Setting up L2TP/IPSec VPN connection to Windows server

[LemonadeLlama]

Hey everyone. Does anyone here have any experience setting up L2TP/IPSec VPN connections on Gentoo? I've done it on Manjaro before using a NetworkManager plug-in. I'm not using NetworkManager on Gentoo though.

My work allows employees to connect to the office network with an L2TP/IPSec VPN connection. I know there's an article on the arch wiki on setting this up, and it says you can use xl2tpd and openswan if you don't have NetworkManager: https://wiki.archlinux.org/title/Openswan_L2TP/IPsec_VPN_client_setup

I could only see StrongSwan and Libreswan in the Gentoo package list though, not openswan, so I'm not sure the Arch guide will translate 100% to Gentoo.

Does anyone know the best way to achieve an L2TP/IPSec connection?

[salahx]

Many years ago, I wrote an article on how to set up a IPSec/L2TP server for Linux: https://wiki.gentoo.org/wiki/IPsec_L2TP_VPN_server (it could use a update, ipsec-tools is dead and some of the instructions are out of date). Configuring a client is even easier. The basic concepts are covered, so its a good starting point.

[LemonadeLlama]

Alright, so I tried using the wiki in addition to a guide I found for Ubuntu (guide is https://howto.lintel.in/configure-ipsecl2tp-vpn-clients-linux-cli/), and I think I'm almost there.

I've installed strongswan and xl2tpd, and configured them, but here's as far as I got:

[salahx]

It could be a a few things. Depending on whether or not your server requires certificate or a PSK, it might be missing (or not in the right place). Second, if you are talking to a Windows server, it might only support weak encryption. Try adding ike=aes-sha1-modp1024 and if that helps.

You might want to try net-analyzer/ike-scan to get an idea of what the server is looking for.

[LemonadeLlama]

[salahx]

Aha! That's clues were looking for. It expects 3des-sha1-modp1024, and it expects a preshared key. So if you;re using strongswan, lets use the new configuration instead of the old:
Create the missing directory:

[LemonadeLlama]

I think we're almost there.

I added the swanctl file like you asked, and here's what happened:

[salahx]

OK, so now its choking on the ESP proposal, let's try this:

[LemonadeLlama]

That's better. but now there's some kind of kernel issue. I'll investigate what I need to change in my config.

[LemonadeLlama]

Alright, I've checked my kernel config according to Strongswan's website, to make sure I didn't miss any modules (they're listed at https://wiki.strongswan.org/projects/strongswan/wiki/KernelModules).

I still can't get a connection.

[salahx]

You're probably missing 3des support in the kernel

[LemonadeLlama]

[salahx]

Its still got a problem with the ESP connection. Try this:

Try this:

[LemonadeLlama]

I enabled logging and changes the settings as you said. It generated a lot of log information.

Here's what my output looks like now:

[salahx]

Ok, after some experimenting i have some idea what the problem might be. I screwed up the original configuration, local_ts should be remote_ts (on server. its local_ts. But on the client it has to be flipped). So it should really be this:

[LemonadeLlama]

No luck so far.

If it helps, I can get a working connection on my laptop running Manjaro, using the networkmanager-l2tp plugin. I am trying to work out how to copy the configuration from the laptop to my Gentoo PC, since the laptop is using networkmanager and the PC is using strongswan directly.

Looking at the log output of both computers, here's the point where the PC fails the connection

[salahx]

Probably you need to do something like this: