You are not logged in.
Pages: 1
Hi.
I try to configure l2tp using this article.
☺ @etc $ ipsec verify
Checking if IPsec got installed and started correctly:
Version check and ipsec on-path [OK]
Openswan U2.6.52.1/K5.7.7-arch1-1 (netkey)
See `ipsec --copyright' for copyright information.
Checking for IPsec support in kernel [OK]
NETKEY: Testing XFRM related proc values
ICMP default/send_redirects [NOT DISABLED]
Disable /proc/sys/net/ipv4/conf/*/send_redirects or NETKEY will cause act on or cause sending of bogus ICMP redirects!
ICMP default/accept_redirects [NOT DISABLED]
Disable /proc/sys/net/ipv4/conf/*/accept_redirects or NETKEY will cause act on or cause sending of bogus ICMP redirects!
XFRM larval drop [OK]
Hardware random device check [N/A]
Two or more interfaces found, checking IP forwarding [OK]
Checking rp_filter [OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for IKE on tcp 500 [NOT IMPLEMENTED]
Pluto listening for IKE/NAT-T on udp 4500 [OK]
Pluto listening for IKE/NAT-T on tcp 4500 [NOT IMPLEMENTED]
Pluto listening for IKE on tcp 10000 (cisco) [NOT IMPLEMENTED]
Checking NAT and MASQUERADEing [TEST INCOMPLETE]
Checking 'ip' command [OK]
Checking 'iptables' command [OK]
ipsec verify: encountered errorsthere is my ipsec.conf:
# /etc/ipsec.conf - Openswan IPsec configuration file
# This file: /usr/share/doc/openswan/ipsec.conf-sample
#
# Manual: ipsec.conf.5
version 2.0 # conforms to second version of ipsec.conf specification
# basic configuration
config setup
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
protostack=netkey
plutoopts="--interface=wlan0"
conn L2TP-PSK
authby=secret
pfs=no
keyingtries=3
dpddelay=30
dpdtimeout=120
dpdaction=clear
rekey=yes
ikelifetime=8h
keylife=1h
type=transport
left=1.1.1.1 # there is my local ip
leftprotoport=17/1701
right=2.2.2.2 # there is my vpn ip
rightprotoport=17/1701
auto=addthere is my /etc/ipsec.secrets:
1.1.1.1 2.2.2.2 : PSK "mypsk"After that I add the connection
☺ @etc $ sudo ipsec auto --add L2TP-PSK
002 "L2TP-PSK": deleting connection
002 adding connection: "L2TP-PSK"I skipped step "Running Openswan in a container" because i don't understand what I should do in this step.
there is my /etc/xl2tpd/xl2tpd.conf:
☺ @etc $ cat /etc/xl2tpd/xl2tpd.conf
[lac vpn-connection]
lns = 2.2.2.2 # my vpn ip
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tpd.client
length bit = yesthere is my /etc/ppp/options.l2tpd.client:
☺ @etc $ cat /etc/ppp/options.l2tpd.client
ipcp-accept-local
ipcp-accept-remote
refuse-eap
require-mschap-v2
noccp
noauth
idle 1800
mtu 1410
mru 1410
defaultroute
usepeerdns
debug
connect-delay 5000
name myname
password mypwdafter that I run next commands:
☺ @etc $ systemctl start openswan
==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ====
Authentication is required to start 'openswan.service'.
Authenticating as: root
Password:
==== AUTHENTICATION COMPLETE ==== ☺ @etc $ systemctl start xl2tpd
==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ====
Authentication is required to start 'xl2tpd.service'.
