Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #210277

L2TP VPN client

Show all headers | View raw

debian-user:

I have an L2TP VPN server that allows incoming connections from clients 
who have the following four (4) items:

1.  IP address or DNS name of the L2TP VPN server.

2.  Pre-shared key.

3.  User name.

4.  User password.


I am able to connect to the L2TP VPN server using macOS.


I would like to connect to the L2TP VPN server using Debian:

2019-06-22 19:01:05 root@tinkywinky ~
# cat /etc/debian_version ; uname -a
9.9
Linux tinkywinky 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1+deb9u2 
(2019-05-13) x86_64 GNU/Linux

2019-06-22 19:04:04 root@tinkywinky ~
# dpkg-query --show xfce4
xfce4	4.12.3


STFW I see:

https://www.bestvpnz.com/tutorials/how-to-set-up-l2tp-ipsec-vpn-on-linux-networkmanager-strongswan/


I have installed:

2019-06-22 19:04:11 root@tinkywinky ~
# dpkg-query --show xl2tpd strongswan network-manager-strongswan
network-manager-strongswan	1.4.1-1
strongswan	5.5.1-4+deb9u4
xl2tpd	1.3.8+dfsg-1


The Network Manager GUI does not have a field for the pre-shared key, so 
I have put the key into a file:

2019-06-22 19:08:24 root@tinkywinky ~
# vi l2tp-key

2019-06-22 19:12:08 root@tinkywinky ~
# mv l2tp-key /home/dpchrist/.

2019-06-22 19:13:05 root@tinkywinky ~
# chown dpchrist.dpchrist /home/dpchrist/l2tp-key

2019-06-22 19:13:20 root@tinkywinky ~
# chmod 0400 /home/dpchrist/l2tp-key


I created a network connection using the Network Manager GUI applet:

	Xfce Applications Menu -> Settings -> Network Connections ->
	Add -> IPsec/IKEv2 (strongswan) -> Create...:

	    Connection name                 l2tp

	-> VPN

	    Gateway
	    Address                         <IP address of server>
	    Certificate                     l2tp-key

	    Client
	    Authentication                  Pre-shared key
	    Username                        dpchrist
	    Password                        Store the password only for this user
					    <20 characters)

	    Options
	    Request an inner IP address     checked
	    Enforce UDP encapsulation       checked
	    Use IP compression              checked

	    Save

When I attempt to connect:

Xfce panel -> Notification Area -> network -> VPN Connections -> l2tp:


Nothing happens -- no visible change to network icon, no connection 
shown by ifconfig(8), ping to inner LAN times out, etc..  But there are 
clues in the logs:

2019-06-22 19:25:22 root@tinkywinky ~
# tail -n 4 /var/log/messages
Jun 22 19:24:56 tinkywinky NetworkManager[547]: <info> 
[1561256696.6007] audit: op="connection-activate" 
uuid="a11a27a6-11c9-4906-998a-3471e8f68500" name="192.168.1.133" pid=993 
uid=13250 result="success"
Jun 22 19:24:56 tinkywinky NetworkManager[547]: <info> 
[1561256696.6029] 
vpn-connection[0x558a8bffe810,a11a27a6-11c9-4906-998a-3471e8f68500,"192.168.1.133",0]: 
Saw the service appear; activating connection
Jun 22 19:24:56 tinkywinky NetworkManager[547]: <info> 
[1561256696.7092] 
vpn-connection[0x558a8bffe810,a11a27a6-11c9-4906-998a-3471e8f68500,"192.168.1.133",0]: 
VPN connection: (ConnectInteractive) reply received
Jun 22 19:24:56 tinkywinky NetworkManager[547]: <warn> 
[1561256696.7146] 
vpn-connection[0x558a8bffe810,a11a27a6-11c9-4906-998a-3471e8f68500,"192.168.1.133",0]: 
VPN connection: failed to connect: 'Loading gateway certificate failed.'


STFW the problem seems to be the lack of an edit box for the pre-shared 
key in the Network Manager GUI applet for such connections:

https://askubuntu.com/questions/586751/where-to-add-the-pre-shared-key-for-the-server-authentication-with-network-manag


Has anyone found a solution or work-around for Debian?


David

Back to linux.debian.user | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

L2TP VPN client David Christensen <dpchrist@holgerdanske.com> - 2019-06-23 04:40 +0200
  Re: L2TP VPN client Curt <curty@free.fr> - 2019-06-23 15:20 +0200
    Re: L2TP VPN client David Christensen <dpchrist@holgerdanske.com> - 2019-06-23 19:10 +0200

csiph-web