Hot answers tagged

33

OK, this question is asked over and over again over the Internet and most of the time there is a (semi-) incorrect answer that you cannot do what was described in the original post. Let me clarify it once and for all :) The short answer is L2TP (and PPTP for that matter) do not have facilities to do route pushes inside the protocol, but it can be achieved ...


19

Here are the ports and protocols: Protocol: UDP, port 500 (for IKE, to manage encryption keys) Protocol: UDP, port 4500 (for IPSEC NAT-Traversal mode) Protocol: ESP, value 50 (for IPSEC) Protocol: AH, value 51 (for IPSEC) Also, Port 1701 is used by the L2TP Server, but connections should not be allowed inbound to it from outside. There is a special ...


7

Well, that was terrible. I found the solution in the last place I would've looked: the client. Windows does not support IPsec NAT-T by default, which is used whenever the server is behind a NAT (as in this case). You have to add a registry key to enable this - see http://support.microsoft.com/kb/926179/en-us (still applies to Windows 8). Then everything ...


7

1. Check L2TP ports existence First check whether there are actually L2TP port configured in Routing and Remote Access (RRAS). Click Start, click Administrative Tools, and then click Routing and Remote Access. Expand your server, and then expand ports. In case there are no entries for WAN Miniport (L2TP)..., add them by right clicking ports. 2. Check RAS ...


5

Did you make the registry changes to the Windows machines to make it behind NAT? Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PolicyAgent] "AssumeUDPEncapsulationContextOnSendRule"=dword:00000002 The registry change is mentioned in this article : http://support.microsoft.com/kb/926179


5

CHAP requires that plaintext password be accessible to the authentication server. Active Directory doesn't store plaintext passwords by default, so CHAP won't work. It would appear that you can modify the VPN server configuration file (com.apple.RemoteAccessServers.plist) to use the MS-CHAPv2 authentication protocol. Given the weakness of the protocol I ...


4

IPSec -> Layer 3 auth and encryption L2TP -> Layer 2 tunneling From what I understand, IPSec wouldn't be carrying any Layer 2 information. That's where L2TP comes in.


4

iThingies are picky about what exactly they need when it comes to VPN. The problem is basically, the defaults most VPN servers use for IPSec is too insecure for iThingies. Has some good tips: Error connecting to Sonicwall L2TP VPN from iPad/iPhone I had a very similar problem getting iThingies to talk to a SonicWall, and had to make some significant ...


4

Ok folks. I just want to mark this as answered and leave what I discovered here incase anyone else comes along wanting to know the answer. IF YOU ARE USING A MAC, DO NOT USE THE BUILT IN VPN CLIENT AND THINK JUNIPER IS GOING TO BE OKAY WITH IT What I discovered is that no matter what it cannot pass on the correct credentials, it simply doesn't have the ...


4

Which client software are you using to connect? Split tunneling is set up, but I believe you'll need to be connecting with the Cisco client software for it to function. Anyway, to get the VPN client's internet traffic to make it out to the internet, looks like all you need is: same-security-traffic permit intra-interface nat (outside) 1 192.168.30.0 255....


3

Ipsec needs UDP port 500 + ip protocol 50 and 51 - but you can use NAt-T instead, which needs UDP port 4500. On the other hand L2TP uses udp port 1701. If you trying to pass ipsec traffic through a "regular" Wi-Fi router and there is no such option as IPSec pass-through, I recommend opening port 500 and 4500. At least that is how it works on mine. Hope ...


3

Turns out the clients can connect and routing is fine, but the client was being quarantined by NPS (Network Policy Server). Originally I had installed NPS and then uninstalled it during troubleshooting. Only when reinstalling it do I see the RRAS logs mentioning that the client has been quarantined. The client had the 'VPN Non-NAP Capable' status and the ...


3

Encapsulating Security Protocol (ESP) is IP protocol 50. It has a protocol number in its own right, just as ICMP, TCP and UDP do, and is arguably the right protocol to use for encrypted tunnels. However, although TCP and UDP have both ip addresses and port numbers associated with both source and destination, ICMP and ESP don't. It's the combination of ...


3

Okay, turns out it's a "bug" in the latest version of Mac OS X Server. From what I was able to find, he IKE daemon racoon won't accept connections if the source port is not UDP 4500. Most connections that go through NAT will randomize the source port, which means it won't connect. The old version of the daemon doesn't have this restriction. Connections from ...


