VPN Client not connecting [SOLVED]

Duco Ergo Sum · Posted: Sat Sep 06, 2014 8:48 pm Post subject:

Well I'm stymied. I have upgraded xl2tpd to 1.3.6 and still no change. I must thank you for all your help. Sadly I'm going have to take this machine off line for a while. I'm not sure how long I hope to get back on line soon and working on this soon. So close but so far!

Again thank you and I'll be back here as soon as I can. I see myself living with out a PC for long... not happily anyway.

All the best.

Duco Ergo Sum · Posted: Mon Sep 22, 2014 1:05 am Post subject:

Hi,

I have my PC back.

Prior to my hiatus, I suspect that I may have been the architect of my PPP problems. Once we got IPSEC working, thought it'd be a good idea to set iptables rules to block all l2tp connection outside the ipsec layer and thus used:

salahx · Guru Joined: 12 Mar 2005 Posts: 530

Strange because my iptables rules work (both client and server):

Duco Ergo Sum · Posted: Mon Sep 22, 2014 8:36 am Post subject:

Thanks,

salahx · Guru Joined: 12 Mar 2005 Posts: 530

Ok so its not a routingh problem. Since its been a while, the latest output of xl2tpd/pppd would be helpful to determine if we're dealing with the same problem. I'll also adjust my simulation at home to make the VM i created for that have a similar network setup to yours to see if that's what's causing it.

Duco Ergo Sum · Posted: Tue Sep 23, 2014 12:02 am Post subject:

Hi

Thanks for persevering with me. Here is a copy of the logs and the output:

Duco Ergo Sum · Posted: Tue Sep 23, 2014 7:54 am Post subject:

The only other information I can think of which might be pertinent is that my system has at least three NICs.

The first appears as eno0

The second and third are not used. One of these is Wifi.

salahx · Guru Joined: 12 Mar 2005 Posts: 530

Well, after running a few simulation, I can't get it to disconnect, even with a similar network setup. Looking at the logs, the problems appears to be at the l2tp layer - soon after the connection the connection, the other side of the tunnel stops responding and the l2tp connection gets dropped. Since we know ipsec works and ppp seems fine, i'm beginning to think the problem here is l2tp.

There is an (undocumented) option to turn off kernel l2tp for xl2tp:

Duco Ergo Sum · Posted: Tue Sep 23, 2014 9:31 am Post subject:

Hi,

When I set:

salahx · Guru Joined: 12 Mar 2005 Posts: 530

It shouldn't give that error. It works for me. Check the syntax of your xl2tpd.conf file. Its gonna be a day or so before i can setup another l2tp client as the Gentoo webservers are down:

It should look something like this:

Duco Ergo Sum · Posted: Wed Sep 24, 2014 7:32 am Post subject:

You're right.

When I copied and pasted to the config file, I missed the '[global]' statement. I was in a rush. Apologies.

Testing again now with the correct syntax. xl2tpd does run but there is no change. The logs are identical.

This might be infomative - http://serverfault.com/questions/550377/strongswan-xl2tpd-client-timeout-between-2-5-minutes

salahx · Guru Joined: 12 Mar 2005 Posts: 530

Oki then lets try it with openl2tp then. You'll need the "rpc" USE Flag set as well. If you as using systemd, grab its unit file. Systemd users are need to start rpcbind manually. Either way, start the openl2tpd service.

Once the service is started, run the "l2tpconfig" utility:

Duco Ergo Sum · Posted: Thu Sep 25, 2014 8:39 am Post subject:

A quick update:

# l2tpconfig

Duco Ergo Sum · Posted: Fri Sep 26, 2014 11:27 pm Post subject:

Hi

I have attempted to follow your example as closely as possible however still fail to get a connection or even a ppp0 interface.

salahx · Guru Joined: 12 Mar 2005 Posts: 530

It appears the ipsec connection is down. Bring back up the ipsec connection and try again.

Duco Ergo Sum · Posted: Sat Sep 27, 2014 10:35 pm Post subject:

The IPsec appears to remain up:

salahx · Guru Joined: 12 Mar 2005 Posts: 530

StrongSwan doesn't do lt2tp (It has a NetworkManager plugin but only for IKEv2). Lets make sure the tunnel is getting established. AFter you create the tunnel, before the session, do a "show tunnel ..." command verify the tunnel sayas ESTABLISHED. IF not, we need to debug the tunnel first.

Duco Ergo Sum · Posted: Sun Sep 28, 2014 12:09 am Post subject:

Unfortunately, I don't seem to be able to establish a tunnel.

salahx · Guru Joined: 12 Mar 2005 Posts: 530

May bad. Its "tunnel show .... " not "show tunnel ..." (There's a "tunnel list" command as well, to see all the open tunnels).

salahx · Guru Joined: 12 Mar 2005 Posts: 530

Actually, I notice above in the status no traffic was flowing over the ipsec connection. The same thing happens here too - Once I put up the l2tp firewall, it stopped working. It turns out openl2tp works differenty with respect to the source port. xl2tps used port 1701, but openl2tp chooses a random one. The ipsec rule we have set up only work when both the source AND destination ports are 1701.

So at this point, we can fix this one of 2 ways:

1) Adjust your ipsec connection:

Duco Ergo Sum · Posted: Sun Sep 28, 2014 7:35 am Post subject:

Old IPsec connection

salahx · Guru Joined: 12 Mar 2005 Posts: 530

Didn't work, the server modified it:

Duco Ergo Sum · Posted: Sun Sep 28, 2014 11:00 pm Post subject:

Looking on the bright side. We now have the Established state. Unfortunately, as far as I can tell we're getting the same behaviour as with xl2tp.

salahx · Guru Joined: 12 Mar 2005 Posts: 530

OK, verify neither the session nor the tunnel go down by itself after a few seconds (The other end might time out after 15-30 minutes of idleness, so that's ok). If the tunnel stays up then its a network configuration problem.

If the tunnel is stable, try the "tracepath" and/or "traceroute" utility and see if data is crossing the tunnel. Ping the other end of the tunnel. Use the "tcpdump -i eno1 proto 50" and "tcpdump -i ppp0" and verify you see traffic (you met get the "ret: -1" thing, i get too, but it should still work)

Duco Ergo Sum · Posted: Sun Sep 28, 2014 11:33 pm Post subject:

No traffic pass through the tunnel and then it disappears after less than a minute. After which to create an established tunnel, I need to restart ipsec and openl2tpd.