Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a non-NATed Openswan+xl2tpd server (Ubuntu 12.04), to which I connect with a Windows 8 behind NAT. The client loses its connection after a while of doing nothing (between 30 and 60 minutes, but I didn't time it).

The client doesn't have enabled that it should kill inactive connections. Nor does it ever go into sleep mode. I also tried setting the kill-after-time to 24 hours, but that didn't help.

The NAT router behind which the client located is Debian Linux, and its router is a Cisco which connects us directly to the data center where the server is. None of our other connections, like SSH, get dropped with inactivity (because of cheap routers). I did however try turning on the keepalives in /etc/ipsec.conf:

config setup
    (...snip...)
    nat_traversal=yes
    force_keepalive=yes
    keep_alive=10

but that didn't help.

As you can see in the config later, dead peer detection's action is clear. That would be a first suggestion to fix, but I need clear, because people will be connecting from everwhere but the kitchen sink. Besides, as I said, in the test setup I have now, I can't see any device killing its connection. (edit: 'restart' also has the same effect)

These are of one time it happened:

Jul 18 16:18:06 host xl2tpd[1918]: Maximum retries exceeded for tunnel 49070.  Closing.
Jul 18 16:18:06 host xl2tpd[1918]: Terminating pppd: sending TERM signal to pid 18359
Jul 18 16:18:06 host xl2tpd[1918]: Connection 4 closed to 89.188.x.y, port 1701 (Timeout)
Jul 18 16:18:11 host xl2tpd[1918]: Unable to deliver closing message for tunnel 49070. Destroying anyway.

and these on another:

Jul 18 17:44:39 host xl2tpd[1918]: udp_xmit failed to 89.188.x.y:1701 with err=-1:Operation not permitted
Jul 18 17:44:43  xl2tpd[1918]: last message repeated 4 times
Jul 18 17:44:43 host xl2tpd[1918]: Maximum retries exceeded for tunnel 10918.  Closing. 
Jul 18 17:44:43 host xl2tpd[1918]: udp_xmit failed to 89.188.x.y:1701 with err=-1:Operation not permitted
Jul 18 17:44:43 host xl2tpd[1918]: Terminating pppd: sending TERM signal to pid 26338
Jul 18 17:44:43 host xl2tpd[1918]: Connection 6 closed to 89.188.x.y, port 1701 (Timeout)
Jul 18 17:44:44 host xl2tpd[1918]: udp_xmit failed to 89.188.x.y:1701 with err=-1:Operation not permitted
Jul 18 17:44:48  xl2tpd[1918]: last message repeated 3 times
Jul 18 17:44:48 host xl2tpd[1918]: Unable to deliver closing message for tunnel 10918. Destroying anyway.
Jul 18 17:44:59 host xl2tpd[1918]: Can not find tunnel 10918 (refhim=0)
Jul 18 17:44:59 host xl2tpd[1918]: network_thread: unable to find call or tunnel to handle packet.  call = 0, tunnel = 10918 Dumping. 
Jul 18 17:45:09 host xl2tpd[1918]: Can not find tunnel 10918 (refhim=0)
Jul 18 17:45:09 host xl2tpd[1918]: network_thread: unable to find call or tunnel to handle packet.  call = 0, tunnel = 10918 Dumping. 
Jul 18 17:45:19 host xl2tpd[1918]: Can not find tunnel 10918 (refhim=0)
Jul 18 17:45:19 host xl2tpd[1918]: network_thread: unable to find call or tunnel to handle packet.  call = 0, tunnel = 10918 Dumping. 
Jul 18 17:45:29 host xl2tpd[1918]: Can not find tunnel 10918 (refhim=0)
Jul 18 17:45:29 host xl2tpd[1918]: network_thread: unable to find call or tunnel to handle packet.  call = 0, tunnel = 10918 Dumping. 
Jul 18 17:45:39 host xl2tpd[1918]: Can not find tunnel 10918 (refhim=0)
Jul 18 17:45:39 host xl2tpd[1918]: network_thread: unable to find call or tunnel to handle packet.  call = 0, tunnel = 10918 Dumping. 
Jul 18 17:45:49 host xl2tpd[1918]: Can not find tunnel 10918 (refhim=0)
Jul 18 17:45:49 host xl2tpd[1918]: network_thread: unable to find call or tunnel to handle packet.  call = 0, tunnel = 10918 Dumping.

Versions:

  • Ubuntu 12.04
  • Openswan: 2.6.37-1
  • xl2tpd: 3.1+dfsg-1
  • kernel: 3.2.0-49-generic

configs:

/etc/ipsec.conf:

version    2.0    # conforms to second version of ipsec.conf specification

config setup
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!10.152.2.0/24
    oe=off
    protostack=netkey
    force_keepalive=yes
    keep_alive=10

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=2
    rekey=no
    dpddelay=30
    dpdtimeout=120
    dpdaction=clear
    ikelifetime=8h
    keylife=1h
    type=transport
    left=%defaultroute
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any

/etc/xl2tpd/xl2tpd.conf

[global]
ipsec saref = no

[lns default]
ip range = 10.152.2.2-10.152.2.254
local ip = 10.152.2.1
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = no
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

/etc/ppp/options.xl2tpd:

require-mschap-v2
refuse-mschap
ms-dns 10.152.2.1
asyncmap 0
auth
crtscts
idle 1800
mtu 1200
mru 1200
lock
hide-password
local
#debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
share|improve this question

1 Answer 1

Most likely your session rekeing communication does not complete. I would start by looking at:
- ubuntu firewall rules (iptables-save)
- ipsec-related network traffic on the ubuntu machine (tcpdump -s 0 -w capturefile.pcap -n -i $vpn_external_interface '$remote_client_ip or icmp or ip proto 50 or udp port 500')
- ipsec-related events in eventlog. This article documents some events, it is written for windows 7 but applies to windows 8, too.
- Cisco router (if you have access to it) idle connection timeout parameter.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.