Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

windows client connecting..... and never connects #1322

Closed
6 tasks
ghost opened this issue Feb 10, 2023 · 3 comments
Closed
6 tasks

windows client connecting..... and never connects #1322

ghost opened this issue Feb 10, 2023 · 3 comments

Comments

@ghost
Copy link

ghost commented Feb 10, 2023

The L2TP/IPSEC server has been installed successfully, but when I try to connect via windows integrated client it appears connecting and nothing more happens.
Debugging with command ipsec barf I can see this in the server:

Feb 10 14:17:26 5002vx0711521000 pluto[5639]: packet from 10.10.101.2:500: initial Main Mode message received but no connection has been authorized with authby=PSK and xauth=no
Feb 10 14:17:27 5002vx0711521000 pluto[5639]: packet from 10.10.101.2:500: initial Main Mode message received but no connection has been authorized with authby=PSK and xauth=no
Feb 10 14:17:28 5002vx0711521000 pluto[5639]: packet from 10.10.101.2:500: initial Main Mode message received but no connection has been authorized with authby=PSK and xauth=no
Feb 10 14:17:31 5002vx0711521000 pluto[5639]: packet from 10.10.101.2:500: initial Main Mode message received but no connection has been authorized with authby=PSK and xauth=no
Feb 10 14:17:48 5002vx0711521000 pluto[5639]: forgetting secrets
Feb 10 14:17:48 5002vx0711521000 pluto[5639]: loading secrets from "/etc/ipsec.secrets"

Any idea which is my problem and how can I fixed it? regards.

Checklist

Describe the issue
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

  1. ...
  2. ...

Expected behavior
A clear and concise description of what you expected to happen.

Logs
Check logs and VPN status, and add error logs to help explain the problem, if applicable.

Server (please complete the following information)

  • OS: [e.g. Debian 11]
  • Hosting provider (if applicable): [e.g. GCP, AWS]

Client (please complete the following information)

  • Device: [e.g. iPhone 12]
  • OS: [e.g. iOS 15]
  • VPN mode: [IPsec/L2TP, IPsec/XAuth ("Cisco IPsec") or IKEv2]

Additional context
Add any other context about the problem here.

@hwdsl2
Copy link
Owner

hwdsl2 commented Feb 11, 2023

@santiarenos Hello! First, please note that IKEv2 mode is recommended. For IPsec/L2TP mode, the error you encountered shows that:

  1. Your VPN server's IPsec/L2TP connection ("l2tp-psk") did not load successfully, or
  2. Your server has multiple IP addresses, and the VPN client tries to connect to an IP address that is not on the default route.

For (1), check the Libreswan logs to see why the connection did not load. For (2), you may need to edit your /etc/ipsec.conf and replace left=%defaultroute with left=1.2.3.4, where 1.2.3.4 is the server's private or public IP address that you want to use for the VPN connection. Restart the IPsec service when finished.

@hwdsl2 hwdsl2 closed this as completed Feb 11, 2023
@ghost
Copy link
Author

ghost commented Feb 13, 2023

I think was the (2) option, I have changed the ip of the server and now I have another error.

Feb 13 08:57:46 localhost pluto[28270]: "l2tp-psk"[2] 10.10.101.2 #3: sent Main Mode R1
Feb 13 08:57:46 localhost pluto[28270]: "l2tp-psk"[2] 10.10.101.2 #3: sent Main Mode R2
Feb 13 08:57:46 localhost pluto[28270]: "l2tp-psk"[2] 10.10.101.2 #3: Peer ID is ID_IPV4_ADDR: '10.10.101.2'
Feb 13 08:57:46 localhost pluto[28270]: "l2tp-psk"[2] 10.10.101.2 #3: IKE SA established {auth=PRESHARED_KEY cipher=AES_CBC_256 integ=HMAC_SHA1 group=MODP2048}
Feb 13 08:57:46 localhost pluto[28270]: "l2tp-psk"[2] 10.10.101.2 #3: Configured DPD (RFC 3706) support not enabled because remote peer did not advertise DPD support
Feb 13 08:57:47 localhost pluto[28270]: "l2tp-psk"[2] 10.10.101.2 #3: the peer proposed: 10.10.1.205/32:1701 -UDP-> 10.10.101.2/32:1701
Feb 13 08:57:47 localhost pluto[28270]: "l2tp-psk"[2] 10.10.101.2 #3: NAT-Traversal: received 2 NAT-OA. Using first; ignoring others
Feb 13 08:57:47 localhost pluto[28270]: "l2tp-psk"[2] 10.10.101.2 #4: responding to Quick Mode proposal {msgid:00000001}
Feb 13 08:57:47 localhost pluto[28270]: "l2tp-psk"[2] 10.10.101.2 #4: us: 10.10.1.205/32:UDP/1701===10.10.1.205[130.61.69.20] them: 10.10.101.2===10.10.101.2/32:UDP/1701
Feb 13 08:57:47 localhost pluto[28270]: "l2tp-psk"[2] 10.10.101.2 #4: sent Quick Mode reply, inbound IPsec SA installed, expecting confirmation transport mode {ESPinUDP=>0x3890f18a <0x017106ec xfrm=AES_CBC_256-HMAC_SHA1_96 NATOA=10.10.101.2 NATD=10.10.101.2:4500 DPD=unsupported}
Feb 13 08:57:47 localhost pluto[28270]: "l2tp-psk"[2] 10.10.101.2 #4: IPsec SA established transport mode {ESPinUDP=>0x3890f18a <0x017106ec xfrm=AES_CBC_256-HMAC_SHA1_96 NATOA=10.10.101.2 NATD=10.10.101.2:4500 DPD=unsupported}
Feb 13 08:57:48 localhost pluto[28270]: "l2tp-psk"[2] 10.10.101.2 #3: received Delete SA(0x3890f18a) payload: deleting IPsec State #4
Feb 13 08:57:48 localhost pluto[28270]: "l2tp-psk"[2] 10.10.101.2 #4: deleting state (STATE_QUICK_R2) aged 1.205729s and sending notification
Feb 13 08:57:48 localhost pluto[28270]: "l2tp-psk"[2] 10.10.101.2 #4: ESP traffic information: in=775B out=529B
Feb 13 08:57:48 localhost pluto[28270]: "l2tp-psk"[2] 10.10.101.2 #3: deleting state (STATE_MAIN_R3) aged 1.677725s and sending notification
Feb 13 08:57:48 localhost pluto[28270]: "l2tp-psk"[2] 10.10.101.2: deleting connection instance with peer 10.10.101.2 {isakmp=#0/ipsec=#0}
Feb 13 08:58:01 localhost CRON[28893]: pam_unix(cron:session): session opened for user root by (uid=0)
Feb 13 08:58:08 localhost CRON[28893]: pam_unix(cron:session): session closed for user root
Feb 13 08:58:45 localhost pluto[28270]: forgetting secrets
Feb 13 08:58:45 localhost pluto[28270]: loading secrets from "/etc/ipsec.secrets"

I have been trying to fix it but still not working. Any ideas?

@ghost
Copy link
Author

ghost commented Feb 13, 2023

Finally it works, disabling chapv2 in the windows client.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant