| View previous topic :: View next topic |
| Author |
Message |
dashnu
l33t
Joined: 21 Jul 2004
Posts: 703
Location: Casco Maine
|
 Posted: Fri Mar 04, 2005 10:26 pm Post subject: OpenSwan L2TP/IPsec VPN server Help |
 |
|
I have been using this guide http://www.jacco2.dds.nl/networking/freeswan-l2tp.html and this guide http://megaz.arbuz.com/archives/2005/01/28/linux-vpn-guide/1/ for setting up a vpn. What a project this has turned out to be.
I have gone through this sever 1000 times and fixed many errors but I am stuck on this error.
I can start openswan fine.
| Code: | Mar 4 17:19:23 dulcinea ipsec__plutorun: Starting Pluto subsystem...
Mar 4 17:19:23 dulcinea pluto[31359]: Starting Pluto (Openswan Version 2.2.0 X.509-1.5.4 PLUTO_USES_KEYRR)
Mar 4 17:19:23 dulcinea pluto[31359]: including NAT-Traversal patch (Version 0.6c)
Mar 4 17:19:23 dulcinea pluto[31359]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
Mar 4 17:19:23 dulcinea pluto[31359]: Using Linux 2.6 IPsec interface code
Mar 4 17:19:23 dulcinea pluto[31359]: Changing to directory '/etc/ipsec/ipsec.d/cacerts'
Mar 4 17:19:23 dulcinea pluto[31359]: loaded CA cert file 'cacert.pem' (1147 bytes)
Mar 4 17:19:23 dulcinea pluto[31359]: Could not change to directory '/etc/ipsec/ipsec.d/aacerts'
Mar 4 17:19:23 dulcinea pluto[31359]: Changing to directory '/etc/ipsec/ipsec.d/ocspcerts'
Mar 4 17:19:23 dulcinea pluto[31359]: Changing to directory '/etc/ipsec/ipsec.d/crls'
Mar 4 17:19:23 dulcinea pluto[31359]: loaded crl file 'crl.pem' (467 bytes)
Mar 4 17:19:23 dulcinea pluto[31359]: added connection description "roadwarrior-l2tp"
Mar 4 17:19:23 dulcinea pluto[31359]: added connection description "roadwarrior"
Mar 4 17:19:23 dulcinea pluto[31359]: added connection description "roadwarrior-all"
Mar 4 17:19:23 dulcinea pluto[31359]: added connection description "roadwarrior-net"
Mar 4 17:19:23 dulcinea pluto[31359]: added connection description "roadwarrior-l2tp-updatedwin"
Mar 4 17:19:23 dulcinea pluto[31359]: listening for IKE messages
Mar 4 17:19:23 dulcinea pluto[31359]: adding interface lo/lo 127.0.0.1
Mar 4 17:19:23 dulcinea pluto[31359]: adding interface lo/lo 127.0.0.1:4500
Mar 4 17:19:23 dulcinea pluto[31359]: adding interface eth0/eth0 192.168.1.251
Mar 4 17:19:23 dulcinea pluto[31359]: adding interface eth0/eth0 192.168.1.251:4500
Mar 4 17:19:23 dulcinea pluto[31359]: adding interface lo/lo ::1
Mar 4 17:19:23 dulcinea pluto[31359]: loading secrets from "/etc/ipsec/ipsec.secrets" |
I do have a minor issue when starting l2tpd
| Code: | /etc/init.d/l2tpd restart
* Stopping l2tpd... [ ok ] * Starting l2tpd...
This binary does not support kernel L2TP. [ ok ]
|
and this in my logs
| Code: | Mar 4 17:20:55 dulcinea l2tpd[30876]: death_handler: Fatal signal 15 received
Mar 4 17:20:56 dulcinea l2tpd[31585]: This binary does not support kernel L2TP.Mar 4 17:20:56 dulcinea l2tpd[31586]: l2tpd version 0.69 started on dulcinea PID:31586
Mar 4 17:20:56 dulcinea l2tpd[31586]: Linux version 2.6.9-gentoo-r9 on a i686, listening on IP address 0.0.0.0, port 1701 |
Error when trying to connect to it via windows client.
