Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSec/L2TP with pfSense 2.2

    Scheduled Pinned Locked Moved IPsec
    118 Posts 48 Posters 111.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      robertwh
      last edited by

      I don't think the IPSEC tunnel is completly working though.
      I suspect it may be NAT-T related

      On the windows client it connects but never gets to the L2TP connection. It generates these logs and then drops with a 809 error.

      
Jan 22 09:13:19	charon: 09[IKE] <con1|27>closing CHILD_SA con1{27} with SPIs cb8d4f49_i (774 bytes) c223e6e8_o (0 bytes) and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 09:13:19	charon: 09[IKE] closing CHILD_SA con1{27} with SPIs cb8d4f49_i (774 bytes) c223e6e8_o (0 bytes) and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 09:13:19	charon: 15[IKE] <con1|27>Hash => 20 bytes @ 0x80d545540
Jan 22 09:13:19	charon: 15[IKE] <con1|27>0: 00 F2 7E 7F 5D 3A C0 86 3F D1 78 60 08 82 8B 6C ..~.]:..?.x`...l
Jan 22 09:13:19	charon: 15[IKE] <con1|27>16: C8 DD FE 22 ..."
Jan 22 09:13:19	charon: 15[IKE] Hash => 20 bytes @ 0x80d545540
Jan 22 09:13:19	charon: 15[IKE] 0: 00 F2 7E 7F 5D 3A C0 86 3F D1 78 60 08 82 8B 6C ..~.]:..?.x`...l
Jan 22 09:13:19	charon: 15[IKE] 16: C8 DD FE 22 ..."
Jan 22 09:13:19	charon: 15[IKE] <con1|27>received DELETE for IKE_SA con1[27]
Jan 22 09:13:19	charon: 15[IKE] received DELETE for IKE_SA con1[27]
Jan 22 09:13:19	charon: 15[IKE] <con1|27>deleting IKE_SA con1[27] between 162.217.144.166[162.217.144.166]...68.196.152.146[192.168.1.9]
Jan 22 09:13:19	charon: 15[IKE] deleting IKE_SA con1[27] between 162.217.144.166[162.217.144.166]...68.196.152.146[192.168.1.9]
Jan 22 09:13:19	charon: 15[IKE] <con1|27>IKE_SA con1[27] state change: ESTABLISHED => DELETING
Jan 22 09:13:19	charon: 15[IKE] IKE_SA con1[27] state change: ESTABLISHED => DELETING
Jan 22 09:13:19	charon: 15[IKE] <con1|27>IKE_SA con1[27] state change: DELETING => DELETING
Jan 22 09:13:19	charon: 15[IKE] IKE_SA con1[27] state change: DELETING => DELETING
Jan 22 09:13:19	charon: 15[IKE] <con1|27>IKE_SA con1[27] state change: DELETING => DESTROYING
Jan 22 09:13:19	charon: 15[IKE] IKE_SA con1[27] state change: DELETING => DESTROYING</con1|27></con1|27></con1|27></con1|27></con1|27></con1|27></con1|27></con1|27></con1|27>
      1 Reply Last reply Reply Quote 0
      • R
        robertwh
        last edited by

        Here is the complete log when the ipsec established but i see nothing on the l2tp side.

        I have tried setting the NAT-T to force and auto.

