<html><body bgcolor="#FFFFFF"><blockquote type="cite"><span class="Apple-style-span" style="font-family: Times; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469); font-size: medium; "><pre>On 03/27/2011 04:06 AM, Dan Deming wrote:
><i> Hello,
</i>><i>
</i>><i> I'm trying to get a strongswan VPN set up so I can connect my iPhone
</i>><i> to my Ubuntu Lucid Lynx desktop, but I can't seem to get it
</i>><i> working and would appreciate any help anyone can give me.
</i>><i>
</i>><i> I feel like I'm close, but networking is not one of my
</i>><i> strong suits, so the whole leftnexthop, rightprotoport
</i>><i> thing is pretty confusing to me.
</i>><i>
</i>><i> I've been generally following the directions on these 3
</i>><i> pages:
</i>><i>
</i>><i> <a href="http://nielspeen.com/blog/2009/04/linux-l2tpipsec-with-iphone-and-mac-osx-clients/"><a href="http://nielspeen.com/blog/2009/04/linux-l2tpipsec-with-iphone-and-mac-osx-clients/">http://nielspeen.com/blog/2009/04/linux-l2tpipsec-with-iphone-and-mac-osx-clients/</a></a>
</i>><i> <a href="https://lists.strongswan.org/pipermail/users/2009-March/003291.html"><a href="https://lists.strongswan.org/pipermail/users/2009-March/003291.html">https://lists.strongswan.org/pipermail/users/2009-March/003291.html</a></a>
</i>><i> <a href="http://rootmanager.com/ubuntu-ipsec-l2tp-windows-domain-auth/setting-up-openswan-xl2tpd-with-native-windows-clients.html"><a href="http://rootmanager.com/ubuntu-ipsec-l2tp-windows-domain-auth/setting-up-openswan-xl2tpd-with-native-windows-clients.html">http://rootmanager.com/ubuntu-ipsec-l2tp-windows-domain-auth/setting-up-openswan-xl2tpd-with-native-windows-clients.html</a></a>
</i>><i>
</i>><i> Currently, I'm getting the following error:
</i>><i>
</i>><i> cannot respond to IPsec SA request because no connection is known for
</i>><i> 53.74.66.108/32===192.168.1.10:17/%any...192.168.1.1[192.168.1.12]:17/%any===192.168.1.12/32
</i>><i> <<a href="http://53.74.66.108/32===192.168.1.10:17/%any...192.168.1.1[192.168.1.12]:17/%any===192.168.1.12/32"><a href="http://53.74.66.108/32===192.168.1.10:17/%any...192.168.1.1[192.168.1.12]:17/%any===192.168.1.12/32">http://53.74.66.108/32===192.168.1.10:17/%any...192.168.1.1[192.168.1.12]:17/%any===192.168.1.12/32</a></a>>
</i>><i>
</i>><i> Here are the stats on what I'm running:
</i>><i>
</i>><i> Ubuntu Desktop:
</i>><i> * Internal IP address is 192.168.1.10
</i>><i> * Running custom compiled version of strongswan-4.3.2 with
</i>><i> --enable-nat-transport option enabled
</i>><i> * Running xl2tpd
</i>><i> * Both were set up by following
</i>><i> <a href="http://nielspeen.com/blog/2009/04/linux-l2tpipsec-with-iphone-and-mac-osx-clients/"><a href="http://nielspeen.com/blog/2009/04/linux-l2tpipsec-with-iphone-and-mac-osx-clients/">http://nielspeen.com/blog/2009/04/linux-l2tpipsec-with-iphone-and-mac-osx-clients/</a></a>
</i>><i> * Firewall was off while I was trying to get this working
</i>><i>
</i>><i> Linksys E3000 router:
</i>><i> * Internal IP address is 192.168.1.1
</i>><i> * Comcast IP address is 53.74.66.108 (not my actual IP, but you get
</i>><i> the idea)
</i>><i> * NAT Enabled
</i>><i> * VPN Passthrough Enabled
</i>><i> * Ports 4500 and 1701 forwarded to 192.168.1.10
</i>><i>
</i>><i> iPhone 3GS:
</i>><i> * I guess the IP for this device is 166.121.15.14? (Again, I changed
</i>><i> it in the log below)
</i>><i>
</i>><i> Here is my ipsec.conf:
</i>><i>
</i>><i> config setup
</i>><i> nat_traversal=yes
</i>><i> charonstart=yes
</i>><i> plutostart=yes
</i>><i>
</i>><i> conn L2TP
</i>><i> authby=psk
</i>><i> pfs=no
</i>><i> rekey=no
</i>><i> type=tunnel
</i>><i> esp=aes128-sha1
</i>><i> ike=aes128-sha-modp1024
</i>><i> left=192.168.1.10
</i>><i> leftnexthop=%defaultroute
</i>><i> #leftprotoport=17/%any
</i>><i> leftprotoport=17/1701
</i>><i> right=%any
</i>><i> rightprotoport=17/%any
