Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm following this guide for getting an IPsec/L2TP VPN server set up on a Gentoo machine, and I'm having trouble getting an OS X client to connect. From the logs, I believe I'm making an IPsec connection OK, but xl2tpd is refusing to go any further in the connection process. My setup (names changed):

  • Home server is directly connected to the Internet - no NAT - at example.com
    • vpn.example.com is an alias for example.com
    • Both addresses are provided through a dynamic DNS service - example.com's IP is not fixed
    • Home server's internal subnet is 192.168.1.0/24
  • OS X client runs 10.5.6 and has a dynamic IP (is a "roadwarrior")

My config files are as follows:

ipsec.conf

version 2.0

config setup
        nat_traversal=no
        nhelpers=0

include /etc/ipsec/ipsec.d/examples/no_oe.conf

conn L2TP-PSK-NAT
        rightsubnet=vhost:%priv
        also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
        authby=secret
        pfs=no
        auto=add
        keyingtries=3
        rekey=no
        type=transport
        left=%defaultroute
        leftprotoport=17/1701
        right=%any
        # Using the magic port of "0" means "any one single port". This is
        # a work around required for Apple OSX clients that use a randomly
        # high port, but propose "0" instead of their port.
        rightprotoport=17/0

ipsec.secrets

: PSK "testkey"

xl2tpd.conf

[global]
port = 1701
access control = no
debug avp = yes
debug network = yes
debug state = yes
debug tunnel = yes

[lns default]
ip range = 172.21.118.2-172.21.118.254
local ip = 172.21.118.1
require chap = yes
refuse pap = yes
name = LinuxVPN
pppoptfile = /etc/ppp/options.xl2tpd
ppp debug = yes
length bit = yes

options.xl2tpd

ipcp-accept-local
ipcp-accept-remote
ms-dns  192.168.1.27
noccp
noauth
crtscts
idle 1800
mtu 1410
mru 1410
nodefaultroute
debug
lock
proxyarp
connect-delay 5000
silent

And the log entries:

*snip*
Sep 05 13:40:32 [pluto] "L2TP-PSK-noNAT"[14] 137.112.114.88 #28: STATE_QUICK_R2: IPsec SA established {ESP=>0x0cb56f8c <0x319c29ff xfrm=AES_128-HMAC_SHA1 NATD=none DPD=none}
Sep 05 13:40:39 [xl2tpd] Maximum retries exceeded for tunnel 23214.  Closing._
Sep 05 13:40:46 [xl2tpd] Connection 70 closed to 137.112.114.88, port 63835 (Timeout)_
*snip*

Why can't I get xl2tpd to accept the connection? I can't even find the relevant xl2tpd log files to continue debugging - all I get are those two lines in the syslog.

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

Figured it out. I'm no expert, so I don't know why this works, but I was able to get a connection by adding the following lines to the conn L2TP-PSK-noNAT section of ipsec.conf:

leftnexthop=%defaultroute
rightnexthop=%defaultroute
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.