Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently installed OpenSwan on my Fedora 13 machine. I want to use it to connect with Mac OS X with L2TP over IPSEC, unfortunately I am already stuck on the IPSEC-negotation part.

My server is running behind a NATted firewall so my external IP differs from the server's IP. The server has a fixed IP on the network and the same is almost always valid for the clients (they are usually behind a NATted firewall).

I installed OpenSwan on Fedora 13 and have following configuration:

config setup
    protostack=netkey
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
    oe=off
    nhelpers=0

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=my.servers.external.ip
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/0

IPSEC starts fine and listens to UDP 500 and 4500. These two ports are opened in the firewall and are forwarded fine to the server.

In my /etc/ipsec.secrets file I have

my.servers.external.ip %any: "LongAndDifficultPassword"

And finally in my sysctl.conf (the redirect-entries are there because OpenSwan was strongly protesting about send/accept_redirects being active) I have

net.ipv4.ip_forward = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0

Running "ipsec verify" gives me "all greens" (except Opportunistic Encryption Support, which is DISABLED), however, when trying to connect my Mac gives me following in the logs:

Nov  1 19:30:28 macbook pppd[4904]: pppd 2.4.2 (Apple version 412.3) started by user, uid 1011
Nov  1 19:30:28 macbook pppd[4904]: L2TP connecting to server 'my.servers.ip.address' (my.servers.ip.address)...
Nov  1 19:30:28 macbook pppd[4904]: IPSec connection started
Nov  1 19:30:28 macbook racoon[4905]: Connecting.
Nov  1 19:30:28 macbook racoon[4905]: IKE Packet: transmit success. (Initiator, Main-Mode message 1).
Nov  1 19:30:31 macbook racoon[4905]: IKE Packet: transmit success. (Phase1 Retransmit).
Nov  1 19:30:38: --- last message repeated 2 times ---
Nov  1 19:30:38 macbook pppd[4904]: IPSec connection failed

Any ideas at all?

share|improve this question
add comment

1 Answer

You need to configure a L2TP server on your vpn server. I suggest something simple like l2tpd (if you can still find it). You need both SWAN running and L2TP.

See this page... http://www.jacco2.dds.nl/networking/openswan-l2tp.html

share|improve this answer
2  
That part I had fixed so it was really the IPSEC-part. In fact it turned out that I have to EXCLUDE the server's own subnet to the virtual_networks-part, i.e. %v4:!my.servers.subnet/24. That fixed the problem. –  sicn Nov 10 '10 at 7:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.