<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Rescued from the Spam bucket. Please remember to subscribe to the mailing list before posting to it.<br><div><br><div><div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; color:rgba(127, 127, 127, 1.0);"><b>From: </b></span><span style="font-family:'Helvetica';">Tian You <<a href="mailto:axqd001@gmail.com">axqd001@gmail.com</a>><br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; color:rgba(127, 127, 127, 1.0);"><b>Subject: </b></span><span style="font-family:'Helvetica';"><b>ipsec verify failed</b><br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; color:rgba(127, 127, 127, 1.0);"><b>Date: </b></span><span style="font-family:'Helvetica';">June 22, 2014 at 2:47:36 PM EDT<br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; color:rgba(127, 127, 127, 1.0);"><b>To: </b></span><span style="font-family:'Helvetica';"><a href="mailto:users@lists.openswan.org">users@lists.openswan.org</a><br></span></div><br><br>Hi all, I’m new to opwnswan and I have no idea how to debug this and go further. Please kindly help.<br><br>This is for xl2tpd + ipsec VPN solution.<br><br>==========================<br><br>$ sudo ipsec verify<br>Checking if IPsec got installed and started correctly:<br><br>Version check and ipsec on-path <span class="Apple-tab-span" style="white-space:pre"> </span>[OK]<br>Openswan U2.6.40/K3.14.5-x86_64-linode42 (netkey)<br>See `ipsec --copyright' for copyright information.<br>Checking for IPsec support in kernel <span class="Apple-tab-span" style="white-space:pre"> </span>[OK]<br> NETKEY: Testing XFRM related proc values<br> ICMP default/send_redirects <span class="Apple-tab-span" style="white-space:pre"> </span>[OK]<br> ICMP default/accept_redirects <span class="Apple-tab-span" style="white-space:pre"> </span>[OK]<br> XFRM larval drop <span class="Apple-tab-span" style="white-space:pre"> </span>[OK]<br>Hardware random device check <span class="Apple-tab-span" style="white-space:pre"> </span>[N/A]<br>Two or more interfaces found, checking IP forwarding<span class="Apple-tab-span" style="white-space:pre"> </span>[OK]<br>Checking rp_filter <span class="Apple-tab-span" style="white-space:pre"> </span>[OK]<br>Checking that pluto is running <span class="Apple-tab-span" style="white-space:pre"> </span>[OK]<br> Pluto listening for IKE on udp 500 <span class="Apple-tab-span" style="white-space:pre"> </span>[FAILED]<br> Pluto listening for IKE on tcp 500 <span class="Apple-tab-span" style="white-space:pre"> </span>[NOT IMPLEMENTED]<br> Pluto listening for IKE/NAT-T on udp 4500 <span class="Apple-tab-span" style="white-space:pre"> </span>[DISABLED]<br> Pluto listening for IKE/NAT-T on tcp 4500 <span class="Apple-tab-span" style="white-space:pre"> </span>[NOT IMPLEMENTED]<br> Pluto listening for IKE on tcp 10000 (cisco) <span class="Apple-tab-span" style="white-space:pre"> </span>[NOT IMPLEMENTED]<br>Checking NAT and MASQUERADEing <span class="Apple-tab-span" style="white-space:pre"> </span>[TEST INCOMPLETE]<br>Checking 'ip' command <span class="Apple-tab-span" style="white-space:pre"> </span>[IP XFRM BROKEN]<br>Checking 'iptables' command <span class="Apple-tab-span" style="white-space:pre"> </span>[OK]<br><br>ipsec verify: encountered errors<br><br>===================<br><br>$ sudo netstat -nlp | grep pluto<br>udp 0 0 127.0.0.1:4500 0.0.0.0:* 14487/pluto <br>udp 0 0 <server public ip>:4500 0.0.0.0:* 14487/pluto <br>udp 0 0 127.0.0.1:500 0.0.0.0:* 14487/pluto <br>udp 0 0 <server public ip>:500 0.0.0.0:* 14487/pluto <br>udp6 0 0 ::1:500 :::* 14487/pluto <br>udp6 0 0 2400:8900::f03c:91f:500 :::* 14487/pluto <br>unix 2 [ ACC ] STREAM LISTENING 26091 14487/pluto /var/run/pluto/pluto.ctl<br>$ sudo ls -l /var/run/pluto/<br>total 12<br>-rw-r--r-- 1 root root 109 Jun 23 00:23 