</i>><i> #rightsubnetwithin=10.0.0.0/8 <<a href="http://10.0.0.0/8"><a href="http://10.0.0.0/8">http://10.0.0.0/8</a></a>>
</i>><i> auto=add
</i>><i>
</i>><i> And here are the errors I see:
</i>><i>
</i>><i> Mar 26 15:41:11 ubuntu-desktop pluto[8372]: added connection
</i>><i> description "L2TP"
</i>><i> Mar 26 15:41:51 ubuntu-desktop pluto[8372]: packet from
</i>><i> 166.121.15.14:15873 <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>>: received Vendor ID
</i>><i> payload [RFC 3947]
</i>><i> Mar 26 15:41:51 ubuntu-desktop pluto[8372]: packet from
</i>><i> 166.121.15.14:15873 <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>>: ignoring Vendor ID
</i>><i> payload [4df37928e9fc4fd1b3262170d515c662]
</i>><i> Mar 26 15:41:51 ubuntu-desktop pluto[8372]: packet from
</i>><i> 166.121.15.14:15873 <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>>: ignoring Vendor ID
</i>><i> payload [8f8d83826d246b6fc7a8a6a428c11de8]
</i>><i> Mar 26 15:41:51 ubuntu-desktop pluto[8372]: packet from
</i>><i> 166.121.15.14:15873 <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>>: ignoring Vendor ID
</i>><i> payload [439b59f8ba676c4c7737ae22eab8f582]
</i>><i> Mar 26 15:41:51 ubuntu-desktop pluto[8372]: packet from
</i>><i> 166.121.15.14:15873 <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>>: ignoring Vendor ID
</i>><i> payload [4d1e0e136deafa34c4f3ea9f02ec7285]
</i>><i> Mar 26 15:41:51 ubuntu-desktop pluto[8372]: packet from
</i>><i> 166.121.15.14:15873 <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>>: ignoring Vendor ID
</i>><i> payload [80d0bb3def54565ee84645d4c85ce3ee]
</i>><i> Mar 26 15:41:51 ubuntu-desktop pluto[8372]: packet from
</i>><i> 166.121.15.14:15873 <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>>: ignoring Vendor ID
</i>><i> payload [9909b64eed937c6573de52ace952fa6b]
</i>><i> Mar 26 15:41:51 ubuntu-desktop pluto[8372]: packet from
</i>><i> 166.121.15.14:15873 <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>>: ignoring Vendor ID
</i>><i> payload [draft-ietf-ipsec-nat-t-ike-03]
</i>><i> Mar 26 15:41:51 ubuntu-desktop pluto[8372]: packet from
</i>><i> 166.121.15.14:15873 <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>>: ignoring Vendor ID
</i>><i> payload [draft-ietf-ipsec-nat-t-ike-02]
</i>><i> Mar 26 15:41:51 ubuntu-desktop pluto[8372]: packet from
</i>><i> 166.121.15.14:15873 <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>>: ignoring Vendor ID
</i>><i> payload [draft-ietf-ipsec-nat-t-ike-02_n]
</i>><i> Mar 26 15:41:51 ubuntu-desktop pluto[8372]: packet from
</i>><i> 166.121.15.14:15873 <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>>: received Vendor ID
</i>><i> payload [Dead Peer Detection]
</i>><i> Mar 26 15:41:51 ubuntu-desktop pluto[8372]: "L2TP"[1]
</i>><i> 166.121.15.14:15873 <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>> #1: responding to
</i>><i> Main Mode from unknown peer 166.121.15.14:15873
</i>><i> <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>>
</i>><i> Mar 26 15:41:52 ubuntu-desktop pluto[8372]: "L2TP"[1]
</i>><i> 166.121.15.14:15873 <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>> #1: NAT-Traversal:
</i>><i> Result using RFC 3947: both are NATed
</i>><i> Mar 26 15:41:52 ubuntu-desktop pluto[8372]: "L2TP"[1]
</i>><i> 166.121.15.14:15873 <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>> #1: ignoring
</i>><i> informational payload, type IPSEC_INITIAL_CONTACT
</i>><i> Mar 26 15:41:52 ubuntu-desktop pluto[8372]: "L2TP"[1]
</i>><i> 166.121.15.14:15873 <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>> #1: Peer ID is
</i>><i> ID_IPV4_ADDR: '10.70.21.33'
</i>><i> Mar 26 15:41:52 ubuntu-desktop pluto[8372]: "L2TP"[2]
</i>><i> 166.121.15.14:15873 <<a href="http://166.121.15.14:15873/"><a href="http://166.121.15.14:15873">http://166.121.15.14:15873</a></a>> #1: deleting