Authenticating as: root
Password:
==== AUTHENTICATION COMPLETE ==== ☺ @etc $ sudo ipsec auto --up L2TP-PSK
002 "L2TP-PSK" #1: initiating Main Mode
105 "L2TP-PSK" #1: STATE_MAIN_I1: initiate
003 "L2TP-PSK" #1: received Vendor ID payload [RFC 3947] method set to=115
003 "L2TP-PSK" #1: received Vendor ID payload [Dead Peer Detection]
002 "L2TP-PSK" #1: enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal)
002 "L2TP-PSK" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
107 "L2TP-PSK" #1: STATE_MAIN_I2: sent MI2, expecting MR2
003 "L2TP-PSK" #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): i am NATed
002 "L2TP-PSK" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
109 "L2TP-PSK" #1: STATE_MAIN_I3: sent MI3, expecting MR3
002 "L2TP-PSK" #1: Main mode peer ID is ID_IPV4_ADDR: '2.2.2.2'
002 "L2TP-PSK" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4
004 "L2TP-PSK" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY oursig= theirsig= cipher=aes_128 prf=oakley_sha group=modp2048}
002 "L2TP-PSK" #1: Dead Peer Detection (RFC 3706): enabled
002 "L2TP-PSK" #2: initiating Quick Mode PSK+ENCRYPT+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:c9345cde proposal=defaults pfsgroup=no-pfs}
118 "L2TP-PSK" #2: STATE_QUICK_I1: initiate
003 "L2TP-PSK" #2: NAT-Traversal: received 2 NAT-OA. ignored because peer is not NATed
002 "L2TP-PSK" #2: Dead Peer Detection (RFC 3706): enabled
002 "L2TP-PSK" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
004 "L2TP-PSK" #2: STATE_QUICK_I2: sent QI2, IPsec SA established transport mode {ESP=>0x04ebcc2c <0xfc2b7ff1 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=enabled} ☺ @etc $ echo "c vpn-connection" | sudo tee /var/run/xl2tpd/l2tp-control
c vpn-connectionafter that I check interface for tunnel using:
☺ @etc $ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp4s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether b4:2e:99:d8:1e:cd brd ff:ff:ff:ff:ff:ff
3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DORMANT group default qlen
1000
link/ether d0:37:45:5e:cb:b2 brd ff:ff:ff:ff:ff:ff
4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default
link/ether 02:42:1c:c9:34:f6 brd ff:ff:ff:ff:ff:ffbut i don't see pppx device.
What i'm doing wrong?
openswan and xl2tpd services are runned:
☺ @etc $ systemctl status openswan
● openswan.service - Openswan daemon
Loaded: loaded (/usr/lib/systemd/system/openswan.service; enabled; vendor preset: disabled)
Active: active (running) since Sun 2020-07-12 23:56:02 +03; 7min ago
Process: 2293 ExecStart=/usr/lib/systemd/scripts/ipsec --start (code=exited, status=0/SUCCESS)
Tasks: 11 (limit: 19111)
Memory: 5.5M
CGroup: /system.slice/openswan.service
├─2384 /bin/sh /usr/lib/ipsec/_plutorun --debug --uniqueids yes --force_busy no --nocrse>
├─2385 logger -s -p daemon error -t ipsec__plutorun
├─2386 /bin/sh /usr/lib/ipsec/_plutorun --debug --uniqueids yes --force_busy no --nocrse>
├─2387 /bin/sh /usr/lib/ipsec/_plutoload --wait no --post
├─2390 /usr/lib/openswan/pluto --nofork --secretsfile /etc/ipsec.secrets --ipsecdir /etc/>
├─2391 _pluto_adns -- <idle>
├─2393 /usr/lib/openswan/pluto -- pluto helper wlan0 # 0
├─2394 /usr/lib/openswan/pluto -- pluto helper wlan0 # 1
├─2395 /usr/lib/openswan/pluto -- pluto helper wlan0 # 2
├─2396 /usr/lib/openswan/pluto -- pluto helper wlan0 # 3
└─2397 /usr/lib/openswan/pluto -- pluto helper wlan0 # 4 ☺ @etc $ systemctl status xl2tpd
● xl2tpd.service - Level 2 Tunnel Protocol Daemon (L2TP)
Loaded: loaded (/usr/lib/systemd/system/xl2tpd.service; disabled; vendor preset: disabled)
Active: active (running) since Sun 2020-07-12 23:56:29 +03; 7min ago
Main PID: 2430 (xl2tpd)
Tasks: 1 (limit: 19111)
Memory: 880.0K
CGroup: /system.slice/xl2tpd.service
└─2430 /usr/bin/xl2tpd -Dfor some reason i don't have ipsec.service
☺ @etc $ systemctl status ipsec
Unit ipsec.service could not be found.Offline
i stopped openswan service and tried to run it using:
☺ @etc $ sudo ipsec up L2TP-PSK
initiating IKE_SA L2TP-PSK[1] to <myvpnip>
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
retransmit 1 of request with message ID 0