ipsec.info<br>-rw-r--r-- 1 root root 6 Jun 23 00:23 ipsec_setup.pid<br>srwx------ 1 root root 0 Jun 23 00:23 pluto.ctl<br>-r--r--r-- 1 root root 6 Jun 23 00:23 pluto.pid<br>$ uname -a<br>Linux force 3.14.5-x86_64-linode42 #1 SMP Thu Jun 5 15:22:13 EDT 2014 x86_64 GNU/Linux<br>$ cat /etc/issue<br>Debian GNU/Linux 6.0 \n \l<br><br>$ sudo ipsec whack --status<br>000 using kernel interface: netkey<br>000 interface lo/lo ::1<br>000 interface eth0/eth0 2400:8900::f03c:91ff:feae:27f1<br>000 interface lo/lo 127.0.0.1<br>000 interface lo/lo 127.0.0.1<br>000 interface eth0/eth0 <server public ip><br>000 interface eth0/eth0 <server public ip><br>000 %myid = (none)<br>000 debug none<br>000 <br>000 virtual_private (%priv):<br>000 - allowed 6 subnets: 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 25.0.0.0/8, fd00::/8, fe80::/10<br>000 - disallowed 0 subnets: <br>000 WARNING: Disallowed subnets in virtual_private= is empty. If you have <br>000 private address space in internal use, it should be excluded!<br>000 <br>000 algorithm ESP encrypt: id=2, name=ESP_DES, ivlen=8, keysizemin=64, keysizemax=64<br>000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192<br>000 algorithm ESP encrypt: id=6, name=ESP_CAST, ivlen=8, keysizemin=40, keysizemax=128<br>000 algorithm ESP encrypt: id=7, name=ESP_BLOWFISH, ivlen=8, keysizemin=40, keysizemax=448<br>000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0<br>000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256<br>000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8, keysizemin=160, keysizemax=288<br>000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, keysizemin=128, keysizemax=256<br>000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8, keysizemin=128, keysizemax=256<br>000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8, keysizemin=128, keysizemax=256<br>000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=160, keysizemax=288<br>000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=12, keysizemin=160, keysizemax=288<br>000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=16, keysizemin=160, keysizemax=288<br>000 algorithm ESP encrypt: id=22, name=ESP_CAMELLIA, ivlen=8, keysizemin=128, keysizemax=256<br>000 algorithm ESP encrypt: id=252, name=ESP_SERPENT, ivlen=8, keysizemin=128, keysizemax=256<br>000 algorithm ESP encrypt: id=253, name=ESP_TWOFISH, ivlen=8, keysizemin=128, keysizemax=256<br>000 algorithm ESP auth attr: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128<br>000 algorithm ESP auth attr: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160<br>000 algorithm ESP auth attr: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256<br>000 algorithm ESP auth attr: id=6, name=AUTH_ALGORITHM_HMAC_SHA2_384, keysizemin=384, keysizemax=384<br>000 algorithm ESP auth attr: id=7, name=AUTH_ALGORITHM_HMAC_SHA2_512, keysizemin=512, keysizemax=512<br>000 algorithm ESP auth attr: id=8, name=AUTH_ALGORITHM_HMAC_RIPEMD, keysizemin=160, keysizemax=160<br>000 algorithm ESP auth attr: id=9, name=AUTH_ALGORITHM_AES_CBC, keysizemin=128, keysizemax=128<br>000 algorithm ESP auth attr: id=251, name=AUTH_ALGORITHM_NULL_KAME, keysizemin=0, keysizemax=0<br>000 <br>000 algorithm IKE encrypt: id=0, name=(null), blocksize=16, keydeflen=131<br>000 algorithm IKE encrypt: id=5, name=OAKLEY_3DES_CBC, blocksize=8, keydeflen=192<br>000 algorithm IKE encrypt: