[Openswan Users] L2TP/IPsec with double NAT

Stefano Pazzaglia stefano.pazzaglia at fastwebnet.it
Fri Aug 12 21:24:03 CEST 2005


No, it doesn't work! What am I doing wrong?

ipconfig /all:

Configurazione IP di Windows

        Nome host . . . . . . . . . . . . . . : pava-winzozz
        ......

Scheda Ethernet Connessione alla rete locale (LAN):

        Indirizzo fisico. . . . . . . . . . . : 00-20-ED-6B-23-47
        DHCP abilitato. . . . . . . . . . . . : Sì
        Indirizzo IP. . . . . . . . . . . . . : 37.xxx.xxx.xxx
        Subnet mask . . . . . . . . . . . . . : 255.255.248.0
        Gateway predefinito . . . . . . . . . : 37.xxx.xxx.1
        Server DHCP . . . . . . . . . . . . . : 37.xxx.xxx.xxx

Scheda PPP VPN:

        Suffisso DNS specifico per connessione:
        Descrizione . . . . . . . . . . . . . : WAN (PPP/SLIP) Interface
        Indirizzo fisico. . . . . . . . . . . : 00-53-45-00-00-00
        DHCP abilitato. . . . . . . . . . . . : No
        Indirizzo IP. . . . . . . . . . . . . : 192.168.0.200
        Subnet mask . . . . . . . . . . . . . : 255.255.255.255
        Gateway predefinito . . . . . . . . . : 192.168.0.200
        Server DNS . . . . . . . . . . . . .  : 192.168.0.100
                                            212.34.224.132
        Server WINS primario . . . . . . . .  : 192.168.0.100

Aug 12 19:14:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 16
Aug 12 19:15:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 17
Aug 12 19:16:12 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #3: 
initiating Quick Mode PSK+ENCRYPT+COMPRESS+TUNNEL to
replace #2 {using isakmp#1}
Aug 12 19:16:13 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #1: 
ignoring informational payload, type INVALID_ID_INFOR
MATION
Aug 12 19:16:13 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #1: 
received and ignored informational message
Aug 12 19:16:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 18
Aug 12 19:17:22 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #3: max 
number of retransmissions (2) reached STATE_QUICK
_I1
Aug 12 19:17:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 19
Aug 12 19:18:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 20
Aug 12 19:19:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 21
Aug 12 19:20:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 22
Aug 12 19:20:42 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #2: 
IPsec SA expired (LATEST!)
Aug 12 19:20:42 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #4: 
initiating Quick Mode PSK+ENCRYPT+COMPRESS+TUNNEL {us
ing isakmp#1}
Aug 12 19:20:42 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #1: 
ignoring informational payload, type INVALID_ID_INFOR
MATION
Aug 12 19:20:42 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #1: 
received and ignored informational message
Aug 12 19:20:49 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #5: 
responding to Quick Mode {msgid:aebc7ba1}
Aug 12 19:20:49 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #5: 
transition from state STATE_QUICK_R0 to state STATE_Q
UICK_R1
Aug 12 19:20:49 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #5: 
STATE_QUICK_R1: sent QR1, inbound IPsec SA installed,
 expecting QI2
Aug 12 19:20:49 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #5: 
transition from state STATE_QUICK_R1 to state STATE_Q
UICK_R2
Aug 12 19:20:49 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #5: 
STATE_QUICK_R2: IPsec SA established {ESP=>0x32d6a6c4
 <0xfcbbe323 xfrm=3DES_0-HMAC_MD5 NATD=213.xxx.xxx.xxx:25782 DPD=none}
Aug 12 19:21:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 23
Aug 12 19:21:52 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #4: max 
number of retransmissions (2) reached STATE_QUICK
_I1
Aug 12 19:22:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 24
Aug 12 19:23:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 25
Aug 12 19:24:37 Orione postfix/smtpd[29582]: connect from 
unknown[192.168.0.102]
Aug 12 19:24:37 Orione postfix/smtpd[29582]: disconnect from 
unknown[192.168.0.102]
Aug 12 19:24:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 26
Aug 12 19:25:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 27
Aug 12 19:26:11 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #6: 
initiating Main Mode to replace #1
Aug 12 19:26:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 28
Aug 12 19:27:21 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #6: max 
number of retransmissions (2) reached STATE_MAIN_
I1.  No response (or no acceptable response) to our first IKE message
Aug 12 19:27:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 29
Aug 12 19:28:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 30
Aug 12 19:29:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 31
Aug 12 19:30:37 Orione postfix/smtpd[29938]: connect from 
unknown[192.168.0.102]
Aug 12 19:30:37 Orione postfix/smtpd[29938]: disconnect from 
unknown[192.168.0.102]
Aug 12 19:30:41 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #1: 
ISAKMP SA expired (LATEST!)
Aug 12 19:30:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 32
Aug 12 19:31:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 33
Aug 12 19:32:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 34
Aug 12 19:33:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 35
Aug 12 19:34:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 36
Aug 12 19:35:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 37
Aug 12 19:36:19 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #7: 
initiating Main Mode
Aug 12 19:36:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 38
Aug 12 19:37:29 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #7: max 
number of retransmissions (2) reached STATE_MAIN_
I1.  No response (or no acceptable response) to our first IKE message
Aug 12 19:37:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 39
Aug 12 19:38:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 40
Aug 12 19:39:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 41
Aug 12 19:40:42 Orione l2tpd[28979]: check_control: control, cid = 0, Ns = 
4, Nr = 42
Aug 12 19:40:49 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx #5: 
IPsec SA expired (LATEST!)
Aug 12 19:40:49 Orione pluto[28823]: "I-hate-vpn"[2] 213.xxx.xxx.xxx: 
deleting connection "I-hate-vpn" instance with peer 213.
xxx.xxx.xxx {isakmp=#0/ipsec=#0}
Aug 12 19:41:18 Orione pluto[28823]: packet from 213.xxx.xxx.xxx:25782: 
Informational Exchange is for an unknown (expired?) SA
Aug 12 19:41:47 Orione l2tpd[28979]: control_xmit: Maximum retries exceeded 
for tunnel 38221.  Closing.
...[snip]






----- Original Message ----- 
From: "Paul Wouters" <paul at xelerance.com>
To: "Stefano" <stefano.pazzaglia at fastwebnet.it>
Cc: <users at openswan.org>
Sent: Friday, August 12, 2005 5:40 PM
Subject: Re: [Openswan Users] L2TP/IPsec with double NAT


> On Fri, 12 Aug 2005, Stefano wrote:
>
>> Thanks Paul,  l2tp/ip now seems to work between  a natted server and not 
>> natted client. But if I'd like to make a connection between both server 
>> and client natted, client has a subnet of 37.xxx.xxx.0 and server has an 
>> interface on lan 192.168.0.0/24 what I have to put in virtual_private and 
>> rightsubnet?
>
> in config setup:
>
> nat_traversal=yes
> virtual_privae="%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v437.xxx.xxx.xxx.0/24,!%v4:192.168.0.0/24"
>
> in the conn:
>
> rightsubnet=vhost:%no,%priv
>
> Paul
>
>
> -- 
> No virus found in this incoming message.
> Checked by AVG Anti-Virus.
> Version: 7.0.338 / Virus Database: 267.10.7/70 - Release Date: 11/08/2005
>
> 



More information about the Users mailing list