Groups > linux.debian.user > #210277 > unrolled thread

L2TP VPN client

Started by	David Christensen <dpchrist@holgerdanske.com>
First post	2019-06-23 04:40 +0200
Last post	2019-06-23 19:10 +0200
Articles	3 — 2 participants

Back to article view | Back to linux.debian.user

  L2TP VPN client David Christensen <dpchrist@holgerdanske.com> - 2019-06-23 04:40 +0200
    Re: L2TP VPN client Curt <curty@free.fr> - 2019-06-23 15:20 +0200
      Re: L2TP VPN client David Christensen <dpchrist@holgerdanske.com> - 2019-06-23 19:10 +0200

#210277 — L2TP VPN client

From	David Christensen <dpchrist@holgerdanske.com>
Date	2019-06-23 04:40 +0200
Subject	L2TP VPN client
Message-ID	<yc0A9-1br-3@gated-at.bofh.it>

debian-user:

I have an L2TP VPN server that allows incoming connections from clients 
who have the following four (4) items:

1.  IP address or DNS name of the L2TP VPN server.

2.  Pre-shared key.

3.  User name.

4.  User password.


I am able to connect to the L2TP VPN server using macOS.


I would like to connect to the L2TP VPN server using Debian:

2019-06-22 19:01:05 root@tinkywinky ~
# cat /etc/debian_version ; uname -a
9.9
Linux tinkywinky 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1+deb9u2 
(2019-05-13) x86_64 GNU/Linux

2019-06-22 19:04:04 root@tinkywinky ~
# dpkg-query --show xfce4
xfce4	4.12.3


STFW I see:

https://www.bestvpnz.com/tutorials/how-to-set-up-l2tp-ipsec-vpn-on-linux-networkmanager-strongswan/


I have installed:

2019-06-22 19:04:11 root@tinkywinky ~
# dpkg-query --show xl2tpd strongswan network-manager-strongswan
network-manager-strongswan	1.4.1-1
strongswan	5.5.1-4+deb9u4
xl2tpd	1.3.8+dfsg-1


The Network Manager GUI does not have a field for the pre-shared key, so 
I have put the key into a file:

2019-06-22 19:08:24 root@tinkywinky ~
# vi l2tp-key

2019-06-22 19:12:08 root@tinkywinky ~
# mv l2tp-key /home/dpchrist/.

2019-06-22 19:13:05 root@tinkywinky ~
# chown dpchrist.dpchrist /home/dpchrist/l2tp-key

2019-06-22 19:13:20 root@tinkywinky ~
# chmod 0400 /home/dpchrist/l2tp-key


I created a network connection using the Network Manager GUI applet:

	Xfce Applications Menu -> Settings -> Network Connections ->
	Add -> IPsec/IKEv2 (strongswan) -> Create...:

	    Connection name                 l2tp

	-> VPN

	    Gateway
	    Address                         <IP address of server>
	    Certificate                     l2tp-key

	    Client
	    Authentication                  Pre-shared key
	    Username                        dpchrist
	    Password                        Store the password only for this user
					    <20 characters)

	    Options
	    Request an inner IP address     checked
	    Enforce UDP encapsulation       checked
	    Use IP compression              checked

	    Save

When I attempt to connect:

Xfce panel -> Notification Area -> network -> VPN Connections -> l2tp:


Nothing happens -- no visible change to network icon, no connection 
shown by ifconfig(8), ping to inner LAN times out, etc..  But there are 
clues in the logs:

2019-06-22 19:25:22 root@tinkywinky ~
# tail -n 4 /var/log/messages
Jun 22 19:24:56 tinkywinky NetworkManager[547]: <info> 
[1561256696.6007] audit: op="connection-activate" 
uuid="a11a27a6-11c9-4906-998a-3471e8f68500" name="192.168.1.133" pid=993 
uid=13250 result="success"
Jun 22 19:24:56 tinkywinky NetworkManager[547]: <info> 
[1561256696.6029] 
vpn-connection[0x558a8bffe810,a11a27a6-11c9-4906-998a-3471e8f68500,"192.168.1.133",0]: 
Saw the service appear; activating connection
Jun 22 19:24:56 tinkywinky NetworkManager[547]: <info> 
[1561256696.7092] 
vpn-connection[0x558a8bffe810,a11a27a6-11c9-4906-998a-3471e8f68500,"192.168.1.133",0]: 
VPN connection: (ConnectInteractive) reply received
Jun 22 19:24:56 tinkywinky NetworkManager[547]: <warn> 
[1561256696.7146] 
vpn-connection[0x558a8bffe810,a11a27a6-11c9-4906-998a-3471e8f68500,"192.168.1.133",0]: 
VPN connection: failed to connect: 'Loading gateway certificate failed.'


