Arch Linux

Cooleech

Member

From: Solin, Croatia

Registered: 2015-01-23

Posts: 44

L2TP connection stopped working

Since yesterday, when I did 'pacman -Syu' on my Arch Linux (KDE Plasma), L2TP connection to company's VPN doesn't work anymore.
Last succesful connection was on 7th of September (4 days ago). I have a few Arch Linux VM's with that same VPN connection set and those work just fine since I didn't update them yet.

Error I get: Starting the service providing the VPN connection 'B VPN' failed.

I've reinstalled networkmanager-strongswan, strongswan, networkmanager-l2tp, networkmanager-vpn-plugin-l2tp and xl2tpd packages but nothing helped.
I've checked both passwords (pre-shared key (PSK) and my VPN password) and everything is just fine. If I can give you any additional info, just ask me.

Thank you for your help in advance!

Cooleech

Member

From: Solin, Croatia

Registered: 2015-01-23

Posts: 44

Re: L2TP connection stopped working

systemctl status NetworkManager
● NetworkManager.service - Network Manager
     Loaded: loaded (/usr/lib/systemd/system/NetworkManager.service; enabled; preset: disabled)
     Active: active (running) since Fri 2026-09-11 16:26:50 CEST; 1h 21min ago
 Invocation: d87eb1f41d3646db8239aa1465afcc10
       Docs: man:NetworkManager(8)
   Main PID: 441 (NetworkManager)
      Tasks: 4 (limit: 19017)
     Memory: 20.7M (peak: 28.9M)
        CPU: 3.801s
     CGroup: /system.slice/NetworkManager.service
             └─441 /usr/bin/NetworkManager --no-daemon

ruj 11 17:26:07 EliteDesk charon[10534]: 00[IKE] uninstalling bypass policy for 192.168.0.0/24
ruj 11 17:26:15 EliteDesk ipsec_starter[10532]: starter_stop_charon(): charon does not respond, sending KILL
ruj 11 17:26:15 EliteDesk ipsec_starter[10532]: child 10534 (charon) has been killed by sig 9
ruj 11 17:26:15 EliteDesk ipsec_starter[10532]: 
ruj 11 17:26:15 EliteDesk ipsec_starter[10532]: charon stopped after 8200 ms
ruj 11 17:26:15 EliteDesk ipsec_starter[10532]: ipsec starter stopped
ruj 11 17:26:15 EliteDesk nm-l2tp-service[10514]: Could not establish IPsec connection.
ruj 11 17:26:15 EliteDesk NetworkManager[441]: <warn>  [1789140375.9529] vpn[0x55ff7c5e6920,40856e03-1386-4801-ac19-c0cb9af6e586,"B VPN"]: failed to connect: 'Could not establish IPsec connection.'
ruj 11 17:26:17 EliteDesk NetworkManager[441]: <info>  [1789140377.4301] audit: op="statistics" interface="eno1" ifindex=2 args="0" pid=910 uid=1000 result="success"
ruj 11 17:26:17 EliteDesk NetworkManager[441]: <info>  [1789140377.4346] audit: op="statistics" interface="eno1" ifindex=2 args="500" pid=1030 uid=1000 result="success"

-thc

Member

Registered: 2017-03-15

Posts: 1,179

Re: L2TP connection stopped working

Preserve a full log from the VPN connection phase.

Derive which update caused the error by analyzing "/var/log/pacman.log" (Look for lines with "upgraded").

Roll back the suspicious packages by downloading the older version from the Arch archive server and installing them via

sudo pacman -U older_package.pkg.tar.zstd

If it works again - compare the system log while connecting to the VPN to the faulty behavior.

Last edited by -thc (Yesterday 16:05:14)

loqs

Member

Registered: 2014-03-06

Posts: 19,057

Re: L2TP connection stopped working

strongswan  6.1.0 disables IKE1 by default. https://gitlab.archlinux.org/archlinux/ … ote_553014
Does you company provide any alternative protocols you could connect with instead?

Cooleech

Member

From: Solin, Croatia

Registered: 2015-01-23

Posts: 44

Re: L2TP connection stopped working

strongswan  6.1.0 disables IKE1 by default. https://gitlab.archlinux.org/archlinux/ … ote_553014
Does you company provide any alternative protocols you could connect with instead?

Welp, since I did clean pacman's cache right after that update (disk was almost full), I guess I have to download previous strongswan version then.
Would libreswan package from AUR fix my problem? And if yes, will that move from AUR to core or extra repo?

Unfortunately, this IKEv1 protocol is the only way they provide for me to connect to that VPN network which is frustrating since it also doesn't work on my cellphone (iirc, since Android v11 l2tp is disabled).
Thank you @-thc and @loqs for your feedback.

EDIT: after downgrading from strongswan-6.1.0-2 to strongswan-6.0.7-1, now everything is back in order.

Last edited by Cooleech (Today 04:54:01)

loqs

Member

Registered: 2014-03-06

Posts: 19,057

Re: L2TP connection stopped working

after downgrading from strongswan-6.1.0-2 to strongswan-6.0.7-1, now everything is back in order.

Please consider building strongswan 6.1.0 locally with IKE1 enabled so you benefit from the security fixes in the 6.1.0 release.  This will also prepare your system for the openssl 4.0 update that will break strongswan-6.0.7-1.

Cooleech

Member

From: Solin, Croatia

Registered: 2015-01-23

Posts: 44

Re: L2TP connection stopped working

after downgrading from strongswan-6.1.0-2 to strongswan-6.0.7-1, now everything is back in order.

Please consider building strongswan 6.1.0 locally with IKE1 enabled so you benefit from the security fixes in the 6.1.0 release.  This will also prepare your system for the openssl 4.0 update that will break strongswan-6.0.7-1.

Well, I have no idea even where to begin with building my own strongswan 6.1.x version. Also, that would be just patching the problem.
Our network guys REALLY should switch to IKEv2 VPN's or I'll create a VM with Debian stable to keep this VPN working. This makes me feel sad, I must say.

Last edited by Cooleech (Today 19:23:23)