id=7, name=OAKLEY_AES_CBC, blocksize=16, keydeflen=128<br>000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashsize=16<br>000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashsize=20<br>000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashsize=32<br>000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashsize=64<br>000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024<br>000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536<br>000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048<br>000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072<br>000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096<br>000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144<br>000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192<br>000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024<br>000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048<br>000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048<br>000 <br>000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0} <br>000 <br>000 "L2TP-PSK-NAT": <server public ip>/32===<server public ip><<server public ip>>:17/%any...%any:17/%any; unrouted; eroute owner: #0<br>000 "L2TP-PSK-NAT": myip=unset; hisip=unset;<br>000 "L2TP-PSK-NAT": ike_life: 28800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3 <br>000 "L2TP-PSK-NAT": policy: PSK+ENCRYPT+DONTREKEY+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 32,32; interface: eth0; <br>000 "L2TP-PSK-NAT": newest ISAKMP SA: #0; newest IPsec SA: #0; <br>000 "L2TP-PSK-noNAT": <server public ip><<server public ip>>:17/%any...%any:17/%any; unrouted; eroute owner: #0<br>000 "L2TP-PSK-noNAT": myip=unset; hisip=unset;<br>000 "L2TP-PSK-noNAT": ike_life: 28800s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3 <br>000 "L2TP-PSK-noNAT": policy: PSK+ENCRYPT+DONTREKEY+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 32,32; interface: eth0; <br>000 "L2TP-PSK-noNAT": newest ISAKMP SA: #0; newest IPsec SA: #0; <br>000 <br>000 <br><br>================<br><br>Jun 22 12:23:24 localhost sudo: axqd : TTY=pts/1 ; PWD=/home/axqd ; USER=root ; COMMAND=/etc/init.d/ipsec restart<br>Jun 22 12:23:24 localhost pluto[14204]: shutting down<br>Jun 22 12:23:24 localhost pluto[14204]: forgetting secrets<br>Jun 22 12:23:24 localhost pluto[14204]: "L2TP-PSK-noNAT": deleting connection<br>Jun 22 12:23:24 localhost pluto[14204]: "L2TP-PSK-NAT": deleting connection<br>Jun 22 12:23:24 localhost pluto[14204]: shutting down interface lo/lo ::1:500<br>Jun 22 12:23:24 localhost pluto[14204]: shutting down interface eth0/eth0 2400:8900::f03c:91ff:feae:27f1:500<br>Jun 22 12:23:24 localhost pluto[14204]: shutting down interface lo/lo 127.0.0.1:4500<br>Jun 22 12:23:24 localhost pluto[14204]: shutting down interface lo/lo 127.0.0.1:500<br>Jun 22 12:23:24 localhost pluto[14204]: shutting down interface eth0/eth0 <server public ip>:4500<br>Jun 22 12:23:24 localhost pluto[14204]: shutting down interface eth0/eth0 <server public ip>:500<br>Jun 22 12:23:24 localhost pluto[14205]: pluto_crypto_helper: helper (0) is normal exiting<br>Jun 22 12:23:25 localhost ipsec__plutorun: Starting Pluto subsystem...<br>Jun 22 12:23:25 localhost pluto[14487]: Starting Pluto (Openswan Version 2.6.40; Vendor ID OSWvfazocUPZ) pid:14487<br>Jun 22 12:23:25 localhost pluto[14487]: LEAK_DETECTIVE support [disabled]<br>Jun 22 12:23:25 localhost pluto[14487]: OCF support for IKE [disabled]<br>Jun 22 12:23:25 localhost pluto[14487]: SAref support [disabled]: Protocol not available<br>Jun 22 12:23:25 localhost pluto[14487]: SAbind support [disabled]: Protocol not available<br>Jun 22 12:23:25 localhost pluto[14487]: NSS support [disabled]<br>Jun 22 12:23:25 localhost pluto[14487]: HAVE_STATSD notification support not compiled in<br>Jun 22 12:23:25 localhost pluto[14487]: Setting NAT-Traversal port-4500 floating to on<br>Jun 22 12:23:25 localhost pluto[14487]: port floating activation criteria nat_t=1/port_float=1<br>Jun 22 12:23:25 localhost pluto[14487]: NAT-Traversal support [enabled]<br>Jun 22 12:23:25 localhost pluto[14487]: using /dev/urandom as source of random entropy<br>Jun 22 12:23:25 localhost pluto[14487]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)<br>Jun 22 