The virtual private lines says not to allow that. This is needed. You need to test externaly.

[dtmf]

Oh ok. I will have to test then when I am on a internet connection out side of my network. I will let u know how that goes when I do that.

[Henning Rogge]

[Overpeer]

Hi!!

I'm trying to config a VPN with this great HOWTO.

I have :

|MyWinClient@192.168.15.102|---192.168.15.X/24 ---|Router|---81.202.x.x---|Internet|---80.33.x.x---|Router|---192.168.1.x/24---|GentooBox@192.168.1.88|---10.0.0.0/24(SecureNetwork)

I can conect to VPN on Gentoo Box from 192.168.1.9 and access to secure net 10.0.0.0 without problems, but... i can´t connect from MyWinClient with same configuration

I modified de registry value for NAT-T, and indicate NAT-T in my ipsec.conf. I maped the ports 500,4500 and 1701 to my gentoo box.

[dashnu]

Change your virtual private line add your internal subnet with a "!". Mine is 192.168.1.0/24 so I have a

[Overpeer]

Thanks, now try.

[khuongdp]

I follow the tutorial and got it working in some way. My network is like this


client(192.168.0.4)<-->(192.168.0.1)Router(x.x.x.x)<-->Internet<-->(x.x.x.x)Router(192.168.0.1)<-->(192.168.0.2)Firewall/dhcp(192.168.10.1)
<----->(192.168.10.2)Client1
<----->(192.168.10.3)Client2
<----->(192.168.10.4)Client3

Both the client and server is behind nat.

I can connect to the vpn and ping/ssh to my firewall/dhcp machine. But when I try to ping/ssh Client1-3 I get a timeout. I am fine ping/ssh to client1-3 through my Firewall/dhcp machine.

I think it's somthing wrong with my iptables rules

[dashnu]

My chains. (I use a DROP all f-wall and create special rules for my vpn users.)

INPUT extif

[johnny_martins00]

Does anyone know howto setup a vpn using this protocol, l2tp/ipsec, but with 2 machines working on linux, gentoo ofcourse .
Thk

[dashnu]

be more specific, run ipsec on a machine l2tpd on another?? no idea what you mean.
_________________
write quit bang

[johnny_martins00]

using the protocol ipsec/l2tp, on 2 unix machines. usually its the server machine unix and the client side windows, but i was wonder if its possible to apply the protocol on 2 unix machines??
Thk

[dashnu]

I think it is possible to do that but why? Just use a straight ipsec conn using RSA keys. Tons of Documents on the web for that.
_________________
write quit bang

[Lex_Brugman]

I've got a gentoo box directly connected to the internet running shorewall as router, my internal network is in the 10.0.0.0 range and my gentoo box has 10.0.0.1 as his internal ip, the external ip will be referred to as 123.123.123.123 and the client as 321.321.321.321.

But if i try to connect with a winxp client after following this guide /var/log/messages reports the following:

[dashnu]

I do not use shorewall but it looks to me as if you are blocking 1701udp which is l2tpd.

also in you virtual_private line you want to exclude your network.

local ip = 10.0.0.1 in l2tpd.conf should be changed to an unused IP address that your l2tpd can claim.

You could trim down you ipsec.conf also.