Hi All,
I'm trying to set up remote access VPN to my home LAN which is protected by an Astaro UTM 9.x gateway. I'm wanting to use L2TP over IPsec but can't get the link to establish through my external NIC. Using the same settings (except to change the VPN to 'internal interface') I can establish a stable VPN via the LAN side of the gateway. I've tried disabling as amny security feature as I can think of and have set up a rule for allow 'anything to anywhere' but it's got me beat!
I've copied in the VPN logs in the hope that it means something to someone...
Thanks,
Colin
(PS - sorry this will look like War & Peace)
External interface (WAN) cant establish VPN
CandCB pluto[21248]: loading secrets from "/etc/ipsec.secrets"
CandCB pluto[21248]: loaded PSK secret for 88.104.166.168 %any
CandCB pluto[21248]: forgetting secrets
CandCB pluto[21248]: loading secrets from "/etc/ipsec.secrets"
CandCB pluto[21248]: loaded PSK secret for 88.104.166.168 %any
CandCB pluto[21248]: loading ca certificates from '/etc/ipsec.d/cacerts'
CandCB pluto[21248]: loaded ca certificate from '/etc/ipsec.d/cacerts/VPN Signing CA.pem'
CandCB pluto[21248]: loading aa certificates from '/etc/ipsec.d/aacerts'
CandCB pluto[21248]: loading ocsp certificates from '/etc/ipsec.d/ocspcerts'
CandCB pluto[21248]: loading attribute certificates from '/etc/ipsec.d/acerts'
CandCB pluto[21248]: Changing to directory '/etc/ipsec.d/crls'
CandCB pluto[21248]: "S_for RemoteUser": deleting connection
CandCB pluto[21248]: "S_for RemoteUser": deleting connection
CandCB pluto[21248]: added connection description "S_for RemoteUser"
CandCB pluto[21248]: added connection description "S_for RemoteUser"
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [FRAGMENTATION]
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [Vid-Initial-Contact]
CandCB pluto[21248]: "S_for RemoteUser"[1] 88.104.166.254 #67: responding to Main Mode from unknown peer 88.104.166.254
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [FRAGMENTATION]
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [Vid-Initial-Contact]
CandCB pluto[21248]: "S_for RemoteUser"[1] 88.104.166.254 #68: responding to Main Mode from unknown peer 88.104.166.254
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [FRAGMENTATION]
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [Vid-Initial-Contact]
CandCB pluto[21248]: "S_for RemoteUser"[1] 88.104.166.254 #69: responding to Main Mode from unknown peer 88.104.166.254
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [FRAGMENTATION]
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [Vid-Initial-Contact]
CandCB pluto[21248]: "S_for RemoteUser"[1] 88.104.166.254 #70: responding to Main Mode from unknown peer 88.104.166.254
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [FRAGMENTATION]
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [Vid-Initial-Contact]
CandCB pluto[21248]: "S_for RemoteUser"[1] 88.104.166.254 #71: responding to Main Mode from unknown peer 88.104.166.254
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [FRAGMENTATION]
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [Vid-Initial-Contact]
2012:12:06-19:35:15 CandCB pluto[21248]: "S_for RemoteUser"[1] 88.104.166.254 #72: responding to Main Mode from unknown peer 88.104.166.254
2012:12:06-19:35:22 CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Delete SA payload: not encrypted
Internal interface VPN works fine
CandCB pluto[21248]: packet from 192.168.0.99:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
CandCB pluto[21248]: packet from 192.168.0.99:500: ignoring Vendor ID payload [FRAGMENTATION]
CandCB pluto[21248]: packet from 192.168.0.99:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
CandCB pluto[21248]: packet from 192.168.0.99:500: ignoring Vendor ID payload [Vid-Initial-Contact]
CandCB pluto[21248]: "S_for RemoteUser"[1] 192.168.0.99 #73: responding to Main Mode from unknown peer 192.168.0.99
CandCB pluto[21248]: "S_for RemoteUser"[1] 192.168.0.99 #73: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: no NAT detected
CandCB pluto[21248]: "S_for RemoteUser"[1] 192.168.0.99 #73: Peer ID is ID_IPV4_ADDR: '192.168.0.99'
CandCB pluto[21248]: "S_for RemoteUser"[1] 192.168.0.99 #73: sent MR3, ISAKMP SA established
CandCB pluto[21248]: "S_for RemoteUser"[1] 192.168.0.99 #74: responding to Quick Mode
CandCB pluto[21248]: "S_for RemoteUser"[1] 192.168.0.99 #74: IPsec SA established {ESP=>0x4a5b7498 <0xa07a9157}
CandCB openl2tpd[25731]: FUNC: tunl 11823: allocated context using profile 'default', created by network request
CandCB openl2tpd[25731]: PROTO: tunl 11823: SCCRQ received from peer 1
CandCB openl2tpd[25731]: FSM: CCE(11823) event SCCRQ_ACCEPT in state IDLE
CandCB openl2tpd[25731]: PROTO: tunl 11823: adjust tx_window_size: peer=8, ours=10
CandCB openl2tpd[25731]: PROTO: tunl 11823: sending SCCRP to peer 1
CandCB openl2tpd[25731]: FSM: CCE(11823) state change: IDLE --> WAITCTLCONN
CandCB openl2tpd[25731]: PROTO: tunl 11823: SCCCN received from peer 1
CandCB openl2tpd[25731]: FSM: CCE(11823) event SCCCN_ACCEPT in state WAITCTLCONN
CandCB openl2tpd[25731]: FUNC: tunl 11823 up
CandCB openl2tpd[25731]: FSM: CCE(11823) state change: WAITCTLCONN --> ESTABLISHED
CandCB openl2tpd[25731]: PROTO: tunl 11823/0: ICRQ received from peer 1
CandCB openl2tpd[25731]: PROTO: tunl 11823/19360: sending ICRP to peer 1/1
CandCB openl2tpd[25731]: PROTO: tunl 11823/19360: ICCN received from peer 1
CandCB pppd-l2tp[5852]: Plugin aua.so loaded.
