<p dir="ltr">Try running a strace on xl2tpd while connecting. If it's the same issue I've seen, you should see errors with every packet. I've only seen this with Debian and Ubuntu with SARef. However, it works perfectly for me on RHEL. </p>
<p dir="ltr">Unfortunately, I haven't been able to find a fix. I was told to ask the mailing list, but haven't gotten around to it.</p>
<p dir="ltr">-Thomas York </p>
<div class="gmail_quote">On Jun 7, 2013 6:36 PM, "Rob Emanuele" <<a href="mailto:rje@shoreis.com">rje@shoreis.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Greetings,<br>
<br>
I'm trying to set up a new ipsec/l2tp vpn server on Ubuntu 13.04. They<br>
have an FC5 system that they want to upgrade since it has a NAT-T bug<br>
where two clients behind the same NAT address cannot connect<br>
simultaneously. We never see any log messages that log data into xl2tpd.<br>
We do see an ipsec SA established. We do see ESP data coming into the box<br>
with tcpdump.<br>
<br>
I'm wondering if my kernel isn't passing the data to xl2tpd correctly or<br>
at all. Would you guys have any suggestions for debugging it further? Do<br>
we need any particular sysctl settings other than ipv4 forwarding?<br>
<br>
Notes on our set up below.<br>
<br>
Thank you,<br>
<br>
Rob<br>
<br>
Versions:<br>
<br>
Linux vpnserver2 3.8.0-23-generic #34-Ubuntu SMP Wed May 29 20:24:54 UTC<br>
2013 i686 i686 i686 GNU/Linux<br>
<br>
xl2tpd 1.3.1+dfsg-1<br>
<br>
openswan 1:2.6.38-1<br>
<br>
ipsec.conf ===========<br>
<br>
config setup<br>
nat_traversal=yes<br>
virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12" target="_blank">10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12</a><br>
#contains the networks that are allowed as subnet= for the remote<br>
client. In other words, the address ranges that may live behind a NAT<br>
router through which a client connects.<br>
oe=off<br>
protostack=netkey<br>
<br>
conn L2TP-PSK-NAT<br>
rightsubnet=vhost:%priv<br>
also=L2TP-PSK-noNAT<br>
<br>
conn L2TP-PSK-noNAT<br>
authby=secret<br>
pfs=no<br>
auto=add<br>
keyingtries=3<br>
rekey=no<br>
# Apple iOS doesn't send delete notify so we need dead peer detection<br>
# to detect vanishing clients<br>
dpddelay=30<br>
dpdtimeout=120<br>
dpdaction=clear<br>
# Set ikelifetime and keylife to same defaults windows has<br>
ikelifetime=8h<br>
keylife=1h<br>
type=transport<br>
# Replace IP address with your local IP (private, behind NAT IP is<br>
okay as well)<br>
left=<OUR EXTERNAL IP><br>
# For updated Windows 2000/XP clients,<br>
# to support old clients as well, use leftprotoport=17/%any<br>
leftprotoport=17/1701<br>
right=%any<br>
rightprotoport=17/%any<br>
#force all to be nat'ed. because of iOS<br>
forceencaps=yes<br>
<br>
xl2tpd.conf ===========<br>
<br>
[lns default]<br>
ip range = 192.168.113.176-192.168.113.200<br>
local ip = 192.168.113.252<br>
require chap = yes<br>
refuse pap = yes<br>
require authentication = yes<br>
name = LinuxVPNserver2<br>
ppp debug = yes<br>
pppoptfile = /etc/ppp/options.xl2tpd<br>
length bit = yes<br>
<br>
<br>
_______________________________________________<br>
<a href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a><br>
<a href="https://lists.openswan.org/mailman/listinfo/users" target="_blank">https://lists.openswan.org/mailman/listinfo/users</a><br>
Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" target="_blank">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>
Building and Integrating Virtual Private Networks with Openswan:<br>
<a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" target="_blank">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a><br>
</blockquote></div>