<span class="Apple-style-span" style="border-collapse: collapse; ">Hello people,<br><br>Please please can you help me ? <br>since two weeks I try to configure a ipsec/l2tp connection between a Windows-XP (Service-pack 3) -Client and my VPN-Server (the Server is a Linux-Machine with 2 Networkinterfaces)<br>
BUT it does not work! The problem is that everything works fine if there is no NAT or only Server-NAT or only Client-NAT.<br>BUT IT STILL DOES NOT WANT TO WORK IF BOTH SIDES ARE NATTED... (Please check the logging-files on the bottom of this page. It is not much but it tells a lot about my Problem and perhaps you have an idea what it could be? )<br>
<br>I tested the instrucions on jacco's website:<br><br><a href="http://www.jacco2.dds.nl/networking/openswan-l2tp.html#serverNATed" target="_blank" style="color: rgb(42, 93, 176); ">http://www.jacco2.dds.nl/networking/openswan-l2tp.html#serverNATed</a><br>
<br><tt> NAT- Internet NAT-<br>Client --------- device =================== device -------------+-------- ... <font color="#000099"><b><a href="http://192.168.1.0/24" title="Linkification: http://192.168.1.0/24" target="_blank" style="color: rgb(42, 93, 176); ">192.168.1.0/24</a></b></font> <br>
192.168.0.2 / \ / \ |<br> / \ / 192.168.1.1 Openswan<br> </tt><tt><b><a href="http://192.168.0.1/24" title="Linkification: http://192.168.0.1/24" target="_blank" style="color: rgb(42, 93, 176); ">192.168.0.1/24</a></b> </tt><tt> 234.234.234.234 123.123.123.123 Server<br>
192.168.1.2</tt><br><br>Use Openswan 2.4.5 or higher<br>Hack the registry of XP (EnableUDPEncapsulation...)<br><br>I use Openswan 2.4.5 with Linux-Kernel 2.6.17-uc1 <br>
The Client is a XP-Machine with Service-Pack 3 and with registry-hack inserted<br><br><br>My setup differs a bit from the setup above:<br><br><tt>NAT- Internet NAT-<br>Client --------- device =================== device -------------+(</tt><tt>192.168.1.2</tt><tt>)Openswan Server(192.168.2.1)-------- ... <font color="#000099"><b><a href="http://192.168.1.0/24" title="Linkification: http://192.168.1.0/24" target="_blank" style="color: rgb(42, 93, 176); ">192.168.2.0/24</a></b></font> <br>
192.168.0.2 / \ / \ <br> / \ / 192.168.1.1 </tt><br><tt> </tt><tt><b><a href="http://192.168.0.1/24" title="Linkification: http://192.168.0.1/24" target="_blank" style="color: rgb(42, 93, 176); ">192.168.0.1/24</a></b> </tt><tt> 234.234.234.234 123.123.123.123 <br>
<br><br></tt>My Openswan-Server is a router with two Network-Interfaces...<br><br>I want to add the Client from Network <a href="http://192.168.0.0/24" target="_blank" style="color: rgb(42, 93, 176); ">192.168.0.0/24</a> to the Openswan-Server-Network <a href="http://192.168.2.0/24" target="_blank" style="color: rgb(42, 93, 176); ">192.168.2.0/24</a>. Between these 2 Networks is the Internet and the local Network of the second NAT-device (the Network <a href="http://192.168.1.0/24" target="_blank" style="color: rgb(42, 93, 176); ">192.168.1.0/24</a>)<br>
