# OpenSwan L2TP/IPsec VPN server Help

## dashnu

I have been using this guide http://www.jacco2.dds.nl/networking/freeswan-l2tp.html  and this guide http://megaz.arbuz.com/archives/2005/01/28/linux-vpn-guide/1/  for setting up a vpn. What a project this has turned out to be.

I have gone through this sever 1000 times and fixed many errors but I am stuck on this error.

I can start openswan fine. 

```
Mar  4 17:19:23 dulcinea ipsec__plutorun: Starting Pluto subsystem...

Mar  4 17:19:23 dulcinea pluto[31359]: Starting Pluto (Openswan Version 2.2.0 X.509-1.5.4 PLUTO_USES_KEYRR)

Mar  4 17:19:23 dulcinea pluto[31359]:   including NAT-Traversal patch (Version 0.6c)

Mar  4 17:19:23 dulcinea pluto[31359]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)

Mar  4 17:19:23 dulcinea pluto[31359]: Using Linux 2.6 IPsec interface code

Mar  4 17:19:23 dulcinea pluto[31359]: Changing to directory '/etc/ipsec/ipsec.d/cacerts'

Mar  4 17:19:23 dulcinea pluto[31359]:   loaded CA cert file 'cacert.pem' (1147 bytes)

Mar  4 17:19:23 dulcinea pluto[31359]: Could not change to directory '/etc/ipsec/ipsec.d/aacerts'

Mar  4 17:19:23 dulcinea pluto[31359]: Changing to directory '/etc/ipsec/ipsec.d/ocspcerts'

Mar  4 17:19:23 dulcinea pluto[31359]: Changing to directory '/etc/ipsec/ipsec.d/crls'

Mar  4 17:19:23 dulcinea pluto[31359]:   loaded crl file 'crl.pem' (467 bytes)

Mar  4 17:19:23 dulcinea pluto[31359]: added connection description "roadwarrior-l2tp"

Mar  4 17:19:23 dulcinea pluto[31359]: added connection description "roadwarrior"

Mar  4 17:19:23 dulcinea pluto[31359]: added connection description "roadwarrior-all"

Mar  4 17:19:23 dulcinea pluto[31359]: added connection description "roadwarrior-net"

Mar  4 17:19:23 dulcinea pluto[31359]: added connection description "roadwarrior-l2tp-updatedwin"

Mar  4 17:19:23 dulcinea pluto[31359]: listening for IKE messages

Mar  4 17:19:23 dulcinea pluto[31359]: adding interface lo/lo 127.0.0.1

Mar  4 17:19:23 dulcinea pluto[31359]: adding interface lo/lo 127.0.0.1:4500

Mar  4 17:19:23 dulcinea pluto[31359]: adding interface eth0/eth0 192.168.1.251

Mar  4 17:19:23 dulcinea pluto[31359]: adding interface eth0/eth0 192.168.1.251:4500

Mar  4 17:19:23 dulcinea pluto[31359]: adding interface lo/lo ::1

Mar  4 17:19:23 dulcinea pluto[31359]: loading secrets from "/etc/ipsec/ipsec.secrets"
```

I do have a minor issue when starting l2tpd

```
/etc/init.d/l2tpd restart

 * Stopping l2tpd...                                                      [ ok ] * Starting l2tpd...

This binary does not support kernel L2TP.                                 [ ok ]

```

and this in my logs

```
Mar  4 17:20:55 dulcinea l2tpd[30876]: death_handler: Fatal signal 15 received

Mar  4 17:20:56 dulcinea l2tpd[31585]: This binary does not support kernel L2TP.Mar  4 17:20:56 dulcinea l2tpd[31586]: l2tpd version 0.69 started on dulcinea PID:31586

Mar  4 17:20:56 dulcinea l2tpd[31586]: Linux version 2.6.9-gentoo-r9 on a i686, listening on IP address 0.0.0.0, port 1701
```

Error when trying to connect to it via windows client.

```
Mar  4 17:23:43 dulcinea pluto[31359]: packet from 192.168.1.98:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]

Mar  4 17:23:43 dulcinea pluto[31359]: packet from 192.168.1.98:500: ignoring Vendor ID payload [FRAGMENTATION]

Mar  4 17:23:43 dulcinea pluto[31359]: packet from 192.168.1.98:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]

Mar  4 17:23:43 dulcinea pluto[31359]: packet from 192.168.1.98:500: ignoring Vendor ID payload [26244d38eddb61b3172a36e3d0cfb819]

Mar  4 17:23:43 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: responding to Main Mode from unknown peer 192.168.1.98

Mar  4 17:23:43 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: transition from state (null) to state STATE_MAIN_R1

Mar  4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: no NAT detected

Mar  4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2

Mar  4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: Peer ID is ID_IPV4_ADDR: '192.168.1.98'

Mar  4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: I did not send a certificate because I do not have one.

Mar  4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3

Mar  4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: sent MR3, ISAKMP SA established

Mar  4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #2: responding to Quick Mode

Mar  4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #2: transition from state (null) to state STATE_QUICK_R1

Mar  4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #2: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2

Mar  4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #2: IPsec SA established {ESP=>0xbfe8b650 <0x6ab1ceb3}

Mar  4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: received Delete SA(0xbfe8b650) payload: deleting IPSEC State #2

Mar  4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: received and ignored informational message

Mar  4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: received Delete SA payload: deleting ISAKMP State #1

Mar  4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98: deleting connection "roadwarrior-l2tp" instance with peer 192.168.1.98 {isakmp=#0/ipsec=#0}

Mar  4 17:23:44 dulcinea pluto[31359]: packet from 192.168.1.98:500: received and ignored informational message
```

This seems to be a dead topic on the forums but one can hope there is someone out there with the experience  :Wink: 

----------

## dashnu

erhhm ?

----------

## dashnu

I have finally made a connection from a windows box.  All works wonders but if the client is has a nat set up The connection fails!

```
pluto[25779]: "roadwarrior-l2tp"[3] 24.XX.XX.XX #6: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: both are NATed
```

When I finally get this all working I will type up a gentoo how-to for it.  If I ever get this fully working  :Rolling Eyes: 

