Hot answers tagged

37

OK, this question is asked over and over again over the Internet and most of the time there is a (semi-) incorrect answer that you cannot do what was described in the original post. Let me clarify it once and for all :) The short answer is L2TP (and PPTP for that matter) do not have facilities to do route pushes inside the protocol, but it can be achieved ...


24

Here are the ports and protocols: Protocol: UDP, port 500 (for IKE, to manage encryption keys) Protocol: UDP, port 4500 (for IPSEC NAT-Traversal mode) Protocol: ESP, value 50 (for IPSEC) Protocol: AH, value 51 (for IPSEC) Also, Port 1701 is used by the L2TP Server, but connections should not be allowed inbound to it from outside. There is a special ...


9

Well, that was terrible. I found the solution in the last place I would've looked: the client. Windows does not support IPsec NAT-T by default, which is used whenever the server is behind a NAT (as in this case). You have to add a registry key to enable this - see http://support.microsoft.com/kb/926179/en-us (still applies to Windows 8). Then everything ...


7

1. Check L2TP ports existence First check whether there are actually L2TP port configured in Routing and Remote Access (RRAS). Click Start, click Administrative Tools, and then click Routing and Remote Access. Expand your server, and then expand ports. In case there are no entries for WAN Miniport (L2TP)..., add them by right clicking ports. 2. Check RAS ...


6

Ipsec needs UDP port 500 + ip protocol 50 and 51 - but you can use NAt-T instead, which needs UDP port 4500. On the other hand L2TP uses udp port 1701. If you trying to pass ipsec traffic through a "regular" Wi-Fi router and there is no such option as IPSec pass-through, I recommend opening port 500 and 4500. At least that is how it works on mine. Hope ...


5

CHAP requires that plaintext password be accessible to the authentication server. Active Directory doesn't store plaintext passwords by default, so CHAP won't work. It would appear that you can modify the VPN server configuration file (com.apple.RemoteAccessServers.plist) to use the MS-CHAPv2 authentication protocol. Given the weakness of the protocol I ...


5

Did you make the registry changes to the Windows machines to make it behind NAT? Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PolicyAgent] "AssumeUDPEncapsulationContextOnSendRule"=dword:00000002 The registry change is mentioned in this article : http://support.microsoft.com/kb/926179


4

iThingies are picky about what exactly they need when it comes to VPN. The problem is basically, the defaults most VPN servers use for IPSec is too insecure for iThingies. Has some good tips: Error connecting to Sonicwall L2TP VPN from iPad/iPhone I had a very similar problem getting iThingies to talk to a SonicWall, and had to make some significant ...


4

Ok folks. I just want to mark this as answered and leave what I discovered here incase anyone else comes along wanting to know the answer. IF YOU ARE USING A MAC, DO NOT USE THE BUILT IN VPN CLIENT AND THINK JUNIPER IS GOING TO BE OKAY WITH IT What I discovered is that no matter what it cannot pass on the correct credentials, it simply doesn't have the ...


4

The solution was to modify the routing table in such a way that IPs in local network are routed via the default gateway: sudo ip route add 10.11.0.0/16 via 10.66.157.1 Where 10.66.157.1 is the default gateway in my routing table. I found it via the command ip route.


4

Finally found the correct steps on how to create a VPN on Windows Server 2016 in AWS. Once connected, the client is able to access resources within the VPC and still access the Internet. Here's the complete list of steps on how it was done for those interested. Setup the instance and needed interfaces: Spin up a Windows Server 2016 instance in EC2 with 1 ...


3

Okay, turns out it's a "bug" in the latest version of Mac OS X Server. From what I was able to find, he IKE daemon racoon won't accept connections if the source port is not UDP 4500. Most connections that go through NAT will randomize the source port, which means it won't connect. The old version of the daemon doesn't have this restriction. Connections from ...


3

Encapsulating Security Protocol (ESP) is IP protocol 50. It has a protocol number in its own right, just as ICMP, TCP and UDP do, and is arguably the right protocol to use for encrypted tunnels. However, although TCP and UDP have both ip addresses and port numbers associated with both source and destination, ICMP and ESP don't. It's the combination of ...


3

Turns out the clients can connect and routing is fine, but the client was being quarantined by NPS (Network Policy Server). Originally I had installed NPS and then uninstalled it during troubleshooting. Only when reinstalling it do I see the RRAS logs mentioning that the client has been quarantined. The client had the 'VPN Non-NAP Capable' status and the ...