STFW the problem seems to be the lack of an edit box for the pre-shared 
key in the Network Manager GUI applet for such connections:

https://askubuntu.com/questions/586751/where-to-add-the-pre-shared-key-for-the-server-authentication-with-network-manag


Has anyone found a solution or work-around for Debian?


David

[toc] | [next] | [standalone]

#210297

From	Curt <curty@free.fr>
Date	2019-06-23 15:20 +0200
Message-ID	<ycazv-79b-1@gated-at.bofh.it>
In reply to	#210277

On 2019-06-23, David Christensen <dpchrist@holgerdanske.com> wrote:
>
> STFW I see:
>
> https://www.bestvpnz.com/tutorials/how-to-set-up-l2tp-ipsec-vpn-on-linux-networkmanager-strongswan/
>
> I have installed:
>
> 2019-06-22 19:04:11 root@tinkywinky ~
> # dpkg-query --show xl2tpd strongswan network-manager-strongswan
> network-manager-strongswan	1.4.1-1
> strongswan	5.5.1-4+deb9u4
> xl2tpd	1.3.8+dfsg-1
>
>
> The Network Manager GUI does not have a field for the pre-shared key, so 
> I have put the key into a file:

Looking at your link above, it says:

 If you need a PSK you will want to select Pre-shared key under the
 Authentication: pull-down menu rather than EAP.

(Psk supported since version 1.3.1 of the strongswan nm plugin.)

https://wiki.strongswan.org/projects/strongswan/wiki/NetworkManager

  PSK is supported starting with NetworkManager-strongswan-1.3.1, but
  strong secrets are enforced.

I guess strong secrets means strlen no less than 20.

I must be missing something.

[toc] | [prev] | [next] | [standalone]

#210309

From	David Christensen <dpchrist@holgerdanske.com>
Date	2019-06-23 19:10 +0200
Message-ID	<ycea5-UO-1@gated-at.bofh.it>
In reply to	#210297

On 6/23/19 6:16 AM, Curt wrote:
> On 2019-06-23, David Christensen <dpchrist@holgerdanske.com> wrote:
>>
>> STFW I see:
>>
>> https://www.bestvpnz.com/tutorials/how-to-set-up-l2tp-ipsec-vpn-on-linux-networkmanager-strongswan/
>>
>> I have installed:
>>
>> 2019-06-22 19:04:11 root@tinkywinky ~
>> # dpkg-query --show xl2tpd strongswan network-manager-strongswan
>> network-manager-strongswan	1.4.1-1
>> strongswan	5.5.1-4+deb9u4
>> xl2tpd	1.3.8+dfsg-1
>>
>>
>> The Network Manager GUI does not have a field for the pre-shared key, so
>> I have put the key into a file:

Thanks for the reply.  :-)


> Looking at your link above, it says:
> 
>   If you need a PSK you will want to select Pre-shared key under the
>   Authentication: pull-down menu rather than EAP.

I saw that and I did that.


> (Psk supported since version 1.3.1 of the strongswan nm plugin.)

I have installed network-manager-strongswan 1.4.1-1.


> https://wiki.strongswan.org/projects/strongswan/wiki/NetworkManager
> 
>    PSK is supported starting with NetworkManager-strongswan-1.3.1, but
>    strong secrets are enforced.
>   
> I guess strong secrets means strlen no less than 20.
> 
> I must be missing something.

That link confirms that I need a feature that does not exist:

     NetworkManager allows configuration and control of VPN daemons
     through a plugin interface. We provide such a plugin for
     NetworkManager to configure road warrior clients for the most common
     setups. The plugin currently supports connections using the IKEv2
     protocol only.


I will see if I can configure my VPN server to accept IKEv2 connections.


David

[toc] | [prev] | [standalone]

csiph-web

L2TP VPN client

Contents

#210277 — L2TP VPN client

#210297

#210309