12:23:25 localhost pluto[14487]: ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)<br>Jun 22 12:23:25 localhost pluto[14487]: ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)<br>Jun 22 12:23:25 localhost pluto[14487]: starting up 1 cryptographic helpers<br>Jun 22 12:23:25 localhost pluto[14487]: started helper pid=14489 (fd:6)<br>Jun 22 12:23:25 localhost pluto[14487]: Using Linux XFRM/NETKEY IPsec interface code on 3.14.5-x86_64-linode42<br>Jun 22 12:23:25 localhost pluto[14489]: using /dev/urandom as source of random entropy<br>Jun 22 12:23:25 localhost pluto[14487]: ike_alg_register_enc(): Activating aes_ccm_8: Ok (ret=0)<br>Jun 22 12:23:25 localhost pluto[14487]: ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists<br>Jun 22 12:23:25 localhost pluto[14487]: ike_alg_register_enc(): Activating aes_ccm_12: FAILED (ret=-17)<br>Jun 22 12:23:25 localhost pluto[14487]: ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists<br>Jun 22 12:23:25 localhost pluto[14487]: ike_alg_register_enc(): Activating aes_ccm_16: FAILED (ret=-17)<br>Jun 22 12:23:25 localhost pluto[14487]: ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists<br>Jun 22 12:23:25 localhost pluto[14487]: ike_alg_register_enc(): Activating aes_gcm_8: FAILED (ret=-17)<br>Jun 22 12:23:25 localhost pluto[14487]: ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists<br>Jun 22 12:23:25 localhost pluto[14487]: ike_alg_register_enc(): Activating aes_gcm_12: FAILED (ret=-17)<br>Jun 22 12:23:25 localhost pluto[14487]: ike_alg_add(): ERROR: algo_type '0', algo_id '0', Algorithm type already exists<br>Jun 22 12:23:25 localhost pluto[14487]: ike_alg_register_enc(): Activating aes_gcm_16: FAILED (ret=-17)<br>Jun 22 12:23:25 localhost pluto[14487]: added connection description "L2TP-PSK-NAT"<br>Jun 22 12:23:25 localhost pluto[14487]: added connection description "L2TP-PSK-noNAT"<br>Jun 22 12:23:25 localhost pluto[14487]: listening for IKE messages<br>Jun 22 12:23:25 localhost pluto[14487]: adding interface eth0/eth0 <server public ip>:500<br>Jun 22 12:23:25 localhost pluto[14487]: adding interface eth0/eth0 <server public ip>:4500<br>Jun 22 12:23:25 localhost pluto[14487]: adding interface lo/lo 127.0.0.1:500<br>Jun 22 12:23:25 localhost pluto[14487]: adding interface lo/lo 127.0.0.1:4500<br>Jun 22 12:23:25 localhost pluto[14487]: adding interface eth0/eth0 2400:8900::f03c:91ff:feae:27f1:500<br>Jun 22 12:23:25 localhost pluto[14487]: adding interface lo/lo ::1:500<br>Jun 22 12:23:25 localhost pluto[14487]: loading secrets from "/etc/ipsec.secrets”<br><br>================<br><br>$ cat /etc/ipsec.conf <br># /etc/ipsec.conf - Openswan IPsec configuration file<br><br># This file: /usr/local/share/doc/openswan/ipsec.conf-sample<br>#<br># Manual: ipsec.conf.5<br><br><br>version<span class="Apple-tab-span" style="white-space:pre"> </span>2.0<span class="Apple-tab-span" style="white-space:pre"> </span># conforms to second version of ipsec.conf specification<br><br># basic configuration<br>config setup<br><span class="Apple-tab-span" style="white-space:pre"> </span># Do not set debug options to debug configuration issues!<br><span class="Apple-tab-span" style="white-space:pre"> </span># plutodebug / klipsdebug = "all", "none" or a combation from below:<br><span class="Apple-tab-span" style="white-space:pre"> </span># "raw crypt parsing emitting control klips pfkey natt x509 dpd private"<br><span class="Apple-tab-span" style="white-space:pre"> </span># eg:<br><span class="Apple-tab-span" style="white-space:pre"> </span># plutodebug="control parsing"<br><span class="Apple-tab-span" style="white-space:pre"> </span># Again: only enable plutodebug or klipsdebug when asked by a developer<br><span class="Apple-tab-span" style="white-space:pre"> </span>#<br><span