Bender007
Tux's lil' helper
Joined: 11 Aug 2003
Posts: 110
Location: Göttingen
|
 Posted: Tue Jan 04, 2005 10:46 am Post subject: Ipsec-Tools + l2tpd |
 |
|
Hi guys
i'm trying to install the ipsec-tools-0.5.beta2 + l2tpd, the ipsec installation works very fine a connection is set up and a tunnel is established but the l2tpd deamon does not response.
Here is the log file from racoon when i'm trying to connect from external:
| Quote: | Dec 7 21:22:49 [racoon] INFO: respond new phase 1 negotiation: 217.226.221.58[500]<=>217.84.226.70[500]_
Dec 7 21:22:49 [racoon] INFO: begin Identity Protection mode._
Dec 7 21:22:49 [racoon] INFO: received Vendor ID: MS NT5 ISAKMPOAKLEY_
Dec 7 21:22:49 [racoon] INFO: ISAKMP-SA established 217.226.221.58[500]-217.84.226.70[500] spi:36f670d18328c321:9a76ba7ff94a74e1_
Dec 7 21:22:49 [racoon] INFO: respond new phase 2 negotiation: 217.226.221.58[0]<=>217.84.226.70[0]_
Dec 7 21:22:49 [racoon] INFO: no policy found, try to generate the policy : 192.168.0.2/32[1701] 217.226.221.58/32[0] proto=udp dir=in_
Dec 7 21:22:49 [racoon] INFO: IPsec-SA established: ESP/Transport 217.84.226.70->217.226.221.58 spi=1684565(0x19b455)_
Dec 7 21:22:49 [racoon] INFO: IPsec-SA established: ESP/Transport 217.226.221.58->217.84.226.70 spi=4071072641(0xf2a7a381)_
Dec 7 21:22:49 [racoon] ERROR: such policy does not already exist: 192.168.0.2/32[1701] 217.226.221.58/32[0] proto=udp dir=in_
Dec 7 21:22:49 [racoon] ERROR: such policy does not already exist: 217.226.221.58/32[0] 192.168.0.2/32[1701] proto=udp dir=out_
Dec 7 21:23:24 [racoon] INFO: purged IPsec-SA proto_id=ESP spi=4071072641._
Dec 7 21:23:24 [racoon] INFO: purged ISAKMP-SA proto_id=ISAKMP spi=36f670d18328c321:9a76ba7ff94a74e1._ |
When i try to connect from external (WAN) to my VPN server the ipsec connection is established but l2tpd says nothing.
A connect from my internal network worked really great a ipsec and l2tpd connection is established and seems to be working.
My l2tpd:
l2tpd
Description: Layer 2 Tunnelling Protocol Daemon
Website: http://www.l2tpd.org/
Ebuilds: 0.70_pre20031121
I'm using a 2.6.9 Kernel
Please i hope someone has a great idea or something 
I searched google and other forums for this error and asked other network people. The last thing i tried was to bind the port 1701 to my local device 192.168.0.1:1701... but doesn't work...
| Quote: | iptables -A INPUT -i ppp0 -m state --state NEW -p udp --dport 1701 -j ACCEPT
iptables -A FORWARD -i ppp0 -o eth0 -p udp --dport 1701 -j ACCEPT
iptables -t nat -A PREROUTING -p udp --dport 1701 -i ppp0 -j DNAT --to-destination 192.168.0.1:1701 |
sorry my english is not really good  |
|
Networking & Security