----------

## ldbl

you must use Nat Traversal patch

----------

## dashnu

the patch is included

----------

## dashnu

I can connect fine internally but of course that is not what i want. 

```
Apr 11 11:29:52 dulcinea ipsec_setup: Starting Openswan IPsec U2.2.0/K2.6.9-gentoo-r9...

Apr 11 11:29:52 dulcinea ipsec_setup: KLIPS ipsec0 on eth0 192.168.1.251/255.255.255.0 broadcast 192.168.1.255 mtu 1410

Apr 11 11:29:52 dulcinea ipsec_setup: ...Openswan IPsec started

Apr 11 11:30:36 dulcinea syslog-ng[6266]: STATS: dropped 0

Apr 11 11:31:05 dulcinea l2tpd[32224]: ourtid = 6210, entropy_buf = 1842

Apr 11 11:31:05 dulcinea l2tpd[32224]: ourcid = 38045, entropy_buf = 949d

Apr 11 11:31:05 dulcinea l2tpd[32224]: check_control: control, cid = 0, Ns = 0, Nr = 0

Apr 11 11:31:05 dulcinea l2tpd[32224]: handle_avps: handling avp's for tunnel 6210, call 38045

Apr 11 11:31:05 dulcinea l2tpd[32224]: message_type_avp: message type 1 (Start-Control-Connection-Request)

Apr 11 11:31:05 dulcinea l2tpd[32224]: protocol_version_avp: peer is using version 1, revision 0.

Apr 11 11:31:05 dulcinea l2tpd[32224]: framing_caps_avp: supported peer frames: sync

Apr 11 11:31:05 dulcinea l2tpd[32224]: bearer_caps_avp: supported peer bearers:

Apr 11 11:31:05 dulcinea l2tpd[32224]: firmware_rev_avp: peer reports firmware version 1280 (0x0500)

Apr 11 11:31:05 dulcinea l2tpd[32224]: hostname_avp: peer reports hostname 'demo1'

Apr 11 11:31:05 dulcinea l2tpd[32224]: vendor_avp: peer reports vendor 'Microsoft'

Apr 11 11:31:05 dulcinea l2tpd[32224]: assigned_tunnel_avp: using peer's tunnel 1

Apr 11 11:31:05 dulcinea l2tpd[32224]: receive_window_size_avp: peer wants RWS of 8.  Will use flow control.

Apr 11 11:31:05 dulcinea l2tpd[32224]: check_control: control, cid = 0, Ns = 1, Nr = 1

Apr 11 11:31:05 dulcinea l2tpd[32224]: handle_avps: handling avp's for tunnel 6210, call 38045

Apr 11 11:31:05 dulcinea l2tpd[32224]: message_type_avp: message type 3 (Start-Control-Connection-Connected)

Apr 11 11:31:05 dulcinea l2tpd[32224]: control_finish: Connection established to 192.168.1.93, 1701.  Local: 6210, Remote: 1.  LNS session is 'default'

Apr 11 11:31:05 dulcinea l2tpd[32224]: check_control: control, cid = 0, Ns = 2, Nr = 1

Apr 11 11:31:05 dulcinea l2tpd[32224]: handle_avps: handling avp's for tunnel 6210, call 38045

Apr 11 11:31:05 dulcinea l2tpd[32224]: message_type_avp: message type 10 (Incoming-Call-Request)

Apr 11 11:31:05 dulcinea l2tpd[32224]: message_type_avp: new incoming call

Apr 11 11:31:05 dulcinea l2tpd[32224]: ourcid = 32842, entropy_buf = 804a

Apr 11 11:31:05 dulcinea l2tpd[32224]: assigned_session_avp: assigned session id: 1

Apr 11 11:31:05 dulcinea l2tpd[32224]: call_serno_avp: serial number is 0

Apr 11 11:31:05 dulcinea l2tpd[32224]: bearer_type_avp: peer bears: analog

Apr 11 11:31:05 dulcinea l2tpd[32224]: check_control: control, cid = 1, Ns = 3, Nr = 2

Apr 11 11:31:05 dulcinea l2tpd[32224]: handle_avps: handling avp's for tunnel 6210, call 32842

Apr 11 11:31:05 dulcinea l2tpd[32224]: message_type_avp: message type 12 (Incoming-Call-Connected)

Apr 11 11:31:05 dulcinea l2tpd[32224]: tx_speed_avp: transmit baud rate is 10000000

Apr 11 11:31:05 dulcinea l2tpd[32224]: frame_type_avp: peer uses:sync frames

Apr 11 11:31:05 dulcinea l2tpd[32224]: ignore_avp : Ignoring AVP

Apr 11 11:31:05 dulcinea l2tpd[32224]: start_pppd: I'm running:

Apr 11 11:31:05 dulcinea l2tpd[32224]: "/usr/sbin/pppd"

Apr 11 11:31:05 dulcinea l2tpd[32224]: "passive"

Apr 11 11:31:05 dulcinea l2tpd[32224]: "-detach"

Apr 11 11:31:05 dulcinea l2tpd[32224]: "192.168.1.251:192.168.1.128"

Apr 11 11:31:05 dulcinea l2tpd[32224]: "refuse-pap"

Apr 11 11:31:05 dulcinea l2tpd[32224]: "auth"

Apr 11 11:31:05 dulcinea l2tpd[32224]: "require-chap"

Apr 11 11:31:05 dulcinea l2tpd[32224]: "name"

Apr 11 11:31:05 dulcinea l2tpd[32224]: "LinuxVPN"

Apr 11 11:31:05 dulcinea l2tpd[32224]: "debug"

Apr 11 11:31:05 dulcinea l2tpd[32224]: "file"

Apr 11 11:31:05 dulcinea l2tpd[32224]: "/etc/ppp/options.l2tpd"