| Code: | Mar 4 17:23:43 dulcinea pluto[31359]: packet from 192.168.1.98:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
Mar 4 17:23:43 dulcinea pluto[31359]: packet from 192.168.1.98:500: ignoring Vendor ID payload [FRAGMENTATION]
Mar 4 17:23:43 dulcinea pluto[31359]: packet from 192.168.1.98:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
Mar 4 17:23:43 dulcinea pluto[31359]: packet from 192.168.1.98:500: ignoring Vendor ID payload [26244d38eddb61b3172a36e3d0cfb819]
Mar 4 17:23:43 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: responding to Main Mode from unknown peer 192.168.1.98
Mar 4 17:23:43 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: transition from state (null) to state STATE_MAIN_R1
Mar 4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: no NAT detected
Mar 4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Mar 4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: Peer ID is ID_IPV4_ADDR: '192.168.1.98'
Mar 4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: I did not send a certificate because I do not have one.
Mar 4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Mar 4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: sent MR3, ISAKMP SA established
Mar 4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #2: responding to Quick Mode
Mar 4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #2: transition from state (null) to state STATE_QUICK_R1
Mar 4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #2: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
Mar 4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #2: IPsec SA established {ESP=>0xbfe8b650 <0x6ab1ceb3}
Mar 4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: received Delete SA(0xbfe8b650) payload: deleting IPSEC State #2
Mar 4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: received and ignored informational message
Mar 4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98 #1: received Delete SA payload: deleting ISAKMP State #1
Mar 4 17:23:44 dulcinea pluto[31359]: "roadwarrior-l2tp"[1] 192.168.1.98: deleting connection "roadwarrior-l2tp" instance with peer 192.168.1.98 {isakmp=#0/ipsec=#0}
Mar 4 17:23:44 dulcinea pluto[31359]: packet from 192.168.1.98:500: received and ignored informational message |
This seems to be a dead topic on the forums but one can hope there is someone out there with the experience 
_________________
write quit bang |
|
| Back to top |
|
 |
dashnu
l33t
Joined: 21 Jul 2004
Posts: 703
Location: Casco Maine
|
| Posted: Sat Mar 05, 2005 7:04 pm Post subject: |
|
|
erhhm ?
_________________
write quit bang |
|
| Back to top |
|
|
dashnu
l33t
Joined: 21 Jul 2004
Posts: 703
Location: Casco Maine
|
| Posted: Mon Mar 07, 2005 5:31 pm Post subject: |
|
|
I have finally made a connection from a windows box. All works wonders but if the client is has a nat set up The connection fails!
| Code: | | pluto[25779]: "roadwarrior-l2tp"[3] 24.XX.XX.XX #6: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: both are NATed |
When I finally get this all working I will type up a gentoo how-to for it. If I ever get this fully working 
_________________
write quit bang |
|
| Back to top |
|
|
ldbl
n00b
Joined: 24 Mar 2005
Posts: 11
Location: Bulgaria
|
| Posted: Fri Apr 08, 2005 1:00 pm Post subject: use Nat-T |
|
|
| you must use Nat Traversal patch |
|
| Back to top |
|
|
dashnu
l33t
Joined: 21 Jul 2004
Posts: 703
Location: Casco Maine
|
| Posted: Mon Apr 11, 2005 4:24 pm Post subject: |
|
|
the patch is included
_________________
write quit bang |
|
| Back to top |
|
|
dashnu
l33t
Joined: 21 Jul 2004
Posts: 703
Location: Casco Maine
|
| Posted: Mon Apr 11, 2005 5:02 pm Post subject: |
|
|
I can connect fine internally but of course that is not what i want.
| Code: | Apr 11 11:29:52 dulcinea ipsec_setup: Starting Openswan IPsec U2.2.0/K2.6.9-gentoo-r9...
Apr 11 11:29:52 dulcinea ipsec_setup: KLIPS ipsec0 on eth0 192.168.1.251/255.255.255.0 broadcast 192.168.1.255 mtu 1410
Apr 11 11:29:52 dulcinea ipsec_setup: ...Openswan IPsec started
Apr 11 11:30:36 dulcinea syslog-ng[6266]: STATS: dropped 0
Apr 11 11:31:05 dulcinea l2tpd[32224]: ourtid = 6210, entropy_buf = 1842
Apr 11 11:31:05 dulcinea l2tpd[32224]: ourcid = 38045, entropy_buf = 949d
Apr 11 11:31:05 dulcinea l2tpd[32224]: check_control: control, cid = 0, Ns = 0, Nr = 0
Apr 11 11:31:05 dulcinea l2tpd[32224]: handle_avps: handling avp's for tunnel 6210, call 38045
Apr 11 11:31:05 dulcinea l2tpd[32224]: message_type_avp: message type 1 (Start-Control-Connection-Request)
Apr 11 11:31:05 dulcinea l2tpd[32224]: protocol_version_avp: peer is using version 1, revision 0.
