Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSec/L2TP with pfSense 2.2

    Scheduled Pinned Locked Moved IPsec
    118 Posts 48 Posters 111.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      Phoenix
      last edited by

      As I configure a road warrior setup my clients are always behind NAT. Please note, that I tested Win8.1 and Android - neither works.

      1 Reply Last reply Reply Quote 0
      • W
        Wolvesclaw
        last edited by

        @jimp:

        Looks like there may be an issue when the client itself is behind NAT. Is that the case for everyone seeing problems?

        Yes, it is behind NAT.

        1 Reply Last reply Reply Quote 0
        • E
          eri--
          last edited by

          @Wolvesclaw:

          @jimp:

          Looks like there may be an issue when the client itself is behind NAT. Is that the case for everyone seeing problems?

          Yes, it is behind NAT.

          Than you should look at the sent identity from the mobile clients.
          Before racoon was tolerant on this identity if the remoteip matched either the one sent by clients or the one retrieved from packet itself.

          1 Reply Last reply Reply Quote 0
          • w0wW
            w0w
            last edited by

            I've tried to configure Android 4.1.2 L2TP https://doc.pfsense.org/index.php/L2TP/IPsec_on_Android#L2TP_Setup
            Nothing works. If you use IPSEC identifier, then android forces to use aggresive mode and connection fails, because you can not enable aggresive mode in strongwan when no xauth enabled and…  you can not use IPSEC without identifier if you don't use xauth. Epic...
            Does somebody else running IPSEC with android 4.1 on 2.2?

            EDIT:
            Solution
            strongswan app + generated certificate with additional Alternative Name "DNS" that must be similar to Common Name. And connection type is
            EAP-TLS, peer identifier is the same  as Common Name in Cert.

            1 Reply Last reply Reply Quote 0
            • X
              XaserII
              last edited by

              Hi there,

              I, too, spent the last two days trying to set this up properly, unfortunately with little success.

              Like pfSalmon and others I get a working IPSec connection (and it detects my LAN IP behind NAT) but L2TP won't respond at all, leading to a 809 error on windows.

              I did everything like in the docs tutorial and added the floating filter (made no difference)

              Unfortunately I can't contribute any info that might help to find the solution either, I'm pretty much a noob in that area..

              Hope someone will find a fix soon :)

              1 Reply Last reply Reply Quote 0
              • R
                revjamie
                last edited by

                I'm also having the same issue. My VPN clients can connect, but they can't access anything inside the network.

                1 Reply Last reply Reply Quote 0
                • X
                  XaserII
                  last edited by

                  I hope this doesn't get too messy, as there are people here who get a L2TP connection but can't communicate with local clients while others (like me) get an IPSec connection but no L2TP connection.

                  On that Note, I noticed something "weird looking" in the L2TP Raw Logs:

                  Feb 22 17:22:11 	l2tps: process 34657 started, version 4.4.1 (root@pfsense-22-amd64-builder 12:58 18-Nov-2014)
Feb 22 17:22:11 	l2tps: Label 'startup' not found
Feb 22 17:22:11 	l2tps: [l2tp0] using interface l2tp0
Feb 22 17:22:11 	l2tps: L2TP: waiting for connection on 0.0.0.0 1701

                  Is this "correct" behavior?

                  1 Reply Last reply Reply Quote 0
                  • M
                    m88
                    last edited by

                    I am having the same issue across the board with getting ipsec going. I followed this to the letter:
                    https://doc.pfsense.org/index.php/L2TP/IPsec

                    but still cant get a tunnel established. The closest i get is possibly the ipsec tunnel being established but no l2tp.

                    machines tested:

                    windows 2008 server, android 5.0.1, android 4.4.4

                    any help would be appreciated as i have been trying to get this going for about a week now.

                    1 Reply Last reply Reply Quote 0
                    • X
                      XaserII
                      last edited by

                      Any updates on this? did anyone find a solution or will this issue be addressed in a future update?

                      EDIT: More weird stuff.. after experimenting with IKEv2 n other VPN settings, AES doesn't work as encryption method for Phase 1 IPsec anymore, only 3DES does, and I'm very confident that it did beforehand…

                      1 Reply Last reply Reply Quote 0
                      • I
                        i1052
                        last edited by

                        https://doc.pfsense.org/index.php/L2TP/IPsec
                        I just fallowed this and did a little different configuration. Now it works on my iPhone/iPad and my MacbookAir(Yosemite 10.10.1).
                        In Phase 1, iOS only support DH group 2, not 14.
                        If i change the DH group to 14 (MODP_2048), I'll receive a mismatch error in logs.