<br>With a Linux-Client I have no Problems to reach my setup. BUT if I use a Windows-Client I have Problems because the l2tp does not start. <br>Everything works fine, ipsec is established (STATE_QUICK_R2: IPsec SA established ) BUT the l2tpd does not start and I don't know why.<br>
In my traces I can see that in a working connection (client not natted but server natted) the l2tp starts between ipsec STATE_QUICK_1 and ipsec STATE_QUICK_2. After STATE_QUICK_" is established the l2tp makes the rest. But between QUICK_1 and QUICK_2 of ipsec, the l2tpd starts...<br>
I found out that there are two packets coming in on eth1 who acitvate the l2tpd (which is listening on ip-adress 0.0.0.0 port 1701).:<br><br>Pluto: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2 <br><4>Mar 19 12:11:10 kernel:<span style="background-color: rgb(255, 102, 102); "> IN=eth1</span> OUT= MAC=00:50:c2:71:70:01:00:50:c2:71:70:09:08:00 SRC=192.168.2.102 DST=192.168.2.100 LEN=84 TOS=0x00 PREC=0x00 TTL=127 ID=33753 PROTO=UDP <span style="background-color: rgb(255, 102, 102); ">SPT=4500 DPT=4500 LEN=64 </span><br>
<4>Mar 19 12:11:10 kernel: <span style="background-color: rgb(255, 102, 102); ">IN=eth1</span> OUT= MAC=00:50:c2:71:70:01:00:50:c2:71:70:09:08:00 SRC=192.168.2.102 DST=192.168.2.100 LEN=192 TOS=0x00 PREC=0x00 TTL=127 ID=33754 PROTO=UDP <span style="background-color: rgb(255, 102, 102); ">SPT=4500 DPT=4500 LEN=172 </span><br>
<4>Mar 19 12:11:10 kernel: <span style="background-color: rgb(51, 255, 51); ">IN=ipsec0</span> OUT= MAC=00:50:c2:71:70:01:00:50:c2:71:70:09:08:00 SRC=192.168.2.102 DST=192.168.2.100 LEN=147 TOS=0x00 PREC=0x00 TTL=127 ID=33754 PROTO=UDP <span style="background-color: rgb(51, 255, 51); ">SPT=1701 DPT=1701 LEN=127 </span><br>
<span style="background-color: rgb(255, 255, 255); "><7>Mar 19 12:11:10 <span style="background-color: rgb(255, 255, 102); ">l2tpd[21171]:</span> network_thread: recv packet from 192.168.2.102, size = 119, tunnel = 0, call = 0 </span><br>
.......... <br><4>Mar 19 13:53:02 pluto[18087]: "test_vpn"[54] 79.208.32.55 #54: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2 <br><4>Mar 19 13:53:02 pluto[18087]: "test_vpn"[54] 79.208.32.55 #54: STATE_QUICK_R2: IPsec SA established {ESP=>0x5d9d38ef <0xcdb2a862 xfrm=3DES_0-HMAC_MD5 NATD=<a href="http://79.208.32.55:34845" target="_blank" style="color: rgb(42, 93, 176); ">79.208.32.55:34845</a> DPD=none}<br>
..............................<span style="background-color: rgb(255, 255, 102); ">l2tpd:</span>...........<br>and everything works fine....<br><br><br>If the connection does not work (Client behind NAT AND Server behind NAT) these two packets also come in BUT the l2tpd does NOT start?:<br>
<br>Pluto: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2 <br><4>Mar 19 13:53:02 kernel: <span style="background-color: rgb(255, 102, 102); ">IN=eth1</span> OUT= MAC=00:50:c2:71:70:01:00:1a:4f:c2:71:54:08:00 SRC=79.208.32.55 DST=192.168.2.100 LEN=84 TOS=0x00 PREC=0x00 TTL=122 ID=42981 PROTO=UDP <span style="background-color: rgb(255, 102, 102); ">SPT=34845 DPT=4500 LEN=64 </span><br>
