Howto l2tp/IPsec VPNServer (PSK MS-Chap for now)

Quinny · n00b Joined: 27 Feb 2003 Posts: 38 Location: Netherlands

Any pointers to a Linux client setup?

My VPN server has been working perfect for about one and a half years now, in the beginning I used to have to restart the ipsec daemon periodically, but I fixed that about a year ago. Windows clients can connect, disconnect and reconnect as often as they like, it's really stable.

The only thing is connections aren't dropped soon enough when a connection breaks. For example: wireless lan dies, windows says: VPN connection disabled, but I can't reconnect, because ipsec of l2tp still thinks I'm logged in, so I have to restart the daemon to drop it manually. But I can't do that when other people are using the VPN too, off course...

But I'm going off-topic in my own post, I'd really like to use my Linux laptop as a client for my VPN, any help? Links to documentation?

<edit>

OK, found some documentation, tried it > My VPN server is running openswan 2.3.0, portage currently only has 2.4.4. They don't seem to be compatible, when I try to connect to the server, the server crashes. (something aboud SHA1 being not implemented)
It says it'll restart itself but then doesn't do that because of an error in the script somewhere so I have to restart it manually.

Copied the older version from the server to the client, including patches and stuff, but it won't compile. The other VPN is in production use (the one that crashed) so I'm not even going to try and update that one at the moment (don't know who are using it atm..)

In any case, a linux client for this VPN setup seems harder than it is

dashnu · l33t Joined: 21 Jul 2004 Posts: 703 Location: Casco Maine

I was not able to get this to work, I was pointing the problems at SELINUX though.

Try this type of config for Linux to Linux...

I do not have rights config because I do not have that box anymore.. I was able to make the connection however it seemed the routing was not correct.

plut0 · Apprentice Joined: 21 Dec 2004 Posts: 272

I followed the tutorial at, http://teh.sh.nu/HowTo, but I cannot connect. When I try to connect the client just "hangs". Eventually it times out with this message: "The L2TP connection attempt failed because the security layer encountered a processing error during initial negotiations with the remote computer." OR "The L2TP connection attempt failed because security negotiation timed out." The client is running Windows XP SP2. I am connecting internally and shut down the firewall for debugging purporses.

I am at a loss on how to debug this. I know very little about openswan and how to log events. If anyone can point me in the right direction I will post more information.

Thanks!

dashnu · l33t Joined: 21 Jul 2004 Posts: 703 Location: Casco Maine

If you are using the default logging setup on gentoo (syslog-ng) all logging will go to /var/log/messages.

tail -f /var/log/messages

while tring to connect to the server. Post the relevant lines.
_________________
write quit bang

plut0 · Apprentice Joined: 21 Dec 2004 Posts: 272

I deleted my configs and copy/pasting everything again...now I can connect. Musta been a typo somewhere!

dashnu · l33t Joined: 21 Jul 2004 Posts: 703 Location: Casco Maine

Cool I think your the first one to test my howto on my page.. Glad it works well for you.

-Brett
_________________
write quit bang

khuongdp · n00b Joined: 09 Nov 2003 Posts: 73

Anybody tried openswan-2.4.6 ...ebuild?

dashnu · l33t Joined: 21 Jul 2004 Posts: 703 Location: Casco Maine

@khuongdp : No I have not.

Other news:
In the FWIW department.. I was able to establish a linux to linux roadwarrior connect.

Notice left == local on both ends.

Server / Gateway

newfangled · Posted: Wed Nov 22, 2006 1:43 am Post subject:

I've been playing with this for a while now.. (actually I tried a few months ago but then gave up and have been too busy until now) I've followed the new HOWTO (thanks btw) but can't get things working. I have both client and server behind NAT routers. But really I don't expect to know anything about the client's IP, routing etc.. for testing I do, but under normal circumstances it's down to whatever the hotel/coffee shop thinks is best :wink:

I've spent a good couple days on google and there is so much information (some conflicting) but mostly related to mutli-homed hosts and not NAT-T nastiness.

I've applied the registry change to the Windows XP test client and plan to have OS X and XP SP2 clients. Here are the versions of my gentoo software:

VinzC · Posted: Mon Jan 01, 2007 4:10 pm Post subject:

You should try OpenSwan 2.4.7 (actually masked by ~ARCH). It includes fixes for NAT-T [EDIT: client-side] implementations including those by Microsoft. Set leftnexthop to the LAN address of your internet router. I tried it and it works (well, almost) perfectly as I can make a successful connection to the NAT'ed server from my NAT'ed Windows workstation. Note my server currently crashes when the connection is closed but I might have just missed something.

Just my 2c.
_________________
Gentoo addict: tomorrow I quit, I promise!... Just one more emerge...
1739!

newfangled · Posted: Mon Jan 01, 2007 4:50 pm Post subject:

Thanks for the tip, I hadn't noticed the addition of the 2.4.7 ebuild since I got this up and running. I created an overlay for the 2.4.4 with the NAT-T patch added to the portage provided patch file and it works well with all my clients. My config files are as stated above and if anyone wants more information about the overlay I will provide it, but it wasn't difficult to figure it out.

