IPSec/L2TP with pfSense 2.2

eri--

Probably you have to disable rekey on this tunnel.

robertwh

Here are my settings below, and it doesn't work.

PHASE 1 SETTINGS

Phase 1 proposal (Authentication):
Authentication method: Mutual PSK
Negotiation mode: Main
My Identifier: My IP address

Phase 1 proposal (Algorithms):
Encryption algorithm: 3DES
Hash algroithm: SHA1
Dh key group: 2 (1024 bit)
Lifetime: 28800 seconds

Advanced options:
Disable rekey is off
Disable reauth is off
NAT Traversal is Auto
Dead Peer Detection is enabled

PHASE 2 SETTINGS

Phase 2 settings are all the defaults except MODE which should be transport so:

MODE: Transport (this one f'd me up for a while, I kept setting it to tunnel)
Protocol: ESP
Encryption algrithms: AES (128 bits), 3DES, CAST128, DES
Hash algorithems: MD5, SHA1, SHA256, SHA384, SHA512, AES-XCBC
PFS key group: off
Lifetime: 3600 seconds

On the mobile clients tab:

Enable IPsec mobile client support is checked
Everything else on this tab is unchecked
User Authentication is set to "Local Database" (which isn't actually used because Xauth isn't on in P1)
Group Authentication is set to none

On the Pre-Shared Keys tabs:
Add a single PSK with the identifier "allusers", set this to something strong

Firewall NAT:

No special NAT rules added, outbound NAT is automatic

Firewall rules:

No special WAN rules added
No IPSec rules added
L2TP VPN, add a rule for the VPN traffic you want to allow. I have a "pass-everything" rule here. Note that if you add a rule, by default you get a pass all TCP rule, not a pass everything rule.

L2TP VPN setup:
L2TP server is Enabled
Interface: LAN
Remote address range: a range that is a subset of the LAN subnet, that starts on a /29 boundary. I picked 192.168.x.208
Subnet mask: /29
Number of l2tp users: 8
Secret: (blank)
Authentication type: CHAP
Server address: is the next ip outside the remote address range, 192.168.x.216 in my case.

jimp

@robertwh:

Interface: LAN

Should be WAN, not LAN (See https://doc.pfsense.org/index.php/L2TP/IPsec )

robertwh

I have tried both it doesn't seem to matter for L2TP.

I can still establish a connection from the phone but not from windows client.

jimp

@robertwh:

I have tried both it doesn't seem to matter for L2TP.

I can still establish a connection from the phone but not from windows client.

The interface matters for L2TP. The transport mode IPsec tunnel is built between the client's IP address and the WAN IP address of the firewall. The L2TP client will send the L2TP request to the WAN IP of the firewall.

Using the exact settings on the guide, a Windows 8.1 client will connect and route. I haven't tried other versions of Windows though.

robertwh

Jimp what version of the snapshot are you using?

jimp

I've tried it with the most recent public build and with some of the newer builds we have been testing internally in preparation for release.

robertwh

I have matched the configuration letter for letter and now matter what i do i cannot connect from windows 8.1 / 7

the one confusing part in L2TP

Current LAN: 192.168.1.1/24

Server Address 192.168.1.2
first starting 192.168.1.128 /25

Is this correct?

jimp

@robertwh:

I have matched the configuration letter for letter and now matter what i do i cannot connect from windows 8.1 / 7

the one confusing part in L2TP

Current LAN: 192.168.1.1/24

Server Address 192.168.1.2
first starting 192.168.1.128 /25

Is this correct?

While that technically should work, I have not tested overlapping the LAN. It's best to use a different subnet.

AndrewZ

Got it partially working…
1. this Floating rule for TCP is important, but I haven't seen the records in the log until #2 below
2. the most annoying: I had to set "Send All Traffic" enabled on iPad in order to access my local resources. Without this I had no traffic coming to PF over the tunnel.

Any idea how to avoid this #2 and send over the VPN only the traffic for my LAN?

opti2k4

Robert,

did you make any progress? I am having same issue, not seeing anything inside the log related to L2TP. Tried android and win 8.1, both not working. Simply i am not getting l2tp response from the server even though it's on WAN interface.

Phoenix

If any forum admin reads this: Please open a category for L2TP, like there is one for IPSec, PPTP and OpenVPN.