Apr 11 11:31:05 dulcinea l2tpd[32224]: framing_caps_avp: supported peer frames: sync
Apr 11 11:31:05 dulcinea l2tpd[32224]: bearer_caps_avp: supported peer bearers:
Apr 11 11:31:05 dulcinea l2tpd[32224]: firmware_rev_avp: peer reports firmware version 1280 (0x0500)
Apr 11 11:31:05 dulcinea l2tpd[32224]: hostname_avp: peer reports hostname 'demo1'
Apr 11 11:31:05 dulcinea l2tpd[32224]: vendor_avp: peer reports vendor 'Microsoft'
Apr 11 11:31:05 dulcinea l2tpd[32224]: assigned_tunnel_avp: using peer's tunnel 1
Apr 11 11:31:05 dulcinea l2tpd[32224]: receive_window_size_avp: peer wants RWS of 8. Will use flow control.
Apr 11 11:31:05 dulcinea l2tpd[32224]: check_control: control, cid = 0, Ns = 1, Nr = 1
Apr 11 11:31:05 dulcinea l2tpd[32224]: handle_avps: handling avp's for tunnel 6210, call 38045
Apr 11 11:31:05 dulcinea l2tpd[32224]: message_type_avp: message type 3 (Start-Control-Connection-Connected)
Apr 11 11:31:05 dulcinea l2tpd[32224]: control_finish: Connection established to 192.168.1.93, 1701. Local: 6210, Remote: 1. LNS session is 'default'
Apr 11 11:31:05 dulcinea l2tpd[32224]: check_control: control, cid = 0, Ns = 2, Nr = 1
Apr 11 11:31:05 dulcinea l2tpd[32224]: handle_avps: handling avp's for tunnel 6210, call 38045
Apr 11 11:31:05 dulcinea l2tpd[32224]: message_type_avp: message type 10 (Incoming-Call-Request)
Apr 11 11:31:05 dulcinea l2tpd[32224]: message_type_avp: new incoming call
Apr 11 11:31:05 dulcinea l2tpd[32224]: ourcid = 32842, entropy_buf = 804a
Apr 11 11:31:05 dulcinea l2tpd[32224]: assigned_session_avp: assigned session id: 1
Apr 11 11:31:05 dulcinea l2tpd[32224]: call_serno_avp: serial number is 0
Apr 11 11:31:05 dulcinea l2tpd[32224]: bearer_type_avp: peer bears: analog
Apr 11 11:31:05 dulcinea l2tpd[32224]: check_control: control, cid = 1, Ns = 3, Nr = 2
Apr 11 11:31:05 dulcinea l2tpd[32224]: handle_avps: handling avp's for tunnel 6210, call 32842
Apr 11 11:31:05 dulcinea l2tpd[32224]: message_type_avp: message type 12 (Incoming-Call-Connected)
Apr 11 11:31:05 dulcinea l2tpd[32224]: tx_speed_avp: transmit baud rate is 10000000
Apr 11 11:31:05 dulcinea l2tpd[32224]: frame_type_avp: peer uses:sync frames
Apr 11 11:31:05 dulcinea l2tpd[32224]: ignore_avp : Ignoring AVP
Apr 11 11:31:05 dulcinea l2tpd[32224]: start_pppd: I'm running:
Apr 11 11:31:05 dulcinea l2tpd[32224]: "/usr/sbin/pppd"
Apr 11 11:31:05 dulcinea l2tpd[32224]: "passive"
Apr 11 11:31:05 dulcinea l2tpd[32224]: "-detach"
Apr 11 11:31:05 dulcinea l2tpd[32224]: "192.168.1.251:192.168.1.128"
Apr 11 11:31:05 dulcinea l2tpd[32224]: "refuse-pap"
Apr 11 11:31:05 dulcinea l2tpd[32224]: "auth"
Apr 11 11:31:05 dulcinea l2tpd[32224]: "require-chap"
Apr 11 11:31:05 dulcinea l2tpd[32224]: "name"
Apr 11 11:31:05 dulcinea l2tpd[32224]: "LinuxVPN"
Apr 11 11:31:05 dulcinea l2tpd[32224]: "debug"
Apr 11 11:31:05 dulcinea l2tpd[32224]: "file"
Apr 11 11:31:05 dulcinea l2tpd[32224]: "/etc/ppp/options.l2tpd"
Apr 11 11:31:05 dulcinea l2tpd[32224]: "/dev/ttyp0"