<4>Mar 19 13:53:02 kernel: <span style="background-color: rgb(255, 102, 102); ">IN=eth1</span> OUT= MAC=00:50:c2:71:70:01:00:1a:4f:c2:71:54:08:00 SRC=79.208.32.55 DST=192.168.2.100 LEN=192 TOS=0x00 PREC=0x00 TTL=122 ID=42982 PROTO=UDP <span style="background-color: rgb(255, 102, 102); ">SPT=34845 DPT=4500 LEN=172 </span><br>
<4>Mar 19 13:53:02 kernel: <span style="background-color: rgb(51, 255, 51); ">IN=ipsec0</span> OUT= MAC=00:50:c2:71:70:01:00:1a:4f:c2:71:54:08:00 SRC=79.208.32.55 DST=192.168.2.100 LEN=147 TOS=0x00 PREC=0x00 TTL=122 ID=42982 PROTO=UDP <span style="background-color: rgb(51, 255, 51); ">SPT=1701 DPT=1701 LEN=127 </span><br>
<br>NO L2tpd is starting??????????<br><br><4>Mar 19 13:53:02 pluto[18087]: "test_vpn"[54] 79.208.32.55 #54: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2 <br><4>Mar 19 13:53:02 pluto[18087]: "test_vpn"[54] 79.208.32.55 #54: STATE_QUICK_R2: IPsec SA established {ESP=>0x5d9d38ef <0xcdb2a862 xfrm=3DES_0-HMAC_MD5 NATD=<a href="http://79.208.32.55:34845" target="_blank" style="color: rgb(42, 93, 176); ">79.208.32.55:34845</a> DPD=none} <br>
<br>The Client repeats to send his packet (len 172)<br><4>Mar 19 13:53:03 kernel: IN=eth1 OUT= MAC=00:50:c2:71:70:01:00:1a:4f:c2:71:54:08:00 SRC=79.208.32.55 DST=192.168.2.100 LEN=192 TOS=0x00 PREC=0x00 TTL=122 ID=42983 PROTO=UDP SPT=34845 DPT=4500 LEN=172 <br>
<4>Mar 19 13:53:03 kernel: IN=ipsec0 OUT= MAC=00:50:c2:71:70:01:00:1a:4f:c2:71:54:08:00 SRC=79.208.32.55 DST=192.168.2.100 LEN=147 TOS=0x00 PREC=0x00 TTL=122 ID=42983 PROTO=UDP SPT=1701 DPT=1701 LEN=127 <br><br><br>
this is the End of the connection when I klick Abort on the Windows-Side:<br><4>Mar 19 13:53:04 kernel: IN=eth1 OUT= MAC=00:50:c2:71:70:01:00:1a:4f:c2:71:54:08:00 SRC=79.208.32.55 DST=192.168.2.100 LEN=100 TOS=0x00 PREC=0x00 TTL=122 ID=42984 PROTO=UDP SPT=34845 DPT=4500 LEN=80 <br>
<4>Mar 19 13:53:04 kernel: IN=eth1 OUT= MAC=00:50:c2:71:70:01:00:1a:4f:c2:71:54:08:00 SRC=79.208.32.55 DST=192.168.2.100 LEN=116 TOS=0x00 PREC=0x00 TTL=122 ID=42985 PROTO=UDP SPT=34845 DPT=4500 LEN=96 <br><4>Mar 19 13:53:04 pluto[18087]: "test_vpn"[54] 79.208.32.55 #53: received Delete SA(0x5d9d38ef) payload: deleting IPSEC State #54 <br>
<br><br>Is my opinion right that the packet which comes in on <span style="background-color: rgb(255, 102, 102); ">eth1 with the len 172</span> is the packet which starts the l2tpd-programm? Do you think the packet must hang in the firewall? Is my firewall (iptables) the Problem? Or do you think that the packet is<br>
destroyed and the l2tp doesn't want to answer? What I noticed is that the source-port and the destination-port of the packets differs in the non-working connection (SPT=34845, DPT=4500) but I think that is the nat-device and it should not be a problem. mainly because the ports of the ipsec-packet are both 1701. and the l2tpd should only have interest on this packet...<br>
<br><br><font size="2" face="Tahoma"><span lang="EN-GB" style="font-size: 10pt; ">Met vriendelijke groet ;) ,<br><br>Joe</span></font></span><br>