Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSec/L2TP with pfSense 2.2

    IPsec
    48
    118
    105.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      meta4
      last edited by

      after upgrading to 2.2.2 i lost t2tp ipsec vpn connectivity.

      nothing is showing up in logs when i attempt to connect.

      was working fine on 2.2.1 using osx and ios clients.

      any changes after the update that i should check?

      ive gone through my config twice and cant find anything wrong

      1 Reply Last reply Reply Quote 0
      • Y
        yassen
        last edited by

        @jimp:

        It may be a bug in strongSwan.

        Client without NAT - works fine. Move the same client behind NAT, and the traffic never makes it through properly. IPsec layer connects, ESP traffic arrives, packets even show up on enc0 but somehow never make it to the L2TP daemon.

        Guys, why not putting a sticky on top of the How-To (https://doc.pfsense.org/index.php/L2TP/IPsec) that this works ONLY for clients not behind nat? I lost days banging my head against the wall … terrible experience. And a simple note would have saved me that.

        1 Reply Last reply Reply Quote 0
        • jimpJ
          jimp Rebel Alliance Developer Netgate
          last edited by

          I forgot to drop a note here but I did put a warning on the wiki doc.

          Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

          Need help fast? Netgate Global Support!

          Do not Chat/PM for help!

          1 Reply Last reply Reply Quote 0
          • R
            roaldhoolwerf
            last edited by

            Hello everybody,

            I've tried my hand today at getting a IPSec/L2TP config running on my freshly installed pfSense box. After a tad of tinkering, I've managed to get my macbook-tethered-via-iPhone connected, but I cannot access any servers after I've been connected. As far as I can tell, I've set up my firewall rules properly (please see attached images). I've been rifling through the logs but I cannot make anything of it yet. I've added the L2TP and IPsec logs as well, although my untrained eye hasn't seen anything wrong.

            Can anyone advice me on how to get this bit running? Any help would be hugely appreciated.
            If anyone needs any more information, I'll be happy to oblige!

            Kind regards,
            Roald

            ![Screen Shot 2015-06-21 at 16.52.12.png_thumb](/public/imported_attachments/1/Screen Shot 2015-06-21 at 16.52.12.png_thumb)
            ![Screen Shot 2015-06-21 at 16.52.12.png](/public/imported_attachments/1/Screen Shot 2015-06-21 at 16.52.12.png)
            ![Screen Shot 2015-06-21 at 16.51.25.png_thumb](/public/imported_attachments/1/Screen Shot 2015-06-21 at 16.51.25.png_thumb)
            ![Screen Shot 2015-06-21 at 16.51.25.png](/public/imported_attachments/1/Screen Shot 2015-06-21 at 16.51.25.png)
            ![Screen Shot 2015-06-21 at 16.43.34.png](/public/imported_attachments/1/Screen Shot 2015-06-21 at 16.43.34.png)
            ![Screen Shot 2015-06-21 at 16.43.29.png_thumb](/public/imported_attachments/1/Screen Shot 2015-06-21 at 16.43.29.png_thumb)
            ![Screen Shot 2015-06-21 at 16.43.34.png_thumb](/public/imported_attachments/1/Screen Shot 2015-06-21 at 16.43.34.png_thumb)
            ![Screen Shot 2015-06-21 at 16.43.29.png](/public/imported_attachments/1/Screen Shot 2015-06-21 at 16.43.29.png)

            1 Reply Last reply Reply Quote 0
            • K
              killmasta93
              last edited by

              @jimp i just wanted to point out this other post I have been troubleshooting and realized really odd things.

              https://forum.pfsense.org/index.php?topic=100600.msg561269#msg561269

              I was able to connect behind NAT only on ios 7.1.2 and i get a log on and i can ping 8.8.8.8 (high pings) but no navigation even following step by step of the wiki  , but on windows 8.1 cannot get a logon nor windows 7 x32 , x64 and windows xp also on MAC  :(

              https://doc.pfsense.org/index.php/L2TP/IPsec

              Thank you

              Tutorials:

              https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

              1 Reply Last reply Reply Quote 0
              • P
                Panja
                last edited by

                I've got this all to work and I can connect with my iPhone and MacBook without problems now.
                Thanks to this guide: https://doc.pfsense.org/index.php/L2TP/IPsec

                One question though.
                I have enabled the IPsec widget on the dashboard page.
                But when someone connects to my VPN I do not see any changes in the widget?
                Active tunnels stays on 0. Mobile users stays on 0.
                Shouldn't that change to 1 (or more) when users connect?

                When I go to status –> IPsec --> overview
                I do see that users are connected.

                Isn't there a more detailed status page for VPN connected users?
                For instance what (internal) IP they have etc, computer/hostname etc.

                1 Reply Last reply Reply Quote 0
                • K
                  killmasta93
                  last edited by

                  @panja i have followed that guide on 2.2 and on 2.2.4 and nothing I also tried other configuration and nothing But I was able to to get on IOS but not on windows. I just gave up and did L2TP without IPsec

                  Tutorials:

                  https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

                  1 Reply Last reply Reply Quote 0
                  • P
                    Panja
                    last edited by

                    I did not try Windows yet.
                    Will do later on and post back.

                    The problem is I want a VPN connection that is supported natively on machines.
                    OpenVPN is great but on all machines (Windows, Mac, iOS etc) you'll have to download an app before you can connect.

                    1 Reply Last reply Reply Quote 0
                    • jimpJ
                      jimp Rebel Alliance Developer Netgate
                      last edited by

                      L2TP is not good, really. Move on to IKEv2. It will work on Windows 7+ Natively, Ubuntu with network manager, OS X 10.11+, iOS 9+, and Android with the strongSwan app. That's as close as you're going to get. Requiring a native VPN client is a silly requirement anyhow, but if you insist, IKEv2 is the answer.

                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                      Need help fast? Netgate Global Support!

                      Do not Chat/PM for help!

                      1 Reply Last reply Reply Quote 0
                      • P
                        Panja
                        last edited by

                        @Panja:

                        One question though.
                        I have enabled the IPsec widget on the dashboard page.
                        But when someone connects to my VPN I do not see any changes in the widget?
                        Active tunnels stays on 0. Mobile users stays on 0.
                        Shouldn't that change to 1 (or more) when users connect?

                        When I go to status –> IPsec --> overview
                        I do see that users are connected.

                        Isn't there a more detailed status page for VPN connected users?
                        For instance what (internal) IP they have etc, computer/hostname etc.

                        Does anyone know this?

                        1 Reply Last reply Reply Quote 0
                        • jimpJ
                          jimp Rebel Alliance Developer Netgate
                          last edited by

                          There isn't a good way to represent L2TP/IPsec in the IPsec wizard. The IPsec side has no knowledge of the username, that's in L2TP not IPsec.

                          Anything done with L2TP/IPsec is likely a wasted effort. IKEv2 is so much easier and smoother, it's just not worth the headache to keep pounding away at L2TP/IPsec when it's not going to work right in most cases.

                          Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                          Need help fast? Netgate Global Support!

                          Do not Chat/PM for help!

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.