Apr 11 11:31:05 dulcinea l2tpd[32224]:
Apr 11 11:31:05 dulcinea l2tpd[32224]: control_finish: Call established with 192.168.1.93, Local: 32842, Remote: 1, Serial: 0
Apr 11 11:31:05 dulcinea pppd[21717]: pppd 2.4.2 started by root, uid 0
Apr 11 11:31:05 dulcinea pppd[21717]: using channel 8
Apr 11 11:31:05 dulcinea pppd[21717]: Using interface ppp0
Apr 11 11:31:05 dulcinea pppd[21717]: Connect: ppp0 <--> /dev/ttyp0
Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [LCP ConfReq id=0x1 <mru 1400> <magic 0x287e3488> <pcomp> <accomp> <callback CBCP>]
Apr 11 11:31:07 dulcinea pppd[21717]: sent [LCP ConfReq id=0x1 <mru 1410> <asyncmap 0x0> <auth chap MD5> <magic 0xa6373742> <pcomp> <accomp>]
Apr 11 11:31:07 dulcinea pppd[21717]: sent [LCP ConfRej id=0x1 <callback CBCP>]
Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [LCP ConfAck id=0x1 <mru 1410> <asyncmap 0x0> <auth chap MD5> <magic 0xa6373742> <pcomp> <accomp>]
Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [LCP ConfReq id=0x2 <mru 1400> <magic 0x287e3488> <pcomp> <accomp>]
Apr 11 11:31:07 dulcinea pppd[21717]: sent [LCP ConfAck id=0x2 <mru 1400> <magic 0x287e3488> <pcomp> <accomp>]
Apr 11 11:31:07 dulcinea pppd[21717]: sent [CHAP Challenge id=0xd6 <71cf0bafe53f56d4b473830028175b2abf8b0aa14dbe>, name = "LinuxVPN"]
Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [LCP code=0xc id=0x3 28 7e 34 88 4d 53 52 41 53 56 35 2e 31 30]
Apr 11 11:31:07 dulcinea pppd[21717]: sent [LCP CodeRej id=0x2 0c 03 00 12 28 7e 34 88 4d 53 52 41 53 56 35 2e 31 30]
Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [LCP code=0xc id=0x4 28 7e 34 88 4d 53 52 41 53 2d 30 2d 44 45 4d 4f 31]
Apr 11 11:31:07 dulcinea pppd[21717]: sent [LCP CodeRej id=0x3 0c 04 00 15 28 7e 34 88 4d 53 52 41 53 2d 30 2d 44 45 4d 4f 31]
Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [CHAP Response id=0xd6 <55ff66a6fe295256347d6c58fd19d77f>, name = "test"]
Apr 11 11:31:07 dulcinea pppd[21717]: sent [CHAP Success id=0xd6 "Access granted"]
Apr 11 11:31:07 dulcinea pppd[21717]: sent [IPCP ConfReq id=0x1 <compress VJ 0f 01> <addr 192.168.1.251>]
Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [CCP ConfReq id=0x5 <mppe +H -M -S -L -D +C>]
Apr 11 11:31:07 dulcinea pppd[21717]: Unsupported protocol 'Compression Control Protocol' (0x80fd) received
Apr 11 11:31:07 dulcinea pppd[21717]: sent [LCP ProtRej id=0x4 80 fd 01 05 00 0a 12 06 01 00 00 01]
Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [IPCP ConfReq id=0x6 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-wins 0.0.0.0> <ms-dns3 0.0.0.0> <ms-wins 0.0.0.0>]
Apr 11 11:31:07 dulcinea pppd[21717]: sent [IPCP ConfRej id=0x6 <ms-wins 0.0.0.0> <ms-wins 0.0.0.0>]
Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [IPCP ConfRej id=0x1 <compress VJ 0f 01>]
Apr 11 11:31:07 dulcinea pppd[21717]: sent [IPCP ConfReq id=0x2 <addr 192.168.1.251>]
Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [IPCP ConfReq id=0x7 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns3 0.0.0.0>]