        
Last 500 IPsec log entries
Jan 22 10:21:32	charon: 16[IKE] received MS NT5 ISAKMPOAKLEY vendor ID
Jan 22 10:21:32	charon: 16[IKE] <40> received NAT-T (RFC 3947) vendor ID
Jan 22 10:21:32	charon: 16[IKE] received NAT-T (RFC 3947) vendor ID
Jan 22 10:21:32	charon: 16[IKE] <40> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Jan 22 10:21:32	charon: 16[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Jan 22 10:21:32	charon: 16[IKE] <40> received FRAGMENTATION vendor ID
Jan 22 10:21:32	charon: 16[IKE] received FRAGMENTATION vendor ID
Jan 22 10:21:32	charon: 16[IKE] <40> 68.196.152.146 is initiating a Main Mode IKE_SA
Jan 22 10:21:32	charon: 16[IKE] 68.196.152.146 is initiating a Main Mode IKE_SA
Jan 22 10:21:32	charon: 16[IKE] <40> remote host is behind NAT
Jan 22 10:21:32	charon: 16[IKE] remote host is behind NAT
Jan 22 10:21:32	charon: 16[IKE] <con1|40>IKE_SA con1[40] established between 162.217.144.166[162.217.144.166]...68.196.152.146[192.168.1.9]
Jan 22 10:21:32	charon: 16[IKE] IKE_SA con1[40] established between 162.217.144.166[162.217.144.166]...68.196.152.146[192.168.1.9]
Jan 22 10:21:32	charon: 16[IKE] <con1|40>DPD not supported by peer, disabled
Jan 22 10:21:32	charon: 16[IKE] DPD not supported by peer, disabled
Jan 22 10:21:32	charon: 07[IKE] <con1|40>received 3600s lifetime, configured 0s
Jan 22 10:21:32	charon: 07[IKE] received 3600s lifetime, configured 0s
Jan 22 10:21:32	charon: 07[IKE] <con1|40>received 250000000 lifebytes, configured 0
Jan 22 10:21:32	charon: 07[IKE] received 250000000 lifebytes, configured 0
Jan 22 10:21:32	charon: 07[IKE] <con1|40>CHILD_SA con1{40} established with SPIs c2ac3083_i 791710e4_o and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:32	charon: 07[IKE] CHILD_SA con1{40} established with SPIs c2ac3083_i 791710e4_o and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:32	charon: 09[IKE] <con1|40>received 3600s lifetime, configured 0s
Jan 22 10:21:32	charon: 09[IKE] received 3600s lifetime, configured 0s
Jan 22 10:21:32	charon: 09[IKE] <con1|40>received 250000000 lifebytes, configured 0
Jan 22 10:21:32	charon: 09[IKE] received 250000000 lifebytes, configured 0
Jan 22 10:21:32	charon: 09[IKE] <con1|40>detected rekeying of CHILD_SA con1{40}
Jan 22 10:21:32	charon: 09[IKE] detected rekeying of CHILD_SA con1{40}
Jan 22 10:21:32	charon: 07[IKE] <con1|40>CHILD_SA con1{40} established with SPIs ce98b678_i f53a2b36_o and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:32	charon: 07[IKE] CHILD_SA con1{40} established with SPIs ce98b678_i f53a2b36_o and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:32	charon: 14[IKE] <con1|40>received DELETE for ESP CHILD_SA with SPI 791710e4
Jan 22 10:21:32	charon: 14[IKE] received DELETE for ESP CHILD_SA with SPI 791710e4
Jan 22 10:21:32	charon: 14[IKE] <con1|40>closing CHILD_SA con1{40} with SPIs c2ac3083_i (0 bytes) 791710e4_o (0 bytes) and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:32	charon: 14[IKE] closing CHILD_SA con1{40} with SPIs c2ac3083_i (0 bytes) 791710e4_o (0 bytes) and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:35	charon: 14[IKE] <con1|40>received 3600s lifetime, configured 0s
Jan 22 10:21:35	charon: 14[IKE] received 3600s lifetime, configured 0s
Jan 22 10:21:35	charon: 14[IKE] <con1|40>received 250000000 lifebytes, configured 0
Jan 22 10:21:35	charon: 14[IKE] received 250000000 lifebytes, configured 0
Jan 22 10:21:35	charon: 14[IKE] <con1|40>detected rekeying of CHILD_SA con1{40}
Jan 22 10:21:35	charon: 14[IKE] detected rekeying of CHILD_SA con1{40}
Jan 22 10:21:35	charon: 14[IKE] <con1|40>CHILD_SA con1{40} established with SPIs c51633fb_i ca4d941f_o and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:35	charon: 14[IKE] CHILD_SA con1{40} established with SPIs c51633fb_i ca4d941f_o and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:35	charon: 16[IKE] <con1|40>received DELETE for ESP CHILD_SA with SPI f53a2b36
Jan 22 10:21:35	charon: 16[IKE] received DELETE for ESP CHILD_SA with SPI f53a2b36