                        Mar 3 09:49:39	charon: 10[CFG] received proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_256/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_128/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024
Mar 3 09:49:39	charon: 10[CFG] configured proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048

                        So it shows the iOS/OSX supports AES(128/256) or 3DES with DH group 2 in Phase 1.

                        If a Windows 2008 R2 client connects , the log shows this:

                        Mar 3 10:17:54	charon: 13[CFG] received proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_384, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_256, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024

                        It shows the Windows client support AES256 with DH group 14 or 3DES with DH group 2/14. The hash algorithmnly only support  SHA1.

                        An Android 4.1.1 client connects the log is like this:

                        Mar 3 10:23:47	charon: 08[CFG] received proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_256/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_128/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024

                        The Android client supports AES(128/256)/3DES/DES , with DH group 2.

                        At last I configured the Phase 1 use 3DES, SHA1, DH group 2, it works for iOS/Android/MacOS X/Windows. It's less security but that's enough for me.

                        If your iPhone can connect but you can't access any website, just fallow that guide add a floating firewall rule. It'll works.

                        But now if the Android and Windows connects, in Status>IPsec it shows a client connected and established a IPsec tunnel, but about half minute the client shows connect failed. And there's no L2TP logs.

                        Then I tried a Windows client with public IPv4 address, it connected successful.
                        It seems Android and Windows can't dial L2TP behind NAT now.
                        Hope someone will find a fix for this.

                        1 Reply Last reply Reply Quote 0
                        • M
                          mwhitcomb7
                          last edited by

                          Hi

                          I found a potential fix for the Windows clients here: http://support.microsoft.com/kb/926179 I used the number "2" setting, and rebooted my Win 8.1 client, the reg hack changes the NAT-T behavior.

                          However, I can't test it because like many others here in this post, I cannot get any activity on the L2TP server. IPsec connects fine but then nothing. I am following the guide and have quintuple checked the settings. There must be a rule (NAT-T?) that needs to go somewhere to allow UDP 1701 traffic to go some where. Is there an architecture diagram somewhere so I can understand the rule set flow from WAN to IPsec to L2TP VPN when NAT-T is invoked? I feel very close to a solution for Windows behind NAT. TIA.

                          If you want to you can cut and paste this into a .reg file and then import (Win7-8.1 only):

                          Windows Registry Editor Version 5.00

                          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent]

                          "AssumeUDPEncapsulationContextOnSendRule"=dword:00000002

                          1 Reply Last reply Reply Quote 0
                          • K
                            krankykoder
                            last edited by

                            Having not being able to get what I need from a VPN using the instructions for MSCHAPv2, I decided to go back to attempting a L2TP/IPsec VPN.

                            Using various suggestions found in this thread, I am able to successfully establish a connection using iOS 8x.

                            I have 2 problems now

                            Problem #1

                            I am unable to access anything both inside my network or out outside (internet). Attempting communications to any network device via IP or DNS fails. And, simply attempting to browse to something like google.com, also fails.

                            I have checked and rechecked my floating FW rules they're all good.
                            I have checked and rechecked my FW rules for IPsec & L2TP interfaces, also, all good.

                            Packet capture reveals nothing (admittedly, I may not be doing this part correctly)

                            Problem #2

                            The settings I had to use to get the iOS devices connected do not allow Windows 7/8.1 devices to connect at all. Which doesn't mean much since I can't get them to connect no matter what the Phase 1&2 settings are.

                            I have also checked and rechecked my settings on the Win clients, all are good.

                            I, as well as many others, I'm sure, were waiting for 2.2 so that we could have L2TP/IPsec VPN. It's a shame so many seem to not be able to get it to work.

                            Because of some of the VPN clients I need to support, OpenVPN isn't an option.

                            1 Reply Last reply Reply Quote 0
                            • S
                              Slasky
                              last edited by

                              Just to toss the salad some here:

                              My issues are as follows:

                              I've set up IPSec With IKE and it Works like a charm on my mobile phone. I can Access internal web-servers and such, when i'm Connected and the internet is provided from 4G.

                              What I cant get to work is my Laptop With VPN Connect software from Shrew Soft. The Client Connects, I get the welcome Message, but I can't Access local servers. This happens when the Laptop is Connected to my mobile phone on Wi-Fi hotspot With shared internet over 4G.