Apr 11 11:31:05 dulcinea l2tpd[32224]: "/dev/ttyp0"

Apr 11 11:31:05 dulcinea l2tpd[32224]:

Apr 11 11:31:05 dulcinea l2tpd[32224]: control_finish: Call established with 192.168.1.93, Local: 32842, Remote: 1, Serial: 0

Apr 11 11:31:05 dulcinea pppd[21717]: pppd 2.4.2 started by root, uid 0

Apr 11 11:31:05 dulcinea pppd[21717]: using channel 8

Apr 11 11:31:05 dulcinea pppd[21717]: Using interface ppp0

Apr 11 11:31:05 dulcinea pppd[21717]: Connect: ppp0 <--> /dev/ttyp0

Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [LCP ConfReq id=0x1 <mru 1400> <magic 0x287e3488> <pcomp> <accomp> <callback CBCP>]

Apr 11 11:31:07 dulcinea pppd[21717]: sent [LCP ConfReq id=0x1 <mru 1410> <asyncmap 0x0> <auth chap MD5> <magic 0xa6373742> <pcomp> <accomp>]

Apr 11 11:31:07 dulcinea pppd[21717]: sent [LCP ConfRej id=0x1 <callback CBCP>]

Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [LCP ConfAck id=0x1 <mru 1410> <asyncmap 0x0> <auth chap MD5> <magic 0xa6373742> <pcomp> <accomp>]

Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [LCP ConfReq id=0x2 <mru 1400> <magic 0x287e3488> <pcomp> <accomp>]

Apr 11 11:31:07 dulcinea pppd[21717]: sent [LCP ConfAck id=0x2 <mru 1400> <magic 0x287e3488> <pcomp> <accomp>]

Apr 11 11:31:07 dulcinea pppd[21717]: sent [CHAP Challenge id=0xd6 <71cf0bafe53f56d4b473830028175b2abf8b0aa14dbe>, name = "LinuxVPN"]

Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [LCP code=0xc id=0x3 28 7e 34 88 4d 53 52 41 53 56 35 2e 31 30]

Apr 11 11:31:07 dulcinea pppd[21717]: sent [LCP CodeRej id=0x2 0c 03 00 12 28 7e 34 88 4d 53 52 41 53 56 35 2e 31 30]

Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [LCP code=0xc id=0x4 28 7e 34 88 4d 53 52 41 53 2d 30 2d 44 45 4d 4f 31]

Apr 11 11:31:07 dulcinea pppd[21717]: sent [LCP CodeRej id=0x3 0c 04 00 15 28 7e 34 88 4d 53 52 41 53 2d 30 2d 44 45 4d 4f 31]

Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [CHAP Response id=0xd6 <55ff66a6fe295256347d6c58fd19d77f>, name = "test"]

Apr 11 11:31:07 dulcinea pppd[21717]: sent [CHAP Success id=0xd6 "Access granted"]

Apr 11 11:31:07 dulcinea pppd[21717]: sent [IPCP ConfReq id=0x1 <compress VJ 0f 01> <addr 192.168.1.251>]

Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [CCP ConfReq id=0x5 <mppe +H -M -S -L -D +C>]

Apr 11 11:31:07 dulcinea pppd[21717]: Unsupported protocol 'Compression Control Protocol' (0x80fd) received

Apr 11 11:31:07 dulcinea pppd[21717]: sent [LCP ProtRej id=0x4 80 fd 01 05 00 0a 12 06 01 00 00 01]

Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [IPCP ConfReq id=0x6 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-wins 0.0.0.0> <ms-dns3 0.0.0.0> <ms-wins 0.0.0.0>]

Apr 11 11:31:07 dulcinea pppd[21717]: sent [IPCP ConfRej id=0x6 <ms-wins 0.0.0.0> <ms-wins 0.0.0.0>]

Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [IPCP ConfRej id=0x1 <compress VJ 0f 01>]

Apr 11 11:31:07 dulcinea pppd[21717]: sent [IPCP ConfReq id=0x2 <addr 192.168.1.251>]

Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [IPCP ConfReq id=0x7 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns3 0.0.0.0>]

Apr 11 11:31:07 dulcinea pppd[21717]: sent [IPCP ConfNak id=0x7 <addr 192.168.1.128> <ms-dns1 192.168.1.1> <ms-dns3 192.168.1.1>]

Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [IPCP ConfAck id=0x2 <addr 192.168.1.251>]

Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [IPCP ConfReq id=0x8 <addr 192.168.1.128> <ms-dns1 192.168.1.1> <ms-dns3 192.168.1.1>]

Apr 11 11:31:07 dulcinea pppd[21717]: sent [IPCP ConfAck id=0x8 <addr 192.168.1.128> <ms-dns1 192.168.1.1> <ms-dns3 192.168.1.1>]

Apr 11 11:31:07 dulcinea pppd[21717]: found interface eth0 for proxy arp

Apr 11 11:31:07 dulcinea pppd[21717]: local  IP address 192.168.1.251

Apr 11 11:31:07 dulcinea pppd[21717]: remote IP address 192.168.1.128

Apr 11 11:31:07 dulcinea pppd[21717]: Script /etc/ppp/ip-up started (pid 21733)

Apr 11 11:31:07 dulcinea pppd[21717]: Script /etc/ppp/ip-up finished (pid 21733), status = 0x1