Jan 22 10:21:35	charon: 16[IKE] <con1|40>closing CHILD_SA con1{40} with SPIs ce98b678_i (0 bytes) f53a2b36_o (0 bytes) and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:35	charon: 16[IKE] closing CHILD_SA con1{40} with SPIs ce98b678_i (0 bytes) f53a2b36_o (0 bytes) and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:39	charon: 16[IKE] <con1|40>received 3600s lifetime, configured 0s
Jan 22 10:21:39	charon: 16[IKE] received 3600s lifetime, configured 0s
Jan 22 10:21:39	charon: 16[IKE] <con1|40>received 250000000 lifebytes, configured 0
Jan 22 10:21:39	charon: 16[IKE] received 250000000 lifebytes, configured 0
Jan 22 10:21:39	charon: 16[IKE] <con1|40>detected rekeying of CHILD_SA con1{40}
Jan 22 10:21:39	charon: 16[IKE] detected rekeying of CHILD_SA con1{40}
Jan 22 10:21:39	charon: 16[IKE] <con1|40>CHILD_SA con1{40} established with SPIs c0f69931_i fff6c3f5_o and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:39	charon: 16[IKE] CHILD_SA con1{40} established with SPIs c0f69931_i fff6c3f5_o and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:39	charon: 10[IKE] <con1|40>received DELETE for ESP CHILD_SA with SPI ca4d941f
Jan 22 10:21:39	charon: 10[IKE] received DELETE for ESP CHILD_SA with SPI ca4d941f
Jan 22 10:21:39	charon: 10[IKE] <con1|40>closing CHILD_SA con1{40} with SPIs c51633fb_i (0 bytes) ca4d941f_o (0 bytes) and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:39	charon: 10[IKE] closing CHILD_SA con1{40} with SPIs c51633fb_i (0 bytes) ca4d941f_o (0 bytes) and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:47	charon: 10[IKE] <con1|40>received 3600s lifetime, configured 0s
Jan 22 10:21:47	charon: 10[IKE] received 3600s lifetime, configured 0s
Jan 22 10:21:47	charon: 10[IKE] <con1|40>received 250000000 lifebytes, configured 0
Jan 22 10:21:47	charon: 10[IKE] received 250000000 lifebytes, configured 0
Jan 22 10:21:47	charon: 10[IKE] <con1|40>detected rekeying of CHILD_SA con1{40}
Jan 22 10:21:47	charon: 10[IKE] detected rekeying of CHILD_SA con1{40}
Jan 22 10:21:47	charon: 10[IKE] <con1|40>CHILD_SA con1{40} established with SPIs c9cfefb5_i 4d93f9c0_o and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:47	charon: 10[IKE] CHILD_SA con1{40} established with SPIs c9cfefb5_i 4d93f9c0_o and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:47	charon: 07[IKE] <con1|40>received DELETE for ESP CHILD_SA with SPI fff6c3f5
Jan 22 10:21:47	charon: 07[IKE] received DELETE for ESP CHILD_SA with SPI fff6c3f5
Jan 22 10:21:47	charon: 07[IKE] <con1|40>closing CHILD_SA con1{40} with SPIs c0f69931_i (0 bytes) fff6c3f5_o (0 bytes) and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:47	charon: 07[IKE] closing CHILD_SA con1{40} with SPIs c0f69931_i (0 bytes) fff6c3f5_o (0 bytes) and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:57	charon: 07[IKE] <con1|40>received 3600s lifetime, configured 0s
Jan 22 10:21:57	charon: 07[IKE] received 3600s lifetime, configured 0s
Jan 22 10:21:57	charon: 07[IKE] <con1|40>received 250000000 lifebytes, configured 0
Jan 22 10:21:57	charon: 07[IKE] received 250000000 lifebytes, configured 0
Jan 22 10:21:57	charon: 07[IKE] <con1|40>detected rekeying of CHILD_SA con1{40}
Jan 22 10:21:57	charon: 07[IKE] detected rekeying of CHILD_SA con1{40}
Jan 22 10:21:57	charon: 07[IKE] <con1|40>CHILD_SA con1{40} established with SPIs c13e2917_i d30e718f_o and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:57	charon: 07[IKE] CHILD_SA con1{40} established with SPIs c13e2917_i d30e718f_o and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:57	charon: 10[IKE] <con1|40>received DELETE for ESP CHILD_SA with SPI 4d93f9c0
Jan 22 10:21:57	charon: 10[IKE] received DELETE for ESP CHILD_SA with SPI 4d93f9c0
Jan 22 10:21:57	charon: 10[IKE] <con1|40>closing CHILD_SA con1{40} with SPIs c9cfefb5_i (0 bytes) 4d93f9c0_o (0 bytes) and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]
Jan 22 10:21:57	charon: 10[IKE] closing CHILD_SA con1{40} with SPIs c9cfefb5_i (0 bytes) 4d93f9c0_o (0 bytes) and TS 162.217.144.166/32|/0[udp/l2f] === 68.196.152.146/32|/0[udp/l2f]</con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40></con1|40>
        1 Reply Last reply Reply Quote 0
        • E
          eri--
          last edited by