                              1 Reply Last reply Reply Quote 0
                              • D
                                d-ron23
                                last edited by

                                I've set up IPSec With IKE and it Works like a charm on my mobile phone. I can Access internal web-servers and such, when i'm Connected and the internet is provided from 4G

                                Can you provide your config?

                                1 Reply Last reply Reply Quote 0
                                • R
                                  relfie
                                  last edited by

                                  Hi ….

                                  I too am struggling with L2TP/IPSEC setup.  I have followed this doc https://doc.pfsense.org/index.php/L2TP/IPsec and it appears that IPSEC is negotiating but I am seeing the message "L2TP: connect: Address already in use" in l2tps.log - can anyone help with diagnosing or fixing??

                                  Log extracts here :

                                  IPSEC.LOG

                                  charon: 08[IKE] <2049> received NAT-T (RFC 3947) vendor ID
                                  charon: 08[IKE] received NAT-T (RFC 3947) vendor ID
                                  charon: 08[IKE] <2049> received draft-ietf-ipsec-nat-t-ike vendor ID
                                  charon: 08[IKE] received draft-ietf-ipsec-nat-t-ike vendor ID
                                  charon: 08[IKE] <2049> received draft-ietf-ipsec-nat-t-ike-08 vendor ID
                                  charon: 08[IKE] received draft-ietf-ipsec-nat-t-ike-08 vendor ID
                                  charon: 08[IKE] <2049> received draft-ietf-ipsec-nat-t-ike-07 vendor ID
                                  charon: 08[IKE] received draft-ietf-ipsec-nat-t-ike-07 vendor ID
                                  charon: 08[IKE] <2049> received draft-ietf-ipsec-nat-t-ike-06 vendor ID
                                  charon: 08[IKE] received draft-ietf-ipsec-nat-t-ike-06 vendor ID
                                  charon: 08[IKE] <2049> received draft-ietf-ipsec-nat-t-ike-05 vendor ID
                                  charon: 08[IKE] received draft-ietf-ipsec-nat-t-ike-05 vendor ID
                                  charon: 08[IKE] <2049> received draft-ietf-ipsec-nat-t-ike-04 vendor ID
                                  charon: 08[IKE] received draft-ietf-ipsec-nat-t-ike-04 vendor ID
                                  charon: 08[IKE] <2049> received draft-ietf-ipsec-nat-t-ike-03 vendor ID
                                  charon: 08[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID
                                  charon: 08[IKE] <2049> received draft-ietf-ipsec-nat-t-ike-02 vendor ID
                                  charon: 08[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID
                                  charon: 08[IKE] <2049> received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
                                  charon: 08[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
                                  charon: 08[IKE] <2049> received FRAGMENTATION vendor ID
                                  charon: 08[IKE] received FRAGMENTATION vendor ID
                                  charon: 08[IKE] <2049> received DPD vendor ID
                                  charon: 08[IKE] received DPD vendor ID
                                  charon: 08[IKE] <2049> aa.aa.aa.aaa is initiating a Main Mode IKE_SA
                                  charon: 08[IKE] aa.aa.aa.aaa is initiating a Main Mode IKE_SA
                                  charon: 08[IKE] <2049> remote host is behind NAT
                                  charon: 08[IKE] remote host is behind NAT
                                  charon: 08[CFG] <2049> looking for pre-shared key peer configs matching bb.bb.bb.bb…aa.aa.aa.aaa[192.168.44.96]
                                  charon: 08[CFG] looking for pre-shared key peer configs matching bb.bb.bb.bb…aa.aa.aa.aaa[192.168.44.96]
                                  charon: 08[CFG] <2049> selected peer config "con15"
                                  charon: 08[CFG] selected peer config "con15"
                                  charon: 08[IKE] <con15|2049>IKE_SA con15[2049] established between bb.bb.bb.bb[bb.bb.bb.bb]…aa.aa.aa.aaa[192.168.44.96]
                                  charon: 08[IKE] IKE_SA con15[2049] established between bb.bb.bb.bb[bb.bb.bb.bb]…aa.aa.aa.aaa[192.168.44.96]
                                  charon: 08[IKE] <con15|2049>scheduling reauthentication in 28003s
                                  charon: 08[IKE] scheduling reauthentication in 28003s
                                  charon: 08[IKE] <con15|2049>maximum IKE_SA lifetime 28543s
                                  charon: 08[IKE] maximum IKE_SA lifetime 28543s
                                  charon: 16[IKE] <con15|2049>CHILD_SA con15{35} established with SPIs cda22b5e_i 0ae4a0dc_o and TS bb.bb.bb.bb/32|/0[udp/l2f] === aa.aa.aa.aaa/32|/0[udp/56000]
                                  charon: 16[IKE] CHILD_SA con15{35} established with SPIs cda22b5e_i 0ae4a0dc_o and TS bb.bb.bb.bb/32|/0[udp/l2f] === aa.aa.aa.aaa/32|/0[udp/56000]

