<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I am trying to set up the following VPN:<div><br></div><div>CLIENT(l2tp) ---> SERVER(EC2 Ubuntu 9.10 Openswan)</div><div><br></div><div>I accomplished this with the following config:</div><div><span class="Apple-style-span" style="font-family: 'Lucida Grande'; color: rgb(20, 20, 20); line-height: 14px; ">conn L2TP-PSK-NAT<br style="word-wrap: break-word; "> rightsubnet=vhost:%priv:%no<br style="word-wrap: break-word; "> also=L2TP-PSK-noNAT<br style="word-wrap: break-word; "><br style="word-wrap: break-word; ">conn L2TP-PSK-noNAT<br style="word-wrap: break-word; "> authby=secret<br style="word-wrap: break-word; "> pfs=no<br style="word-wrap: break-word; "> auto=add<br style="word-wrap: break-word; "> keyingtries=3<br style="word-wrap: break-word; "> # we cannot rekey for %any, let client rekey<br style="word-wrap: break-word; "> rekey=no<br style="word-wrap: break-word; "> # Set ikelifetime and keylife to same defaults windows has<br style="word-wrap: break-word; "> ikelifetime=8h<br style="word-wrap: break-word; "> keylife=1h<br style="word-wrap: break-word; "> # l2tp-over-ipsec is transport mode<br style="word-wrap: break-word; "> type=transport<br style="word-wrap: break-word; "> #<br style="word-wrap: break-word; "> left=EC2 Internal IP<br style="word-wrap: break-word; "> leftnexthop=%defaultroute<br style="word-wrap: break-word; "> #<br style="word-wrap: break-word; "> leftprotoport=17/1701<br style="word-wrap: break-word; "> #<br style="word-wrap: break-word; "> # The remote user.<br style="word-wrap: break-word; "> #<br style="word-wrap: break-word; "> right=%any<br style="word-wrap: break-word; "> rightprotoport=17/0<br style="word-wrap: break-word; "><br style="word-wrap: break-word; ">conn passthrough-for-non-l2tp<br style="word-wrap: break-word; "> type=passthrough<br style="word-wrap: break-word; "> left=EC2 Internal IP<br style="word-wrap: break-word; "> leftnexthop=10.252.74.1<br style="word-wrap: break-word; "> right=0.0.0.0<br style="word-wrap: break-word; "> rightsubnet=0.0.0.0/0<br style="word-wrap: break-word; "> auto=route</span></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;"><br></span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;"><br></span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;">Also had to tweak sysctl and add some iptables for masquerading, but it works great as I can connect to this system via my iPhone or MacBook and all traffic is passed through the VPN.</span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;"><br></span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;">Now I need to add the following functionality:</span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;"><br></span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;"><br></span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;">Internal VPN(Ubuntu 9.10) Nat'd ---> <span class="Apple-style-span" style="color: rgb(0, 0, 0); font-family: Helvetica; line-height: normal; ">SERVER(EC2 Ubuntu 9.10 Openswan)</span></span></font></div><div><br></div><div>The goal here is to allow clients to connect to the ec2 instance VPN and be able to access servers on the Internal VPN network.</div><div><br></div><div>Here is the current config:</div><div>Internal VPN:</div><div><span class="Apple-style-span" style="font-family: 'Lucida Grande'; color: rgb(20, 20, 20); line-height: 14px; ">conn net-to-net<br style="word-wrap: break-word; "> authby=secret<br style="word-wrap: break-word; "> pfs=no<br style="word-wrap: break-word; "> rekey=yes<br style="word-wrap: break-word; "> keyingtries=3<br style="word-wrap: break-word; "> type=tunnel<br style="word-wrap: break-word; "><br style="word-wrap: break-word; "> left=192.168.40.45 # Local vitals<br style="word-wrap: break-word; "> leftsubnet=192.168.40.0/24<br style="word-wrap: break-word; "> <a href="mailto:leftid=@internal.vpn">leftid=@internal.vpn</a><br style="word-wrap: break-word; "> right=EC2 External Elastic IP # Remote vitals<br style="word-wrap: break-word; "> <a href="mailto:rightid=@external.vpn">rightid=@external.vpn</a><br style="word-wrap: break-word; "> auto=start</span></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;"><br></span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;">External VPN:</span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;">conn net-to-net<br style="word-wrap: break-word; "> authby=secret<br style="word-wrap: break-word; "> pfs=no<br style="word-wrap: break-word; "> rekey=yes<br style="word-wrap: break-word; "> keyingtries=3<br style="word-wrap: break-word; "> type=tunnel<br style="word-wrap: break-word; "><br style="word-wrap: break-word; "> <a href="mailto:leftid=@external.vpn">leftid=@external.vpn</a><br style="word-wrap: break-word; "> right=External IP for internal VPN -- this could change. wondering if I need it<br style="word-wrap: break-word; "> <a href="mailto:rightid=@internal.vpn">rightid=@internal.vpn</a><br style="word-wrap: break-word; "> rightsubnet=192.168.40.0/24<br style="word-wrap: break-word; "> auto=add # authorizes but doesn't start this</span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;"><br></span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;"><br></span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;"><br></span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;">Now when I connect on the internalVPN server I see:</span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;">Feb 11 12:26:02 vpn-int pluto[27334]: "net-to-net" #1: we require peer to have ID <a href="mailto:'@external.vpn">'@external.vpn</a>', but peer declares 'Private EC2 IP'<br style="word-wrap: break-word; ">Feb 11 12:26:02 vpn-int pluto[27334]: "net-to-net" #1: sending encrypted notification INVALID_ID_INFORMATION to External EC2 IP:4500</span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;"><br></span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;">And on the external VPN we see: ( X.X.X.X = External IP for internal VPN )</span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;">Feb 11 12:26:36 ubuntu pluto[10256]: packet from X.X.X.X:429: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]<br style="word-wrap: break-word; ">Feb 11 12:26:36 ubuntu pluto[10256]: "L2TP-PSK-NAT"[5] X.X.X.X #4: responding to Main Mode from unknown peer X.X.X.X<br style="word-wrap: break-word; ">Feb 11 12:26:36 ubuntu pluto[10256]: "L2TP-PSK-NAT"[5] X.X.X.X #4: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1</span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;"><br></span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;">I feel like I'm missing something here. Why does the EC2 external VPN choose the L2TP-PSK-NAT?? It should be using the net-to-net conn as the ID's match.</span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;"><br></span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;">Any help would be appreciated.</span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;"><br></span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;">Sincerely,</span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;"><br></span></font></div><div><font class="Apple-style-span" color="#141414" face="'Lucida Grande'"><span class="Apple-style-span" style="line-height: 14px;">Chris</span></font></div></body></html>