          Probably you have to disable rekey on this tunnel.

          1 Reply Last reply Reply Quote 0
          • R
            robertwh
            last edited by

            Here are my settings below, and it doesn't work.

            PHASE 1 SETTINGS

            Phase 1 proposal (Authentication):
            Authentication method: Mutual PSK
            Negotiation mode: Main
            My Identifier: My IP address

            Phase 1 proposal (Algorithms):
            Encryption algorithm: 3DES
            Hash algroithm: SHA1
            Dh key group: 2 (1024 bit)
            Lifetime: 28800 seconds

            Advanced options:
            Disable rekey is off
            Disable reauth is off
            NAT Traversal is Auto
            Dead Peer Detection is enabled

            PHASE 2 SETTINGS

            Phase 2 settings are all the defaults except MODE which should be transport so:

            MODE: Transport (this one f'd me up for a while, I kept setting it to tunnel)
            Protocol: ESP
            Encryption algrithms: AES (128 bits), 3DES, CAST128, DES
            Hash algorithems: MD5, SHA1, SHA256, SHA384, SHA512, AES-XCBC
            PFS key group: off
            Lifetime: 3600 seconds

            On the mobile clients tab:

            Enable IPsec mobile client support is checked
            Everything else on this tab is unchecked
            User Authentication is set to "Local Database" (which isn't actually used because Xauth isn't on in P1)
            Group Authentication is set to none

            On the Pre-Shared Keys tabs:
            Add a single PSK with the identifier "allusers", set this to something strong

            Firewall NAT:

            • No special NAT rules added, outbound NAT is automatic

            Firewall rules:

            • No special WAN rules added
            • No IPSec rules added
            • L2TP VPN, add a rule for the VPN traffic you want to allow.  I have a "pass-everything" rule here.  Note that if you add a rule, by default you get a pass all TCP rule, not a pass everything rule.

            L2TP VPN setup:
            L2TP server is Enabled
            Interface: LAN
            Remote address range: a range that is a subset of the LAN subnet, that starts on a /29 boundary.  I picked 192.168.x.208
            Subnet mask: /29
            Number of l2tp users: 8
            Secret: (blank)
            Authentication type: CHAP
            Server address: is the next ip outside the remote address range, 192.168.x.216 in my case.

            1 Reply Last reply Reply Quote 0
            • jimpJ
              jimp Rebel Alliance Developer Netgate
              last edited by

              @robertwh:

              Interface: LAN

              Should be WAN, not LAN (See https://doc.pfsense.org/index.php/L2TP/IPsec )

              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

              Need help fast? Netgate Global Support!

              Do not Chat/PM for help!

              1 Reply Last reply Reply Quote 0
              • R
                robertwh
                last edited by

                I have tried both it doesn't seem to matter for L2TP.

                I can still establish a  connection from the phone but not from windows client.

