<div dir="ltr"><div><div><div><div><div><div><div><div>Hello! My name is Artem. I'm trying to set up L2TP over IPsec VPN server.<br></div>Here is my config:<br><br></div>ipsec.conf:<br>version 2.0 # conforms to second version of ipsec.conf specification<br>
# basic configuration<br>config setup<br> # NAT-TRAVERSAL support, see README.NAT-Traversal<br> nat_traversal=yes<br> virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:!192.168.0.0/16,%v4:172.16.0.0/12">10.0.0.0/8,%v4:!192.168.0.0/16,%v4:172.16.0.0/12</a><br>
oe=off<br> # which IPsec stack to use. auto will try netkey, then klips then mast<br> protostack=netkey<br><br>conn L2TP-PSK<br> authby=secret<br> # authby=rsasig<br> pfs=no<br> auto=add<br> keyingtries=3<br>
rekey=no<br> dpddelay=10<br> dpdtimeout=90<br> dpdaction=clear<br> ikelifetime=8h<br> keylife=1h<br> type=transport<br> left=10.0.0.1<br> # leftid=%fromcert<br> # leftrsasigkey=%cert<br> # leftcert=/etc/ipsec.d/certs/gateway.pem<br>
leftprotoport=17/1701<br> right=%any<br> # rightrsasigkey=%cert<br> rightprotoport=17/%any<br> rightsubnet=vhost:%priv,%no<br><br></div>ipsec.secrets:<br>10.0.0.1 %any: PSK "1234567890<br><br></div>chap-secrets:<br>
ipsec * "123456" *<br><br></div>xl2tpd.conf:<br>[global] ; Global parameters:<br>listen-addr = 10.0.0.1<br>port = 1701 ; * Bind to port 1701<br><br>
[lns default] ; Our fallthrough LNS definition<br>ip range = 192.168.1.2-192.168.1.20 ; * Allocate from this IP range<br>local ip = 192.168.1.199 ; * Our local IP to use<br>length bit = yes ; * Use length bit in payload?<br>
assign ip = yes<br>require chap = yes ; * Require CHAP auth. by peer<br>refuse pap = yes ; * Refuse PAP authentication<br>require authentication = yes ; * Require peer to authenticate<br>
name = precise64 ; * Report this as our hostname<br>ppp debug = no ; * Turn on PPP debugging<br>pppoptfile = /etc/ppp/options.l2tpd.lns ; * ppp options file<br><br></div>options.l2tpd.lns:<br>
lock<br>auth<br>nomppe<br>maxfail 0<br>lcp-echo-interval 60<br>lcp-echo-failure 4<br>nodefaultroute<br>require-mschap-v2<br>noaccomp<br>nopcomp<br>proxyarp<br>nobsdcomp<br>nodeflate<br><br></div>So when I try to use L2TPoIPsec with PSK on Windows7 all works fine and there are new entries in /var/log/auth.log. However if I select using certificates while using the same server config I can connect to my VPN server. In this case there are no new entries in auth.log file. I think IPsec isn't involved in this case. So what is the problem? Should be there any special iptables rules? My server doesn't support KLIPS, only NETKEY.<br>
</div>Thanks in advance.<br></div>