0

I spent the morning trying to configure an L2TP/IPsec VPN using Openswan and xl2tpd on a Debian Squeeze server for use by a mix of iOS and Mac clients. I am trying to set it up using pre-shared keys to keep things simple.

The iPhone connects and begins to create the VPN, then gets stuck and fails part way through. I can't figure out the issue after fiddling many parameters and double checking everything.

Here's the last log message from /var/log/auth.log before it gets stuck:

pluto[30733]: "L2TP-PSK"[5] 166.147.96.226 #5: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0x0659cf9f <0xc3c2f68c xfrm=AES_256-HMAC_SHA1 NATOA=none NATD=166.147.96.226:10682 DPD=enabled}

Then about 30 seconds later, the iPhone gives up and this shows up in the auth.log:

pluto[30733]: ERROR: asynchronous network error report on br1 (sport=4500) for message to 166.147.96.226 port 10682, complainant 166.147.96.226: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]

What does this mean? Is the server unable to contact the client or is the client unable to make an additional connection, and passes this error across the IPsec connection it could establish?

Unfortunately, I'm testing this with the iPhone on AT&T's cellular network, because I'm inside the Wi-Fi network I want to establish the VPN within. Does AT&T block VPN traffic?

I know the IPsec authentication is working because if I change or remove the line from /etc/ipsec.secrets, the connection fails much quicker and I don't see these log lines.

I believe the firewall is allowing UDP ports 500 and 4500, and the ESP protocol, because if I block those, again the connection fails much quicker.

/etc/ipsec.conf connection section:

conn L2TP-PSK
    authby=secret
    pfs=no
    rekey=no
    keyingtries=3
    dpddelay=30
    dpdtimeout=120
    dpdaction=clear
    compress=yes
    left=%defaultroute
    leftprotoport=udp/1701
    right=%any
    rightprotoport=udp/0
    auto=add

/etc/ipsec.secrets

VPN-SERVER-PUBLIC-IP %any: PSK "mysecretishere"

/etc/xl2tpd/xl2tpd.conf

[global]                ; Global parameters:
access control = no
rand source = dev

[lns default]             ; Our fallthrough LNS definition
ip range = 192.168.1.120-192.168.1.127
local ip = 192.168.1.119
require chap = yes
refuse pap = no
require authentication = yes
name = LinuxVPNserver
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tp
length bit = yes

/etc/ppp/options.l2tp

ipcp-accept-local
ipcp-accept-remote
ms-dns  192.168.1.1
noccp
auth
crtscts
idle 1800
mtu 1410
mru 1410
nodefaultroute
debug
lock
proxyarp
connect-delay 5000
plugin pppol2tp.so
require-mschap-v2
  • I think this would be much better suited to Server Fault. Can it be moved over? – Michelle Jun 23 '12 at 9:00
1

AT&T seems to block incoming UDP packets (doesn't let them traverse the NAT), so it will be very difficult to set up L2TP/IPsec. I think you're stuck with PPTP.

0

This error is your clue.

ERROR: asynchronous network error report on br1 (sport=4500) for message to 166.147.96.226 port 10682, complainant 166.147.96.226: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)

I've seen it before and every time it is because either the host server or remote client's network/firewall is blocking the ipsec packets. If it is a user controlled firewall or router this a simple fix (enable IPSEC) but if it's out of your control you are out of luck and have to use a different protocol. There are some who say change the left=17/%any but this has never worked for me (in rare cases perhaps the client side may be smart and attempt to use a different port which may not be blocked).

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.