CandCB pppd-l2tp[5852]: AUA plugin initialized.
CandCB pppd-l2tp[5852]: Plugin ippool.so loaded.
CandCB pppd-l2tp[5852]: Plugin pppol2tp.so loaded.
CandCB pppd-l2tp[5852]: pppd 2.4.5 started by (unknown), uid 0
CandCB pppd-l2tp[5852]: using channel 23
CandCB pppd-l2tp[5852]: Using interface ppp1
CandCB pppd-l2tp[5852]: Connect: ppp1 <-->
CandCB pppd-l2tp[5852]: Overriding mtu 1500 to 1380
CandCB pppd-l2tp[5852]: PPPoL2TP options: lnsmode tid 11823 sid 19360 debugmask 0
CandCB pppd-l2tp[5852]: Overriding mru 1500 to mtu value 1380
CandCB pppd-l2tp[5852]: sent [LCP ConfReq id=0x1 <mru 1380> <asyncmap 0x0> <auth chap MS-v2> <magic 0xff87bcd9>]
I'm trying to set up remote access VPN to my home LAN which is protected by an Astaro UTM 9.x gateway. I'm wanting to use L2TP over IPsec but can't get the link to establish through my external NIC. Using the same settings (except to change the VPN to 'internal interface') I can establish a stable VPN via the LAN side of the gateway. I've tried disabling as amny security feature as I can think of and have set up a rule for allow 'anything to anywhere' but it's got me beat!
I've copied in the VPN logs in the hope that it means something to someone...
Thanks,
Colin
(PS - sorry this will look like War & Peace)
External interface (WAN) cant establish VPN
CandCB pluto[21248]: loading secrets from "/etc/ipsec.secrets"
CandCB pluto[21248]: loaded PSK secret for 88.104.166.168 %any
CandCB pluto[21248]: forgetting secrets
CandCB pluto[21248]: loading secrets from "/etc/ipsec.secrets"
CandCB pluto[21248]: loaded PSK secret for 88.104.166.168 %any
CandCB pluto[21248]: loading ca certificates from '/etc/ipsec.d/cacerts'
CandCB pluto[21248]: loaded ca certificate from '/etc/ipsec.d/cacerts/VPN Signing CA.pem'
CandCB pluto[21248]: loading aa certificates from '/etc/ipsec.d/aacerts'
CandCB pluto[21248]: loading ocsp certificates from '/etc/ipsec.d/ocspcerts'
CandCB pluto[21248]: loading attribute certificates from '/etc/ipsec.d/acerts'
CandCB pluto[21248]: Changing to directory '/etc/ipsec.d/crls'
CandCB pluto[21248]: "S_for RemoteUser": deleting connection
CandCB pluto[21248]: "S_for RemoteUser": deleting connection
CandCB pluto[21248]: added connection description "S_for RemoteUser"
CandCB pluto[21248]: added connection description "S_for RemoteUser"
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [FRAGMENTATION]
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [Vid-Initial-Contact]
CandCB pluto[21248]: "S_for RemoteUser"[1] 88.104.166.254 #67: responding to Main Mode from unknown peer 88.104.166.254
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [FRAGMENTATION]
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [Vid-Initial-Contact]
CandCB pluto[21248]: "S_for RemoteUser"[1] 88.104.166.254 #68: responding to Main Mode from unknown peer 88.104.166.254
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [FRAGMENTATION]
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [Vid-Initial-Contact]
CandCB pluto[21248]: "S_for RemoteUser"[1] 88.104.166.254 #69: responding to Main Mode from unknown peer 88.104.166.254
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [FRAGMENTATION]
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [Vid-Initial-Contact]
CandCB pluto[21248]: "S_for RemoteUser"[1] 88.104.166.254 #70: responding to Main Mode from unknown peer 88.104.166.254
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [FRAGMENTATION]
