5

I'm setting up LT2p over IPSec on my Centos 6.3 fresh install.

I have iptables flushed, permit all.

Whenever I try to connect, i get a 'no reply from vpn' and nothi

Here's my ipsec.conf file (Server is 1.2.3.4) :

config setup
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
    oe=off
    protostack=netkey

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=1.2.3.4
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any

My /etc/ipsec.secrets

1.2.3.4 %any: PSK "password"

My sysctl.conf (appened lines)

net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.icmp_ignore_bogus_error_responses = 1

Here's what 'ipsec verify' gives:

# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.32/K2.6.32-279.19.1.el6.x86_64 (netkey)
Checking for IPsec support in kernel                            [OK]
 SAref kernel support                                           [N/A]
 NETKEY:  Testing for disabled ICMP send_redirects              [OK]
NETKEY detected, testing for disabled ICMP accept_redirects     [OK]
Checking that pluto is running                                  [OK]
 Pluto listening for IKE on udp 500                             [OK]
 Pluto listening for NAT-T on udp 4500                          [OK]
Checking for 'ip' command                                       [OK]
Checking /bin/sh is not /bin/dash                               [WARNING]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support                                [DISABLED]

And I see xl2tpd is listening on 1701/udp :

udp        0      0 1.2.3.4:1701     0.0.0.0:*     2096/xl2tpd 

bumped to the homepage by Community 15 hours ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

  • First, use tcpdump on both sides to make sure that packets are being transmitted and being received. – bahamat Jan 15 '13 at 15:54
  • Ok i see this when I connect : – Disco Jan 15 '13 at 16:13
  • 17:12:38.239822 IP MYIPHERE.isakmp > SERVERIP.isakmp: isakmp: phase 1 I ident A few times but nothing after that. – Disco Jan 15 '13 at 16:13
  • Phase 1 failure means the preshared key isn't being accepted. Look for authpriv.* messages in syslog (on Debian in /var/log/auth.log). Remember, your ipsec.secrets file needs to have the left and right side reversed for each side. – bahamat Jan 17 '13 at 7:25
  • Is your computer (the one you're trying to connect from) to the CentOS server behind NAT? – Bogdan Stoica Feb 4 at 14:36
0

Check that your network is working properly the data rate of sent and recieved packets is also responding or not, sometimes due to connection lost or some other problem this problem is caused.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.