I'll play with the masked ebuild and see if it is a better solution. I don't have a problem with crashes after disconnection so maybe it is something in the latest ebuild.

One thing I would say is that the connection can be really slow at times.. it can take a while just to refresh window contents of samba shares when viewed over the VPN. What kind of performance are other people seeing? How much upstream bandwidth do you have?

VinzC · Posted: Mon Jan 01, 2007 4:57 pm Post subject:

I already experienced slow connections the first time I played with OpenSwan. Once the load increased the line seemed to drop down completely. You might be experiencing such kinds of problems.

As for the bandwidth I still have to do some more tests. But I must first get the server back on :lol:

and it's about 25 miles from where I am ATM...
_________________
Gentoo addict: tomorrow I quit, I promise!... Just one more emerge...
1739!

dashnu · l33t Joined: 21 Jul 2004 Posts: 703 Location: Casco Maine

I am thinking about trying the latest ~ openswan again. I had the same error as you but I want to try your leftnexthop=lanip .. You scaring me a bit with the server "crashing" can you explain what happens?

FWIW I have never had any speed issues.. 768k up 1M down.
_________________
write quit bang

newfangled · Posted: Tue Jan 02, 2007 3:14 pm Post subject:

VinzC · Posted: Tue Jan 02, 2007 5:37 pm Post subject:

Well the server didn't crash. I saw from the logs today morning it got back control again one hour and a half later. There were probably network problems at that very moment, a true coïncidence. I made another connection attempt. Successful this time. So I have some more opportunities for testing later on :-)

.
_________________
Gentoo addict: tomorrow I quit, I promise!... Just one more emerge...
1739!

dashnu · l33t Joined: 21 Jul 2004 Posts: 703 Location: Casco Maine

Ah, Well I gave it a go anyways. All good on my end. Thanks for the info.

The Howto on my site is also now fully up to date and in sync with my current system.
_________________
write quit bang

VinzC · Posted: Wed Jan 03, 2007 9:57 am Post subject:

VinzC · Posted: Wed Jan 03, 2007 10:18 am Post subject:

As for the speed issues, a friend who has good knowledge of FreeSwan told me that the slowdown could be caused by exchanging packets of larger size. Since IPSEC encapsulates IP (correct?), unnecessary packet fragmentation might occur. If I understood correctly, one has to play a little with MTU values to fix the problem.
_________________
Gentoo addict: tomorrow I quit, I promise!... Just one more emerge...
1739!

dashnu · l33t Joined: 21 Jul 2004 Posts: 703 Location: Casco Maine

VinzC · 1.2.3.0/24

Hi again.

I've just made a successful connection between a NAT'ed OpenSwan server and:

NAT'ed Windows XP;
a Gentoo Linux client that is directly connected to the Internet.

I've followed Jacco de Leuuw's guide but it was incomplete to some extent. I've somehow guessed the missing information. The IPSec/secrets configuration has driven me mad but I've got it working now :twisted:

. Here are my *client* configuration files for a road-warrior config :!:

using PSK

.

dashnu · l33t Joined: 21 Jul 2004 Posts: 703 Location: Casco Maine

Good info man. I am going to test this today. Mind if I add it to my howto, I will give you credit?

It is kinda a bummer that we have to go through all this to nail up a linux client. Using PSK leftid / rightid do not seem to work and if you have another conn like i described in the thread somewhere (straight ipsec / ipsec) the roadwarrior conn will not properly identify to the correct connection.

I am working on setting up my own CA and using certs, I am having a few troubles but will post that info once I get it working. This is how it _should_ be done in production. Once certs are working connections will identify correctly and we can then use just ipsec for linux clients.

thanks again.
_________________
write quit bang

dashnu · l33t Joined: 21 Jul 2004 Posts: 703 Location: Casco Maine

Just noticed you have client external IP in ipsec.secret does %any work ?
_________________
write quit bang

newfangled · Posted: Thu Jan 04, 2007 3:51 pm Post subject:

I have a CA and use certs, let me know what you need help with.

As for MTU, I played with that when I set this up but didn't want to take it too low as the VPN usage is only ever going to be light and I didn't want to compromise the other activities this server is used for. It works but I guess I just expected more responsive performance as I am used to ssh, vnc, and X11 forwarding over the same connection.

dashnu · l33t Joined: 21 Jul 2004 Posts: 703 Location: Casco Maine

So, I went through this howto http://www.natecarlson.com/linux/ipsec-l2tp.php for certs. I get all the way to the end without problems but I can not convert it to pk12.

newfangled · Posted: Thu Jan 04, 2007 5:33 pm Post subject:

Can you post a recursive listing of everything under your sslca directory? The howto looks correct, the most obvious step for an error is after the signing step not moving the newcert.pem and newreq.key to your danp-laptop directory. Hence that is why I asked for the directory listing.

I already had a CA setup for signing certs used with courier-imap, apache etc.. So I just created host requests, signed them and then did the PKCS12 export. When I get home I can check for steps I took.