Openswan 2.3.0 and WinXP clients behind firewall...

[agustinchernitsky]

Hi Everyone,

I am trying to setup openswan on my Gentoo router with L2TPd support for my WinXP clients. This is the network layout.

WinXP Clients =========== [ Gentoo Router ] <<<< INTERNET >>>> [ Gentoo VPN Gateway] ========== Corp Network.

As you can see, the WinXP clients connect from a public place, wich has this configuration (ie Cybercafes). Now, when I try to connect from a winXP client, I get the IPSEC SA established, but it never gets to the L2TP auth process. It seems it can't get thru NAT.

I have tried this configuration within the same network as the Gentoo VPN GW and it works fine... So, the problem must bue the NAT on the other side. The Gentoo VPN GW has the firewall open (again, for testing purposes).

Has anyone tried this? My best guess is that L2TP is not compatible with NAT...

Any ideas??

Cheers!!

This is my ipsec.conf in the Gentoo VPN Gateway:

[v_tieleman]

Actually, it is not your L2TPD that is causing problems.
I actually had the same problem, namely the openswan server can not create a route to the client that is connecting:

Nov 30 07:52:32 extranet pluto[12432]: "road-warrior-psk"[2] 24.232.73.203:4500 #3: route-host output: /usr/lib/ipsec/_updown: doroute `ip route add 24.232.73.203/32 via 24.232.73.203 dev ipsec0 ' failed (RTNETLINK answers: Network is unreachable)

Do you have another router in between? I actually have the following setup:


Windows XP VPN Client ---- Gentoo Gateway ---- Router A ---- Internet ---- Router B (192.168.0.1) --- Gentoo VPN Server --- Network (192.168.0.0/24)


The routers in my case are ADSL modems. The problem is the VPN server does not know the route to the VPN client has to go through the Router B.
You can fix it by adding the following line:

rightnexthop=192.168.0.1

[agustinchernitsky]

well, after trying and trying I found this from http://www.jacco2.dds.nl/networking/freeswan-l2tp.html.