class="Apple-tab-span" style="white-space:pre"> </span># enable to get logs per-peer<br><span class="Apple-tab-span" style="white-space:pre"> </span># plutoopts="--perpeerlog"<br><span class="Apple-tab-span" style="white-space:pre"> </span>#<br><span class="Apple-tab-span" style="white-space:pre"> </span># Enable core dumps (might require system changes, like ulimit -C)<br><span class="Apple-tab-span" style="white-space:pre"> </span># This is required for abrtd to work properly<br><span class="Apple-tab-span" style="white-space:pre"> </span># Note: incorrect SElinux policies might prevent pluto writing the core<br><span class="Apple-tab-span" style="white-space:pre"> </span>dumpdir=/var/run/pluto/<br><span class="Apple-tab-span" style="white-space:pre"> </span>#<br><span class="Apple-tab-span" style="white-space:pre"> </span># NAT-TRAVERSAL support, see README.NAT-Traversal<br><span class="Apple-tab-span" style="white-space:pre"> </span>nat_traversal=yes<br><span class="Apple-tab-span" style="white-space:pre"> </span># exclude networks used on server side by adding %v4:!a.b.c.0/24<br><span class="Apple-tab-span" style="white-space:pre"> </span># It seems that T-Mobile in the US and Rogers/Fido in Canada are<br><span class="Apple-tab-span" style="white-space:pre"> </span># using 25/8 as "private" address space on their 3G network.<br><span class="Apple-tab-span" style="white-space:pre"> </span># This range has not been announced via BGP (at least upto 2010-12-21)<br><span class="Apple-tab-span" style="white-space:pre"> </span>virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10<br><span class="Apple-tab-span" style="white-space:pre"> </span># OE is now off by default. Uncomment and change to on, to enable.<br><span class="Apple-tab-span" style="white-space:pre"> </span>oe=off<br><span class="Apple-tab-span" style="white-space:pre"> </span># which IPsec stack to use. auto will try netkey, then klips then mast<br><span class="Apple-tab-span" style="white-space:pre"> </span>protostack=netkey<br><span class="Apple-tab-span" style="white-space:pre"> </span># Use this to log to a file, or disable logging on embedded systems (like openwrt)<br><span class="Apple-tab-span" style="white-space:pre"> </span>#plutostderrlog=/dev/null<br><br># Add connections here<br><br># sample VPN connection<br># for more examples, see /etc/ipsec.d/examples/<br>#conn sample<br>#<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span># Left security gateway, subnet behind it, nexthop toward right.<br>#<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>left=10.0.0.1<br>#<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>leftsubnet=172.16.0.0/24<br>#<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>leftnexthop=10.22.33.44<br>#<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span># Right security gateway, subnet behind it, nexthop toward left.<br>#<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>right=10.12.12.1<br>#<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>rightsubnet=192.168.0.0/24<br>#<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>rightnexthop=10.101.102.103<br>#<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span># To authorize this connection, but not actually start it, <br>#<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span># at startup, uncomment this.<br>#<span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>#auto=add<br><br>conn L2TP-PSK-NAT<br> rightsubnet=vhost:%priv<br> also=L2TP-PSK-noNAT<br><br>conn L2TP-PSK-noNAT<br> authby=secret<br> pfs=no<br> auto=add<br> keyingtries=3<br> rekey=no<br> ikelifetime=8h<br> keylife=1h<br> type=transport<br> left=<server public ip><br> leftprotoport=17/%any<br> #leftprotoport=17/1701<br> right=%any<br> rightprotoport=17/%any<br><br></div></div></div><br></body></html>