```

So next I connect outside our network.  VPN behind Firewall nat and now a windows client behind a nat also...

```

Apr 11 11:47:31 dulcinea pluto[21508]: "roadwarrior-l2tp"[2] 24.XX.XX.162 #3: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: both are NATed

Apr 11 11:47:31 dulcinea pluto[21508]: "roadwarrior-l2tp"[2] 24.XX.XX.162 #3: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2

Apr 11 11:47:31 dulcinea pluto[21508]: "roadwarrior-l2tp"[2] 24.XX.XX.162 #3: Peer ID is ID_FQDN: '@demo1'

Apr 11 11:47:31 dulcinea pluto[21508]: "roadwarrior-l2tp"[3] 24.XX.XX.162 #3: deleting connection "roadwarrior-l2tp" instance with peer 24.XX.XX.162 {isakmp=#0/ipsec=#0}

Apr 11 11:47:31 dulcinea pluto[21508]: "roadwarrior-l2tp"[3] 24.XX.XX.162 #3: I did not send a certificate because I do not have one.

Apr 11 11:47:31 dulcinea pluto[21508]: "roadwarrior-l2tp"[3] 24.XX.XX.162 #3: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3

Apr 11 11:47:31 dulcinea pluto[21508]: | NAT-T: new mapping 24.XX.XX.162:500/4500)

Apr 11 11:47:31 dulcinea pluto[21508]: "roadwarrior-l2tp"[3] 24.XX.XX.162:4500 #3: sent MR3, ISAKMP SA established

Apr 11 11:47:31 dulcinea pluto[21508]: "roadwarrior-l2tp"[3] 24.XX.XX.162:4500 #3: cannot respond to IPsec SA request because no connection is known for 24.XX.XX.12/32===192.168.1.251:4500:17/1701...24.XX.XX.162:4500[@demo1]:17/1701

```

Stuck! And i can not figure this out.....

----------

## dashnu

welp just hacked my registry to fix an sp2 bug.. http://support.microsoft.com/default.aspx?kbid=885407

and still nothing same error server side no error client side anymore.

........ .............  :Confused:   :Confused:   :Confused:   :Confused:   :Evil or Very Mad:   :Evil or Very Mad: 

/me prays some knowledgeable vpn person sees this thread..

----------

## dashnu

Ok got it..  I used 2.3.0 and applied this patch http://www.jacco2.dds.nl/networking/patches/openswan-2.3.0-NATserver.patch

tar-ed up the src digested the build and emerged..

Now i can connect with the default winders client with NAT on both sides.

I shall work on a howto soon.

----------

