dkosovic
commented
7 years ago With the xl2tpd can't bind to port 1701 issue, I normally don't have xl2tpd running so don't see that message, Also my VPN server's firewall prevents L2TP connections without IPsec, so I'm not able to replicate all possible scenarios where it might try to connecting without encapsulating in IPsec.
if you do the following, you should see more pppd debugging in journalctl output which might give a hint:
sudo killall -TERM nm-l2tp-service
sudo /usr/lib/NetworkManager/nm-l2tp-service --debugWith tcpdump on the wifi interface, I only see decapsulated l2tp traffic for inbound traffic. and encapsulate l2tp oubound.
That would be interesting if xl2tpd is trying to do a L2TP connection with the IPsec connection being down. I didn't trust the exit status of the strongswan ipsec up command which brings up an IPsec connection, so explicitly call the ipsec status command to determine if the IPsec connection is up by search for "ESTABLISHED" in the output of that command, see code after the comments on this line:
You should see the following in the logs if it determines the IPsec connection is established: strongSwan ready for action
You might like to check if the IPsec connection is indeed up using just the command-line:
First add a pre-shared key to /etc/ipsec.secrets with a line something like:
: PSK this-is-my-PSKwith this-is-my-PSK replaced by the actual PSK.
You should hopefully have some ipsec.conf files under /var/run/nm-ipsec-l2tp.* that were generated by network-manager-l2tp. You can start the ipsec connection with something like:
sudo ipsec restart --conf /var/run/nm-ipsec-l2tp.12345/ipsec.conf --debug
sudo ipsec up nm-ipsec-l2tp-12345
sudo ipsec status
mgedmin
fnordahl
dragon788
delanym
I installed the plugin from the PPA
configured it with the gateway/username/password for my VPN, enabled the IPsec tunnel to L2TP host and entered the pre-shared key. Attempts to connect fail with the following error visible in
journalctl -b:I've tried to build my own xl2tpd as suggested on the wiki, except I couldn't remove the system xl2tpd package so I had to use dpkg-divert to replace its binaries with my own built versions:
but I still get the same "Maximum retries exceeded" error.
Other random flailing like disabling my ufw firewall or rebooting did not change anything about the failure.
I've tried Wireshark over my wifi interface, and I noticed a strange thing: there are ISAKMP messages for establishing the IPsec tunnel, but then the L2TP SCCRQ messages appear to be going to the VPN gateway over UDP directly, not over the IPsec tunnel. I'm not a networking expert, but I don't think I would be seeing those if they were tunneled.
Looking more closely over journalctl I see nothing suspicious, except maybe
(
netstat -tunlvp|grep 1701tells me it's my local xl2tpd listening on port 1701.)Aside: a coworker did successfully connect to the VPN server using network-manager-l2tp with Ubuntu 16.04, after following the instructions at http://blog.z-proj.com/enabling-l2tp-over-ipsec-on-ubuntu-16-04/, and he tells me that I've the right settings specified in the Network Manager GUI.
Preemptive update: I've strongswan 5.3.5-1ubuntu4.1 from yakkety-updates.