I do have the same trouble. I am very confident, that is is no IPSec issue. I do belive it is a issue with the network stack somehow, see my insights below:

I locate the mpd4 PID
[2.2-RELEASE][root@vicinity.dominion.ch]/var/etc: ps ax | grep mpd
7069 - Ss 0:02.69 /usr/local/sbin/mpd5 -b -k -d /var/etc -f mpd_wan.conf -p /var/run/pppoe_wan.pid -s ppp pppoeclient
37089 - Ss 0:00.02 /usr/local/sbin/mpd4 -b -k -d /var/etc/l2tp-vpn -p /var/run/l2tp-vpn.pid -s l2tps l2tps
54867 0 S+ 0:00.01 grep mpd

and KILL it
[2.2-RELEASE][root@vicinity.dominion.ch]/var/etc: kill 37089

I start a background tcpdump on the pflog interface, the ip is my public ip I originate from (NATed of course)
[2.2-RELEASE][root@vicinity.dominion.ch]/var/etc: tcpdump -n -e -ttt -i pflog0 host 194.230.155.137 &
[1] 29082
[2.2-RELEASE][root@vicinity.dominion.ch]/var/etc: tcpdump: WARNING: pflog0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 65535 bytes
capability mode sandbox enabled

I start a fake daemon with netcat
[2.2-RELEASE][root@vicinity.dominion.ch]/var/etc: nc -l -u 1701
00:00:00.000000 rule 104..16777216/0(match): pass in on pppoe1: 194.230.155.137.43933 > 212.25.10.250.500: isakmp: phase 1 I ident
00:00:03.975271 rule 89..16777216/0(match): pass in on enc0: 194.230.155.137.55697 > 212.25.10.250.1701: l2tp:TLSNs=0,Nr=0 *MSGTYPE(SCCRQ) *PROTO_VER(1.0) *HOST_NAME(anonymous) *FRAMING_CAP(AS) *ASSND_TUN_ID(63285) *RECV_WIN_SIZE(1)
^C

I do see traffic PASS on enc0, but I see no traffic hitting netcat - that is probably why I see NO LOGs

At that point I am lost, I don't know where my packet vanishes.

meta4

i'm unable to get a working config using:

https://doc.pfsense.org/index.php?title=L2TP/IPsec&oldid=7045

i also altered the config using the setup posted by themaninblack earlier in this thread without any success.

trying to connect from osx client and ios.

Simple77

Just a data point that I have gotten L2TP/IPsec working in testing with three virtual machines under Parallels, one pfSense 2.2 server, one Mavericks Mac on the LAN acting as a server, and one Mavericks Mac on the WAN acting as a VPN client. I can connect and reach the LAN server to share files over AFP.

I pretty much followed the steps in meta4's link above and made sure to use the 'allusers’ PSK identifier, the Floating Firewall Rule was in place (or AFP connections to the LAN didn't pass), and the DH key group to DH key group to 2 (1024 bit) to support the Macs.

I've not enabled this in production as the existing LAN network would likely be unreachable. If anyone is aware if there is an OpenVPN equivalent of 'push "route 10.0.0.0 255.255.0.0' for the L2TP/IPsec approach, details would be appreciated…

pfSalmon

Really looking forward to connecting to pfSense with a built-in Win8.1 or Android VPN client.

I followed the directions from the wiki:
https://doc.pfsense.org/index.php?title=L2TP/IPsec&oldid=7045

Status: The IPSec tunnel is created successfully, but the L2TP connection times out. No entries in L2TP or firewall logs. Packet capture on IPSec interface comes up empty.

I have allow-all rules in IPSec and L2TP VPN firewall tabs, and added the floating rule from the wiki. Not sure how to diagnose from here, but willing to try if anyone has any suggestions.

Bandee1987

Hi all,

Same problem here. IPSec tunnel was successfully established with the client but after that there's no l2tp connection.
I've tried many things (as Phoenix and pfSalmon) with no success.

Wolvesclaw

Got the same problem. IPSec connects but nothing shows up in l2tp-logs. The Client trys and throws error 809 after a while.

Is there any solution yet?

jimp

Looks like there may be an issue when the client itself is behind NAT. Is that the case for everyone seeing problems?

handspring

@jimp:

Looks like there may be an issue when the client itself is behind NAT. Is that the case for everyone seeing problems?

It's not true.
The IPSec/L2TP VPN can be established on iOS, no matte it behind NAT or 3G/4G network (actually it's same as behind NAT). But it couldn't work on Win7/8.1 client.

jimp

OK, that's consistent with one of our other tests. The problem seems to be Windows Clients with NAT. iOS seemed to connect OK either way.