                                  L2TPS.LOG

                                  4slgbmernfw01 l2tps: Incoming L2TP packet from aa.aa.aa.aaa 56000
                                  4slgbmernfw01 l2tps: Incoming L2TP packet from aa.aa.aa.aaa 56000
                                  4slgbmernfw01 l2tps: L2TP: connect: Address already in use
                                  4slgbmernfw01 l2tps: Incoming L2TP packet from aa.aa.aa.aaa 56000
                                  4slgbmernfw01 l2tps: L2TP: connect: Address already in use
                                  4slgbmernfw01 l2tps: Incoming L2TP packet from aa.aa.aa.aaa 56000
                                  4slgbmernfw01 l2tps: L2TP: connect: Address already in use
                                  4slgbmernfw01 l2tps: Incoming L2TP packet from aa.aa.aa.aaa 56000
                                  4slgbmernfw01 l2tps: L2TP: connect: Address already in use
                                  4slgbmernfw01 l2tps: Incoming L2TP packet from aa.aa.aa.aaa 56000
                                  4slgbmernfw01 l2tps: L2TP: connect: Address already in use
                                  4slgbmernfw01 l2tps: Incoming L2TP packet from aa.aa.aa.aaa 56000
                                  4slgbmernfw01 l2tps: L2TP: connect: Address already in use
                                  4slgbmernfw01 l2tps: L2TP: Control connection 0x803456308 terminated: 6 (expecting reply; none received)
                                  4slgbmernfw01 l2tps: L2TP: Control connection 0x803456308 destroyed</con15|2049></con15|2049></con15|2049></con15|2049>

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    Slasky
                                    last edited by

                                    @d-ron23:

                                    I've set up IPSec With IKE and it Works like a charm on my mobile phone. I can Access internal web-servers and such, when i'm Connected and the internet is provided from 4G

                                    Can you provide your config?

                                    Since I posted this, the setup stopped working. Not sure why, but it might have something to do With recent packageinstallations, although it shouldn't.

                                    Below are Attached images of my setup. I set this up after a guide I found on this forum. Mobile Phones tend to use IKEv1, so if you are using mobile Phones and Laptops, use Auto on Version. With this IKEv2 should be available too.

                                    Not sure if you need to allow certain ports on the WAN Interface to allow (like port 500 and 4500), but I have added those just to be sure.

                                    I also set a rule that allows all IPSec network Clients to my LAN.

                                    Once Connected I could Reach my local web-servers With the local IPs without any issues.

                                    IPSec1.png
                                    IPSec1.png_thumb
                                    MobileClients.png
                                    MobileClients.png_thumb
                                    Phase2-1.png
                                    Phase2-1.png_thumb
                                    Phase2-2.png
                                    Phase2-2.png_thumb
                                    Tunnels.png
                                    Tunnels.png_thumb

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      sergiosmvc
                                      last edited by

                                      hello,

                                      With the new release 2.2.1 someone could establish one l2tp/ipsec connection with windows 7 / 8 native client?

                                      1 Reply Last reply Reply Quote 0
                                      • I
                                        ipitcher
                                        last edited by

                                        I'm seeing the same behavior on 2.2.1, which is IPSec connecting, but no L2TP activity ie. "l2tps: L2TP: connect: Address already in use" messages in the VPN log.

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          almabes
                                          last edited by

                                          I am seeing the same behavior as well.  I am running 2.2.1 on several customer firewalls.  I have configured IPSec/L2TP per JimP's instructions.  My clients are a Windows 7 box nat'd behind another pfSense 2.2.1 box, and an android device, either connected to 4G (nat'd by VZW) or wifi behind the same pfSense box.  The IPSec portion connects and establishes an SA, but I never see anything show up in the L2TP log. 
                                          I have added rules on the WAN side to allow traffic from * to UDP 500, 4500 and 1701.  I have added a rule to allow traffic from IPSec to any.

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            stoofz
                                            last edited by

                                            Same issue here with the L2TP / IPsec VPN, sigh. PPTP and OpenVPN both work flawless.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.