[Openswan Users]

Siegfried Fischler siegfried.fischler2 at bluewin.ch
Fri Jul 15 00:03:22 CEST 2005

did add leftnexthop with the ip adr of the dsl router and as well the
openswan server and with this param the situation gets worse. nothing, i.e.
no dial-up client or dsl client will be able to establish even a tunnel.
there are no life signs in the log when using openswan with my initial
config when using the dsl client, but using the dial-up client shows lots of
positive log messages for l2tp and ppp. it appears that when trying to
establish a vpn session like illustrated in scenario #1

<client>--<dsl router>---<internet>---ip_1<dsl router>ip_2---ip_3<openswan
2.3.1 server>ip_4---<this is the LAN the VPN client should get access to>
(scenario #1)

l2tp daemon will not get notified at all (hence no log messages appear) and
obviously the client times-out and closes with the error 678 the tunnel. but
when doing the same with the scenarion #2

<ppp client>---<internet>---ip_1<dsl router>ip_2---ip_3<openswan 2.3.1
server>ip_4---<this is the LAN the VPN client should get access to>
(scenario #2)
the dial-up client happily gets access to the treasure, i.e. internal LAN.

#excerpt of ipsec.conf
conn roadwarrior-l2tp
	leftnexthop=ip_N # disables scenario #1 and #2 for ip_N where n

#l2tpd.conf content
#had initially listen_addr= in global section +
#DNAT rule for iptables but removed it until issue is resolved
auth file = /etc/l2tpd/l2tp-secrets
[lns default]
ip range =
local ip =
require chap = yes
refuse pap = yes
require authentication = yes
name = PegasusVPNserver
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tpd
length bit = yes

In order to not get any nervous breakdown I either get myself some serious
medication or better the right hint to solve this issue....

Thanks guys!

-----Original Message-----
From: Jacco de Leeuw [mailto:jacco2 at dds.nl]
Sent: Donnerstag, 14. Juli 2005 20:53
To: Siegfried Fischler
Subject: **SPAM** Re: [Openswan Users]

> conn roadwarrior-l2tp
> 	left=%defaultroute
> 	leftcert=pegasuscert.pem

Could you try this:


(Or whatever the internal IP address is of your NAT router).

> and now the log showing in the first part the WinXP client session when
> dialing-up into the internet and in the second using a client as well
> a dsl device and during the second session, the client shows the error
> message 678

Are there any log messages by the L2TP daemon?

Jacco de Leeuw                         mailto:jacco2 at dds.nl
Zaandam, The Netherlands           http://www.jacco2.dds.nl

More information about the Users mailing list