Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have managed to configure VPN with iPhone and OpenSWAN on Linux 2.6. Though, when disconnecting the iphone and reconnecting, it times out.

I have found that:

1) no packets are being sent when you disconnect iPhone from VPN.

2) when reconnecting, pluto picks up on the older socket and tries to use that state machine. which then fails and iPhone retransmits until times out.

I'm using the latest version in git, including #1204 patch. I see the NAT-T patch debug lines in the logs. But still, no cookie.


share|improve this question
What does your configuration look like? I've been trying for hours to get this to work. – Mike Mar 15 '12 at 5:22
up vote 4 down vote accepted

Sounds like you've got it mostly working. My guess is that you'll need this added to your IPsec configuration:

     # Apple iOS doesn't send delete notify so we need dead peer
     # detection to detect vanishing clients

Basically, when you disconnect with an iPhone/iPad it does not send a DELETE signal, so the tunnel just sits there (until you restart the ipsec service, for instance). These options above say that if they haven't heard from the device in 90 seconds then to just close down and clean it up. You can obviously adjust the numbers to your needs.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.