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [Vid-Initial-Contact]
CandCB pluto[21248]: "S_for RemoteUser"[1] 88.104.166.254 #71: responding to Main Mode from unknown peer 88.104.166.254
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [FRAGMENTATION]
CandCB pluto[21248]: packet from 88.104.166.254:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Vendor ID payload [Vid-Initial-Contact]
2012:12:06-19:35:15 CandCB pluto[21248]: "S_for RemoteUser"[1] 88.104.166.254 #72: responding to Main Mode from unknown peer 88.104.166.254
2012:12:06-19:35:22 CandCB pluto[21248]: packet from 88.104.166.254:500: ignoring Delete SA payload: not encrypted
Internal interface VPN works fine
CandCB pluto[21248]: packet from 192.168.0.99:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
CandCB pluto[21248]: packet from 192.168.0.99:500: ignoring Vendor ID payload [FRAGMENTATION]
CandCB pluto[21248]: packet from 192.168.0.99:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
CandCB pluto[21248]: packet from 192.168.0.99:500: ignoring Vendor ID payload [Vid-Initial-Contact]
CandCB pluto[21248]: "S_for RemoteUser"[1] 192.168.0.99 #73: responding to Main Mode from unknown peer 192.168.0.99
CandCB pluto[21248]: "S_for RemoteUser"[1] 192.168.0.99 #73: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: no NAT detected
CandCB pluto[21248]: "S_for RemoteUser"[1] 192.168.0.99 #73: Peer ID is ID_IPV4_ADDR: '192.168.0.99'
CandCB pluto[21248]: "S_for RemoteUser"[1] 192.168.0.99 #73: sent MR3, ISAKMP SA established
CandCB pluto[21248]: "S_for RemoteUser"[1] 192.168.0.99 #74: responding to Quick Mode
CandCB pluto[21248]: "S_for RemoteUser"[1] 192.168.0.99 #74: IPsec SA established {ESP=>0x4a5b7498 <0xa07a9157}
CandCB openl2tpd[25731]: FUNC: tunl 11823: allocated context using profile 'default', created by network request
CandCB openl2tpd[25731]: PROTO: tunl 11823: SCCRQ received from peer 1
CandCB openl2tpd[25731]: FSM: CCE(11823) event SCCRQ_ACCEPT in state IDLE
CandCB openl2tpd[25731]: PROTO: tunl 11823: adjust tx_window_size: peer=8, ours=10
CandCB openl2tpd[25731]: PROTO: tunl 11823: sending SCCRP to peer 1
CandCB openl2tpd[25731]: FSM: CCE(11823) state change: IDLE --> WAITCTLCONN
CandCB openl2tpd[25731]: PROTO: tunl 11823: SCCCN received from peer 1
CandCB openl2tpd[25731]: FSM: CCE(11823) event SCCCN_ACCEPT in state WAITCTLCONN
CandCB openl2tpd[25731]: FUNC: tunl 11823 up
CandCB openl2tpd[25731]: FSM: CCE(11823) state change: WAITCTLCONN --> ESTABLISHED
CandCB openl2tpd[25731]: PROTO: tunl 11823/0: ICRQ received from peer 1
CandCB openl2tpd[25731]: PROTO: tunl 11823/19360: sending ICRP to peer 1/1
CandCB openl2tpd[25731]: PROTO: tunl 11823/19360: ICCN received from peer 1
CandCB pppd-l2tp[5852]: Plugin aua.so loaded.
CandCB pppd-l2tp[5852]: AUA plugin initialized.
CandCB pppd-l2tp[5852]: Plugin ippool.so loaded.
CandCB pppd-l2tp[5852]: Plugin pppol2tp.so loaded.
CandCB pppd-l2tp[5852]: pppd 2.4.5 started by (unknown), uid 0
CandCB pppd-l2tp[5852]: using channel 23
CandCB pppd-l2tp[5852]: Using interface ppp1
CandCB pppd-l2tp[5852]: Connect: ppp1 <-->
CandCB pppd-l2tp[5852]: Overriding mtu 1500 to 1380
CandCB pppd-l2tp[5852]: PPPoL2TP options: lnsmode tid 11823 sid 19360 debugmask 0
CandCB pppd-l2tp[5852]: Overriding mru 1500 to mtu value 1380
CandCB pppd-l2tp[5852]: sent [LCP ConfReq id=0x1 <mru 1380> <asyncmap 0x0> <auth chap MS-v2> <magic 0xff87bcd9>]