I created a L2TP/IPSec tunnel and I am struggling with routing, I cannot SSH to a machine in the remote network. My local system is Debian buster (current testing).

Here is my local networkg config; interface ppp0 is the tunnel interface.

#ip a
2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether fc:aa:14:27:3a:bf brd ff:ff:ff:ff:ff:ff
    inet brd scope global dynamic enp1s0
       valid_lft 71692sec preferred_lft 71692sec
    inet6 fe80::feaa:14ff:fe27:3abf/64 scope link 
       valid_lft forever preferred_lft forever
14: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1410 qdisc pfifo_fast state UNKNOWN group default qlen 3
    inet peer scope global ppp0
       valid_lft forever preferred_lft forever

I need to connect to server, inside the VPN network. I only need this one addres, other communication should go through my home router.

This is the routing table after creating the tunnel:

# ip r
default via dev enp1s0 proto static metric 100 dev ppp0 proto kernel scope link src dev enp1s0 proto kernel scope link src metric 100 

I added:

ip r a via

I can ping it, cannot ssh (no route). I run wireshark and saw that even TSP SYN is without the answer (but ICMP is getting back).

I also discovered that under Windows SSH works in this tunnel, but it is carried as ESP payload, but under Linux I get TCP SYN when trying to SSH.

I tried about dozen of routes and nothing worked for me. Could someone help?


  • Have you tried running tcpdump -pni ppp0 while attempting a connection? – kasperd Jul 30 '17 at 11:16
  • Another question: What does the routing table look like after you added the extra routing entry? – kasperd Jul 30 '17 at 11:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.