                1 Reply Last reply Reply Quote 0
                • jimpJ
                  jimp Rebel Alliance Developer Netgate
                  last edited by

                  @robertwh:

                  I have tried both it doesn't seem to matter for L2TP.

                  I can still establish a  connection from the phone but not from windows client.

                  The interface matters for L2TP. The transport mode IPsec tunnel is built between the client's IP address and the WAN IP address of the firewall. The L2TP client will send the L2TP request to the WAN IP of the firewall.

                  Using the exact settings on the guide, a Windows 8.1 client will connect and route. I haven't tried other versions of Windows though.

                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  1 Reply Last reply Reply Quote 0
                  • R
                    robertwh
                    last edited by

                    Jimp what version of the snapshot are you using?

                    1 Reply Last reply Reply Quote 0
                    • jimpJ
                      jimp Rebel Alliance Developer Netgate
                      last edited by

                      I've tried it with the most recent public build and with some of the newer builds we have been testing internally in preparation for release.

                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                      Need help fast? Netgate Global Support!

                      Do not Chat/PM for help!

                      1 Reply Last reply Reply Quote 0
                      • R
                        robertwh
                        last edited by

                        I have matched the configuration letter for letter and now matter what i do i cannot connect from windows 8.1 / 7

                        the one confusing part in L2TP

                        Current LAN: 192.168.1.1/24

                        Server Address 192.168.1.2
                        first starting 192.168.1.128 /25

                        Is this correct?

                        1 Reply Last reply Reply Quote 0
                        • jimpJ
                          jimp Rebel Alliance Developer Netgate
                          last edited by

                          @robertwh:

                          I have matched the configuration letter for letter and now matter what i do i cannot connect from windows 8.1 / 7

                          the one confusing part in L2TP

                          Current LAN: 192.168.1.1/24

                          Server Address 192.168.1.2
                          first starting 192.168.1.128 /25

                          Is this correct?

                          While that technically should work, I have not tested overlapping the LAN. It's best to use a different subnet.

                          Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                          Need help fast? Netgate Global Support!

                          Do not Chat/PM for help!

                          1 Reply Last reply Reply Quote 0
                          • A
                            AndrewZ
                            last edited by

                            Got it partially working…
                            1. this Floating rule for TCP is important, but I haven't seen the records in the log until #2 below
                            2. the most annoying: I had to set "Send All Traffic" enabled on iPad in order to access my local resources. Without this I had no traffic coming to PF over the tunnel.

                            Any idea how to avoid this #2 and send over the VPN only the traffic for my LAN?

                            1 Reply Last reply Reply Quote 0
                            • O
                              opti2k4
                              last edited by

                              Robert,

                              did you make any progress? I am having same issue, not seeing anything inside the log related to L2TP. Tried android and win 8.1, both not working. Simply i am not getting l2tp response from the server even though it's on WAN interface.

                              1 Reply Last reply Reply Quote 0
                              • P
                                Phoenix
                                last edited by

                                If any forum admin reads this: Please open a category for L2TP, like there is one for IPSec, PPTP and OpenVPN.

                                I do have the same trouble. I am very confident, that is is no IPSec issue. I do belive it is a issue with the network stack somehow, see my insights below:

                                I locate the mpd4 PID
                                [2.2-RELEASE][root@vicinity.dominion.ch]/var/etc: ps ax | grep mpd
                                7069  -  Ss    0:02.69 /usr/local/sbin/mpd5 -b -k -d /var/etc -f mpd_wan.conf -p /var/run/pppoe_wan.pid -s ppp pppoeclient
                                37089  -  Ss    0:00.02 /usr/local/sbin/mpd4 -b -k -d /var/etc/l2tp-vpn -p /var/run/l2tp-vpn.pid -s l2tps l2tps
                                54867  0  S+    0:00.01 grep mpd

                                and KILL it
                                [2.2-RELEASE][root@vicinity.dominion.ch]/var/etc: kill 37089