3

Your "Local connection" is your regular (physical) connection over which the IPsec VPN tunnel is built. Disabling that interface will completely isolate your windows client from the network; thus the VPN tunnel will go down as well. You can try using traceroute to verify whether or not your traffic is going through the VPN tunnel. To provide more ...


2

For anyone that is still looking for the answer to this, I had this problem on Ubuntu 10.04, openswan in the repos for 10.04 is 2.6.23 which gave me the errors mentioned in this question. The quick and easy way to fix this is to upgrade to 2.6.38, to do this you can install the Openswan team's PPA. Instructions are here - https://launchpad.net/~openswan/+...


2

You need to enable IP forwarding, and disable the send_redirects, as per the results of the "ipsec verify" step you did. This should do the trick: echo 1 > /proc/sys/net/ipv4/ip_forward for each in /proc/sys/net/ipv4/conf/* do echo 0 > $each/accept_redirects echo 0 > $each/send_redirects done Then run "ipsec verify" again, and that ...


2

Creating an L2 Bridge with SoftEther into a TAP interface like this is essentially a SecureNAT configuration. SoftEther can do what you want without dnsmasq or ufw. Revert the current configuration and try this instead: Create a new virtual hub named snat. Click the Manage Virtual Hub button. Click Virtual NAT and Virtual DHCP. Click SecureNAT ...


2

Im sorry about my English. I have same problem and after..... many hours........... I see a option in the Networks Interfaces..... need edit the Interface LAN when you have the connection Server VPN and check box Set as default gateway Cant upload image.... cos my first post here.


2

Unless it is absolutely necessary, which I doubt, running layer-2 over a WAN is a really bad idea. STP will require all sorts of tweaks to work correctly with the increased latency. You need to measure the latency and apply it to all the STP calculations. Broadcasts, multicasts, and unknown unicasts will need to travel end-to-end to every switch port in the ...


2

As it turns out, the defaults for the DHCP relay agent simply don't work for some L2TP clients. When you set up an interface for DHCP relaying in RRAS (on the "Internal" interface, where VPN clients go), the default options look like this: It looks unassuming, but the cause of this entire issue is the "Boot threshold" setting. The ...


1

What authentication method are you using for the L2TP VPN? It's possible that your devices require a certificate issued from your CA to connect, but if your Macs and Windows PCs are connected to the domain then they'll have this by default. Alternately you can try just using a PPTP VPN and seeing if that works.


1

To the best of my knowledge. Some NATs can detect the call ID “conflict” and will modify them to keep the multiple VPN connections unique. The NAT must have a PPTP editor to allow this. This of course isn’t something router manufacturers generally advertise on their spec sheets. You will need to go digging around on their website to find. For example on the ...


1

It sounds to me like your VPN is using the PPTP protocol, rather than the other protocols supported by Windows Server. PPTP is easy to publish through a firewall or router, you need two entries: TCP Port 1723 IP Protocol number 47 (named "GRE" - Generic Router Encapsulation) Some routers will do this automatically for you if you forward PPTP to your ...


1

We are also using a L2TP VPN connection and I could make it work on Ubuntu with openswan and xl2tp. I guess it should be similar on Debian. It didn’t work right away, I had to play with the parameters. It worked for me when I commented these lines: #refuse-eap #refuse-pap #refuse-chap #refuse-mschap #refuse-mschap-v2 #require-mschap-v2 in /etc/ppp/...


1

I don't think you can push a route to the client in a L2TP/IPSEC VPN. You will have to do the configuration directly on the client. What mobile client is it you are having trouble with? It's easier to provide some input if we know the operating system and software you are using.


1

I've had this same problem, and it turned out that the local Windows firewall was blocking the connection. This guide helped me add the correct ports. Basically you need to open UDP Ports '50, 500, 4500' https://www.magnumvpn.com/setup-windows-10-firewall-l2tp.html


1

As far as I know (please correct me if I'm wrong) L2TP/IPSEC doesn't work on port 80 (due to different protocol (!=TCP)), maybe you want to look into OpenVPN - Open Source VPN as a end solution for yourself.


1

add "ATTRIBUTE Acct-Interim-Interval 85 integer" to /etc/radiusclient/dictionary and return Acct-Interim-Interval in /etc/raddb/users or radreply sql table or others ways you like. here is the solution: http://lists.freeradius.org/pipermail/freeradius-users/2007-March/016817.html


1

After breaking my head over this the workarround was so easy. If the VPN client connects it get an IP from the main DHCP server than all network traffic is blocked. You must use a DHCP scope from the RRAS. When i set the scope everything worked instantly !


Only top voted, non community-wiki answers of a minimum length are eligible