Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I spent the morning trying to configure an L2TP/IPsec VPN using Openswan and xl2tpd on a Debian Squeeze server for use by a mix of iOS and Mac clients. I am trying to set it up using pre-shared keys to keep things simple.

The iPhone connects and begins to create the VPN, then gets stuck and fails part way through. I can't figure out the issue after fiddling many parameters and double checking everything.

Here's the last log message from /var/log/auth.log before it gets stuck:

pluto[30733]: "L2TP-PSK"[5] 166.147.96.226 #5: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0x0659cf9f <0xc3c2f68c xfrm=AES_256-HMAC_SHA1 NATOA=none NATD=166.147.96.226:10682 DPD=enabled}

Then about 30 seconds later, the iPhone gives up and this shows up in the auth.log:

pluto[30733]: ERROR: asynchronous network error report on br1 (sport=4500) for message to 166.147.96.226 port 10682, complainant 166.147.96.226: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]

What does this mean? Is the server unable to contact the client or is the client unable to make an additional connection, and passes this error across the IPsec connection it could establish?

Unfortunately, I'm testing this with the iPhone on AT&T's cellular network, because I'm inside the Wi-Fi network I want to establish the VPN within. Does AT&T block VPN traffic?

I know the IPsec authentication is working because if I change or remove the line from /etc/ipsec.secrets, the connection fails much quicker and I don't see these log lines.

I believe the firewall is allowing UDP ports 500 and 4500, and the ESP protocol, because if I block those, again the connection fails much quicker.

/etc/ipsec.conf connection section:

conn L2TP-PSK
    authby=secret
    pfs=no
    rekey=no
    keyingtries=3
    dpddelay=30
    dpdtimeout=120
    dpdaction=clear
    compress=yes
    left=%defaultroute
    leftprotoport=udp/1701
    right=%any
    rightprotoport=udp/0
    auto=add

/etc/ipsec.secrets

VPN-SERVER-PUBLIC-IP %any: PSK "mysecretishere"

/etc/xl2tpd/xl2tpd.conf

[global]                ; Global parameters:
access control = no
rand source = dev

[lns default]             ; Our fallthrough LNS definition
ip range = 192.168.1.120-192.168.1.127
local ip = 192.168.1.119
require chap = yes
refuse pap = no
require authentication = yes
name = LinuxVPNserver
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tp
length bit = yes

/etc/ppp/options.l2tp

ipcp-accept-local
ipcp-accept-remote
ms-dns  192.168.1.1
noccp
auth
crtscts
idle 1800
mtu 1410
mru 1410
nodefaultroute
debug
lock
proxyarp
connect-delay 5000
plugin pppol2tp.so
require-mschap-v2
share|improve this question
    
I think this would be much better suited to Server Fault. Can it be moved over? –  Michelle Jun 23 '12 at 9:00
add comment

1 Answer

AT&T seems to block incoming UDP packets (doesn't let them traverse the NAT), so it will be very difficult to set up L2TP/IPsec. I think you're stuck with PPTP.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.