                                I start a background tcpdump on the pflog interface, the ip is my public ip I originate from (NATed of course)
                                [2.2-RELEASE][root@vicinity.dominion.ch]/var/etc: tcpdump -n -e -ttt -i pflog0 host 194.230.155.137 &
                                [1] 29082
                                [2.2-RELEASE][root@vicinity.dominion.ch]/var/etc: tcpdump: WARNING: pflog0: no IPv4 address assigned
                                tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
                                listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 65535 bytes
                                capability mode sandbox enabled

                                I start a fake daemon with netcat
                                [2.2-RELEASE][root@vicinity.dominion.ch]/var/etc: nc -l -u 1701
                                00:00:00.000000 rule 104..16777216/0(match): pass in on pppoe1: 194.230.155.137.43933 > 212.25.10.250.500: isakmp: phase 1 I ident
                                00:00:03.975271 rule 89..16777216/0(match): pass in on enc0: 194.230.155.137.55697 > 212.25.10.250.1701:  l2tp:TLSNs=0,Nr=0 *MSGTYPE(SCCRQ) *PROTO_VER(1.0) *HOST_NAME(anonymous) *FRAMING_CAP(AS) *ASSND_TUN_ID(63285) *RECV_WIN_SIZE(1)
                                ^C

                                I do see traffic PASS on enc0, but I see no traffic hitting netcat - that is probably why I see NO LOGs

                                At that point I am lost, I don't know where my packet vanishes.

                                1 Reply Last reply Reply Quote 0
                                • M
                                  meta4
                                  last edited by

                                  i'm unable to get a working config using:

                                  https://doc.pfsense.org/index.php?title=L2TP/IPsec&oldid=7045

                                  i also altered the config using the setup posted by themaninblack earlier in this thread without any success.

                                  trying to connect from osx client and ios.

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    Simple77
                                    last edited by

                                    Just a data point that I have gotten L2TP/IPsec working in testing with three virtual machines under Parallels, one pfSense 2.2 server, one Mavericks Mac on the LAN acting as a server, and one Mavericks Mac on the WAN acting as a VPN client.  I can connect and reach the LAN server to share files over AFP.

                                    I pretty much followed the steps in meta4's link above and made sure to use the 'allusers’ PSK identifier, the Floating Firewall Rule was in place (or AFP connections to the LAN didn't pass), and the DH key group to DH key group to 2 (1024 bit) to support the Macs.

                                    I've not enabled this in production as the existing LAN network would likely be unreachable.  If anyone is aware if there is an OpenVPN equivalent of 'push "route 10.0.0.0 255.255.0.0' for the L2TP/IPsec approach, details would be appreciated…

                                    1 Reply Last reply Reply Quote 0
                                    • P
                                      pfSalmon
                                      last edited by

                                      Really looking forward to connecting to pfSense with a built-in Win8.1 or Android VPN client.

                                      I followed the directions from the wiki:
                                      https://doc.pfsense.org/index.php?title=L2TP/IPsec&oldid=7045

                                      Status: The IPSec tunnel is created successfully, but the L2TP connection times out. No entries in L2TP or firewall logs.  Packet capture on IPSec interface comes up empty.

                                      I have allow-all rules in IPSec and L2TP VPN firewall tabs, and added the floating rule from the wiki. Not sure how to diagnose from here, but willing to try if anyone has any suggestions.

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        Bandee1987
                                        last edited by

                                        Hi all,

                                        Same problem here. IPSec tunnel was successfully established with the client but after that there's no l2tp connection.
                                        I've tried many things (as Phoenix and pfSalmon) with no success.

                                        1 Reply Last reply Reply Quote 0
                                        • W
                                          Wolvesclaw
                                          last edited by

                                          Got the same problem. IPSec connects but nothing shows up in l2tp-logs. The Client trys and throws error 809 after a while.

                                          Is there any solution yet?

                                          1 Reply Last reply Reply Quote 0
                                          • jimpJ
                                            jimp Rebel Alliance Developer Netgate
                                            last edited by

                                            Looks like there may be an issue when the client itself is behind NAT. Is that the case for everyone seeing problems?

                                            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                            Need help fast? Netgate Global Support!

                                            Do not Chat/PM for help!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.