Apr 11 11:31:07 dulcinea pppd[21717]: sent [IPCP ConfNak id=0x7 <addr 192.168.1.128> <ms-dns1 192.168.1.1> <ms-dns3 192.168.1.1>]
Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [IPCP ConfAck id=0x2 <addr 192.168.1.251>]
Apr 11 11:31:07 dulcinea pppd[21717]: rcvd [IPCP ConfReq id=0x8 <addr 192.168.1.128> <ms-dns1 192.168.1.1> <ms-dns3 192.168.1.1>]
Apr 11 11:31:07 dulcinea pppd[21717]: sent [IPCP ConfAck id=0x8 <addr 192.168.1.128> <ms-dns1 192.168.1.1> <ms-dns3 192.168.1.1>]
Apr 11 11:31:07 dulcinea pppd[21717]: found interface eth0 for proxy arp
Apr 11 11:31:07 dulcinea pppd[21717]: local IP address 192.168.1.251
Apr 11 11:31:07 dulcinea pppd[21717]: remote IP address 192.168.1.128
Apr 11 11:31:07 dulcinea pppd[21717]: Script /etc/ppp/ip-up started (pid 21733)
Apr 11 11:31:07 dulcinea pppd[21717]: Script /etc/ppp/ip-up finished (pid 21733), status = 0x1
|
So next I connect outside our network. VPN behind Firewall nat and now a windows client behind a nat also...
| Code: |
Apr 11 11:47:31 dulcinea pluto[21508]: "roadwarrior-l2tp"[2] 24.XX.XX.162 #3: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: both are NATed
Apr 11 11:47:31 dulcinea pluto[21508]: "roadwarrior-l2tp"[2] 24.XX.XX.162 #3: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Apr 11 11:47:31 dulcinea pluto[21508]: "roadwarrior-l2tp"[2] 24.XX.XX.162 #3: Peer ID is ID_FQDN: '@demo1'
Apr 11 11:47:31 dulcinea pluto[21508]: "roadwarrior-l2tp"[3] 24.XX.XX.162 #3: deleting connection "roadwarrior-l2tp" instance with peer 24.XX.XX.162 {isakmp=#0/ipsec=#0}
Apr 11 11:47:31 dulcinea pluto[21508]: "roadwarrior-l2tp"[3] 24.XX.XX.162 #3: I did not send a certificate because I do not have one.
Apr 11 11:47:31 dulcinea pluto[21508]: "roadwarrior-l2tp"[3] 24.XX.XX.162 #3: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Apr 11 11:47:31 dulcinea pluto[21508]: | NAT-T: new mapping 24.XX.XX.162:500/4500)
Apr 11 11:47:31 dulcinea pluto[21508]: "roadwarrior-l2tp"[3] 24.XX.XX.162:4500 #3: sent MR3, ISAKMP SA established
Apr 11 11:47:31 dulcinea pluto[21508]: "roadwarrior-l2tp"[3] 24.XX.XX.162:4500 #3: cannot respond to IPsec SA request because no connection is known for 24.XX.XX.12/32===192.168.1.251:4500:17/1701...24.XX.XX.162:4500[@demo1]:17/1701
|
Stuck! And i can not figure this out.....
_________________
write quit bang |
|
| Back to top |
|
|
dashnu
l33t
Joined: 21 Jul 2004
Posts: 703
Location: Casco Maine
|
| Posted: Mon Apr 11, 2005 5:46 pm Post subject: |
|
|
welp just hacked my registry to fix an sp2 bug.. http://support.microsoft.com/default.aspx?kbid=885407
and still nothing same error server side no error client side anymore.
........ .............  
/me prays some knowledgeable vpn person sees this thread..
_________________
write quit bang |
|
| Back to top |
|
|
dashnu
l33t
Joined: 21 Jul 2004
Posts: 703
Location: Casco Maine
|
|
| Back to top |
|
|
|
Networking & Security