3

The solution was to modify the routing table in such a way that IPs in local network are routed via the default gateway: sudo ip route add 10.11.0.0/16 via 10.66.157.1 Where 10.66.157.1 is the default gateway in my routing table. I found it via the command ip route.


3

Finally found the correct steps on how to create a VPN on Windows Server 2016 in AWS. Once connected, the client is able to access resources within the VPC and still access the Internet. Here's the complete list of steps on how it was done for those interested. Setup the instance and needed interfaces: Spin up a Windows Server 2016 instance in EC2 with 1 ...


3

Your "Local connection" is your regular (physical) connection over which the IPsec VPN tunnel is built. Disabling that interface will completely isolate your windows client from the network; thus the VPN tunnel will go down as well. You can try using traceroute to verify whether or not your traffic is going through the VPN tunnel. To provide more ...


2

I find it more likely that this is related to your firewall rules. I might double check that you aren't only letting stuff route to a certain subnet, or range or group that was created in your network. I might also double check this. I've setup L2TP connections to iPhones and iPads using sonicwall, but I've never had to setup connections to over 30 devices....


2

The password is stored in an encrypted form that's next to impossible to manually decrypt. PSK VPN connections really weren't meant for your use case, Certificate based authentication was, which is why you're finding it hard to do what you want.


2

IKE traffic to establish a phase 1 tunnel runs over port 500 of the UDP protocol; a typical port scan only checks TCP ports. This is because it's much harder to simply 'check' a UDP port for openness without knowing what protocol is operating on the port - many services won't respond to a UDP packet that's malformed, and many systems won't send ICMP ...


2

For anyone that is still looking for the answer to this, I had this problem on Ubuntu 10.04, openswan in the repos for 10.04 is 2.6.23 which gave me the errors mentioned in this question. The quick and easy way to fix this is to upgrade to 2.6.38, to do this you can install the Openswan team's PPA. Instructions are here - https://launchpad.net/~openswan/+...


2

Alright. I figured it out. The problem was with my ipsec.conf file (not shown) in which I had the lines: left=10.0.50.20 # my local IP address leftnexthop=%defaultroute The problem appeared to be after I set my VPN to the default route it would attempt to send packets destined for the VPN server through the vpn causing a nice feedback loop. Modifying these ...


2

You need to enable IP forwarding, and disable the send_redirects, as per the results of the "ipsec verify" step you did. This should do the trick: echo 1 > /proc/sys/net/ipv4/ip_forward for each in /proc/sys/net/ipv4/conf/* do echo 0 > $each/accept_redirects echo 0 > $each/send_redirects done Then run "ipsec verify" again, and that ...


2

You can use the interface name ppp+ in iptables rules to match all interfaces starting with the name ppp. This ought to suit your needs.


2

Creating an L2 Bridge with SoftEther into a TAP interface like this is essentially a SecureNAT configuration. SoftEther can do what you want without dnsmasq or ufw. Revert the current configuration and try this instead: Create a new virtual hub named snat. Click the Manage Virtual Hub button. Click Virtual NAT and Virtual DHCP. Click SecureNAT ...


2

Im sorry about my English. I have same problem and after..... many hours........... I see a option in the Networks Interfaces..... need edit the Interface LAN when you have the connection Server VPN and check box Set as default gateway Cant upload image.... cos my first post here.


2

Unless it is absolutely necessary, which I doubt, running layer-2 over a WAN is a really bad idea. STP will require all sorts of tweaks to work correctly with the increased latency. You need to measure the latency and apply it to all the STP calculations. Broadcasts, multicasts, and unknown unicasts will need to travel end-to-end to every switch port in the ...


1

I had similar problem. My server doesn't NAT, so this piece is not needed so removed it: conn L2TP-PSK-NAT rightsubnet=vhost:%priv also=L2TP-PSK-noNAT And when that's done NAT Traversel must be set to yes. nat_traversal=yes


1

In ipsec.conf, left needs to be not your public IP, but whatever IP your server sees, so 10.252.194.250 in this case. That way it can "match" up a left/right side connection. Where left=you, and right=%any.


1

Take a look at MLPPP - Multi-Link PPP. Its capabilities should meet what you described with probably even non-appliance (a.k.a. pure software) implementations as well.


Only top voted, non community-wiki answers of a minimum length are eligible