[Openswan Users] Roadwarrior cannot connect from the outside
Stian Skarsbø Solheim
lists at m3ua.net
Thu Jun 5 02:16:16 EDT 2014
Hi all,
Following a number of tutorials on the interwebs I have (finnaly!) gotten openswan/xl2tpd/pppd up and running on my Ubuntu 12.04 LTS box.
From my internal lan I can connect with iOS7, iOS5 (trusty old iPad 1), and OS X 10.9. However, when I try to connect from the cellular network (iPhone) I get the “L2TP server is not responding” error.
My setup is your normal home cable situation:
Internet <—> Cable Modem (bridge) <—> Home router (NAT) <—> openSwan server
Here is my ipsec.conf:
version 2.0
config setup
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.1.0/16,%v4:172.16.0.0/12
oe=off
protostack=netkey
listen=10.1.2.3
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
type=transport
left=10.1.2.3
leftnexthop=10.1.2.1
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
dpddelay=15
dpdtimeout=30
dpdaction=clear
In /var/log/auth.log when connecting from the outside I get this:
I see that the client is offering up 10.235.73.47 as its address and I suspect this is the culprit. Does anyone know a way around this? Thankful for any pointers :)
Jun 5 07:56:23 ltsbox pluto[798]: packet from 126.11.18.148:500: received Vendor ID payload [RFC 3947] method set to=115
Jun 5 07:56:23 ltsbox pluto[798]: packet from 126.11.18.148:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike] meth=114, but already using method 115
Jun 5 07:56:23 ltsbox pluto[798]: packet from 126.11.18.148:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-08] meth=113, but already using method 115
Jun 5 07:56:23 ltsbox pluto[798]: packet from 126.11.18.148:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-07] meth=112, but already using method 115
Jun 5 07:56:23 ltsbox pluto[798]: packet from 126.11.18.148:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-06] meth=111, but already using method 115
Jun 5 07:56:23 ltsbox pluto[798]: packet from 126.11.18.148:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-05] meth=110, but already using method 115
Jun 5 07:56:23 ltsbox pluto[798]: packet from 126.11.18.148:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-04] meth=109, but already using method 115
Jun 5 07:56:23 ltsbox pluto[798]: packet from 126.11.18.148:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 115
Jun 5 07:56:23 ltsbox pluto[798]: packet from 126.11.18.148:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 115
Jun 5 07:56:23 ltsbox pluto[798]: packet from 126.11.18.148:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 115
Jun 5 07:56:23 ltsbox pluto[798]: packet from 126.11.18.148:500: ignoring Vendor ID payload [FRAGMENTATION 80000000]
Jun 5 07:56:23 ltsbox pluto[798]: packet from 126.11.18.148:500: received Vendor ID payload [Dead Peer Detection]
Jun 5 07:56:23 ltsbox pluto[798]: "L2TP-PSK-NAT"[24] 126.11.18.148 #25: responding to Main Mode from unknown peer 126.11.18.148
Jun 5 07:56:23 ltsbox pluto[798]: "L2TP-PSK-NAT"[24] 126.11.18.148 #25: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Jun 5 07:56:23 ltsbox pluto[798]: "L2TP-PSK-NAT"[24] 126.11.18.148 #25: STATE_MAIN_R1: sent MR1, expecting MI2
Jun 5 07:56:24 ltsbox pluto[798]: "L2TP-PSK-NAT"[24] 126.11.18.148 #25: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): both are NATed
Jun 5 07:56:24 ltsbox pluto[798]: "L2TP-PSK-NAT"[24] 126.11.18.148 #25: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Jun 5 07:56:24 ltsbox pluto[798]: "L2TP-PSK-NAT"[24] 126.11.18.148 #25: STATE_MAIN_R2: sent MR2, expecting MI3
Jun 5 07:56:25 ltsbox pluto[798]: "L2TP-PSK-NAT"[24] 126.11.18.148 #25: ignoring informational payload, type IPSEC_INITIAL_CONTACT msgid=00000000
Jun 5 07:56:25 ltsbox pluto[798]: "L2TP-PSK-NAT"[24] 126.11.18.148 #25: Main mode peer ID is ID_IPV4_ADDR: '10.235.73.47'
Jun 5 07:56:25 ltsbox pluto[798]: "L2TP-PSK-NAT"[24] 126.11.18.148 #25: switched from "L2TP-PSK-NAT" to "L2TP-PSK-NAT"
Jun 5 07:56:25 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #25: deleting connection "L2TP-PSK-NAT" instance with peer 126.11.18.148 {isakmp=#0/ipsec=#0}
Jun 5 07:56:25 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #25: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Jun 5 07:56:25 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #25: new NAT mapping for #25, was 126.11.18.148:500, now 126.11.18.148:4500
Jun 5 07:56:25 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #25: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp1024}
Jun 5 07:56:25 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #25: Dead Peer Detection (RFC 3706): enabled
Jun 5 07:56:27 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #25: the peer proposed: 87.115.5.45/32:17/1701 -> 10.235.73.47/32:17/0
Jun 5 07:56:27 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #25: NAT-Traversal: received 2 NAT-OA. using first, ignoring others
Jun 5 07:56:27 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #26: responding to Quick Mode proposal {msgid:789f60f3}
Jun 5 07:56:27 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #26: us: 10.1.2.3<10.1.2.3>:17/1701---10.1.2.1
Jun 5 07:56:27 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #26: them: 126.11.18.148[10.235.73.47]:17/54988===10.235.73.47/32
Jun 5 07:56:27 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #26: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
Jun 5 07:56:27 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #26: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2
Jun 5 07:56:28 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #26: Dead Peer Detection (RFC 3706): enabled
Jun 5 07:56:28 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #26: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
Jun 5 07:56:28 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #26: STATE_QUICK_R2: IPsec SA established transport mode {ESP/NAT=>0x07d16b80 <0xd7ba0515 xfrm=AES_256-HMAC_SHA1 NATOA=10.235.73.47 NATD=126.11.18.148:4500 DPD=enabled}
Jun 5 07:56:48 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #25: received Delete SA(0x07d16b80) payload: deleting IPSEC State #26
Jun 5 07:56:48 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #25: ERROR: netlink XFRM_MSG_DELPOLICY response for flow eroute_connection delete included errno 2: No such file or directory
Jun 5 07:56:48 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #25: received and ignored informational message
Jun 5 07:56:48 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148 #25: received Delete SA payload: deleting ISAKMP State #25
Jun 5 07:56:48 ltsbox pluto[798]: "L2TP-PSK-NAT"[25] 126.11.18.148: deleting connection "L2TP-PSK-NAT" instance with peer 126.11.18.148 {isakmp=#0/ipsec=#0}
Jun 5 07:56:48 ltsbox pluto[798]: packet from 126.11.18.148:4500: received and ignored informational message
Br
Stian Skarsbø Solheim
More information about the Users
mailing list