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
retransmit 2 of request with message ID 0
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
retransmit 3 of request with message ID 0
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
retransmit 4 of request with message ID 0
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
retransmit 5 of request with message ID 0
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
giving up after 5 retransmits
peer not responding, trying again (2/3)
initiating IKE_SA L2TP-PSK[1] to <myvpnip>
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
retransmit 1 of request with message ID 0
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
retransmit 2 of request with message ID 0
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
retransmit 3 of request with message ID 0
sending packet: from 192.168.100.5[500] to <myvpnip>500] (1000 bytes)
retransmit 4 of request with message ID 0
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
retransmit 5 of request with message ID 0
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
giving up after 5 retransmits
peer not responding, trying again (3/3)
initiating IKE_SA L2TP-PSK[1] to <myvpnip>
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
retransmit 1 of request with message ID 0
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
retransmit 2 of request with message ID 0
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
retransmit 3 of request with message ID 0
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
retransmit 4 of request with message ID 0
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
retransmit 5 of request with message ID 0
sending packet: from 192.168.100.5[500] to <myvpnip>[500] (1000 bytes)
giving up after 5 retransmits
establishing IKE_SA failed, peer not responding
establishing connection 'L2TP-PSK' failedI'm created l2tp connection on Ubuntu using network manager. And I set NT domain, can someone answer me what does the NT domain mean? Maybe i should set this option somewhere in my configs?
Offline
If you got the VPN connection working with network-manager-l2tp on Ubuntu, is there any reason you are not using the networkmanager-l2tp package from AUR?
I'm guessing you needed to use the command-line instead of a GUI. If so, then you could use the NetworkManager CLI with the `nmcli` command as an alternative.
list all NM connections:
nmcli conbring up VPN connection:
nmcli con up id VPN-Connection-Namebring down VPN connection:
nmcli con down id VPN-Connection-NameWhere VPN-Connection-Name is the actual name of the VPN connection as listed in the nmcli con output.
You'll need to copy the corresponding NetworkManager VPN connection profile file which is stored under /etc/NetworkManager/system-connections/ from the desktop Ubuntu to the computer you want to use the command-line.
To pickup the new VPN connection profile file (or even changes to that file if you edit it), issue the following:
nmcli con reloadTo use networkmanager-l2tp, you will need to replace openswan with strongswan, I'm suggesting strongswan as that was most likely what you were using on Ubuntu. You might need to do `sudo rm rf /etc/ipsec*` after uninstalling openswan.
`systemctl status ipsec` works if you have libreswan installed, not openswan. As you've discovered `systemctl status openswan` works with openswan. But `sudo ipsec status` should work with any of the *swans. Most other linux distros no longer include openswan, most include either libreswan or strongswan or both.
NT Domain is the Windows domain the L2TP server running on Windows Server is using, lets assume the NT Domain field is set to DOMAIN, then it is equivalent to specifying DOMAIN\username (i.e. Down-Level Logon Name format), or username@domain.com (i.e. User Principal Name (UPN) format) for the username.
Last edited by dkosovic (2020-07-16 18:53:22)
Offline
Forgot to mention, it is hard to tell what is going wrong with your xl2tpd connection as you haven't posted any xl2tpd and pppd log output from `journalctl`
Offline
Pages: 1