</i>><i> connection "L2TP" instance with peer 166.121.15.14 {isakmp=#0/ipsec=#0}
</i>><i> Mar 26 15:41:52 ubuntu-desktop pluto[8372]: | NAT-T: new mapping
</i>><i> 166.121.15.14:15873/15893 <<a href="http://166.121.15.14:15873/15893"><a href="http://166.121.15.14:15873/15893">http://166.121.15.14:15873/15893</a></a>>)
</i>><i> Mar 26 15:41:52 ubuntu-desktop pluto[8372]: "L2TP"[2]
</i>><i> 166.121.15.14:15893 <<a href="http://166.121.15.14:15893/"><a href="http://166.121.15.14:15893">http://166.121.15.14:15893</a></a>> #1: sent MR3, ISAKMP
</i>><i> SA established
</i>><i> Mar 26 15:41:53 ubuntu-desktop pluto[8372]: "L2TP"[2]
</i>><i> 166.121.15.14:15893 <<a href="http://166.121.15.14:15893/"><a href="http://166.121.15.14:15893">http://166.121.15.14:15893</a></a>> #1: cannot respond to
</i>><i> IPsec SA request because no connection is known for
</i>><i> 53.74.66.108/32===192.168.1.10:4500:17/%any...166.121.15.14:15893[10.70.21.33]:17/%any===10.70.21.33/32
</i>><i> <<a href="http://53.74.66.108/32===192.168.1.10:4500:17/%any...166.121.15.14:15893[10.70.21.33]:17/%any===10.70.21.33/32"><a href="http://53.74.66.108/32===192.168.1.10:4500:17/%any...166.121.15.14:15893[10.70.21.33]:17/%any===10.70.21.33/32">http://53.74.66.108/32===192.168.1.10:4500:17/%any...166.121.15.14:15893[10.70.21.33]:17/%any===10.70.21.33/32</a></a>>
</i>><i> Mar 26 15:41:53 ubuntu-desktop pluto[8372]: "L2TP"[2]
</i>><i> 166.121.15.14:15893 <<a href="http://166.121.15.14:15893/"><a href="http://166.121.15.14:15893">http://166.121.15.14:15893</a></a>> #1: sending encrypted
</i>><i> notification INVALID_ID_INFORMATION to 166.121.15.14:15893
</i>><i> <<a href="http://166.121.15.14:15893/"><a href="http://166.121.15.14:15893">http://166.121.15.14:15893</a></a>>
</i>><i> Mar 26 15:41:56 ubuntu-desktop pluto[8372]: "L2TP"[2]
</i>><i> 166.121.15.14:15893 <<a href="http://166.121.15.14:15893/"><a href="http://166.121.15.14:15893">http://166.121.15.14:15893</a></a>> #1: Quick Mode I1
</i>><i> message is unacceptable because it uses a previously used Message ID
</i>><i> 0xab4fb5b4 (perhaps this is a duplicated packet)
</i>><i> Mar 26 15:41:56 ubuntu-desktop pluto[8372]: "L2TP"[2]
</i>><i> 166.121.15.14:15893 <<a href="http://166.121.15.14:15893/"><a href="http://166.121.15.14:15893">http://166.121.15.14:15893</a></a>> #1: sending encrypted
</i>><i> notification INVALID_MESSAGE_ID to 166.121.15.14:15893
</i>><i> <<a href="http://166.121.15.14:15893/"><a href="http://166.121.15.14:15893">http://166.121.15.14:15893</a></a>>
</i>><i> Mar 26 15:41:59 ubuntu-desktop pluto[8372]: "L2TP"[2]
</i>><i> 166.121.15.14:15893 <<a href="http://166.121.15.14:15893/"><a href="http://166.121.15.14:15893">http://166.121.15.14:15893</a></a>> #1: Quick Mode I1
</i>><i> message is unacceptable because it uses a previously used Message ID
</i>><i> 0xab4fb5b4 (perhaps this is a duplicated packet)
</i>><i> Mar 26 15:41:59 ubuntu-desktop pluto[8372]: "L2TP"[2]
</i>><i> 166.121.15.14:15893 <<a href="http://166.121.15.14:15893/"><a href="http://166.121.15.14:15893">http://166.121.15.14:15893</a></a>> #1: sending encrypted
</i>><i> notification INVALID_MESSAGE_ID to 166.121.15.14:15893
</i>><i> <<a href="http://166.121.15.14:15893/"><a href="http://166.121.15.14:15893">http://166.121.15.14:15893</a></a>>
</i>><i> Mar 26 15:42:03 ubuntu-desktop pluto[8372]: "L2TP"[2]
</i>><i> 166.121.15.14:15893 <<a href="http://166.121.15.14:15893/"><a href="http://166.121.15.14:15893">http://166.121.15.14:15893</a></a>> #1: Quick Mode I1
</i>><i> message is unacceptable because it uses a previously used Message ID
</i>><i> Mar 26 Mar 26 15:42:05 ubuntu-desktop pluto[8372]: ERROR: asynchronous
</i>><i> network error report on eth0 for message to 166.121.15.14 port 15893,
</i>><i> complainant 166.121.15.14 <<a href="http://166.121.15.14/"><a href="http://166.121.15.14">http://166.121.15.14</a></a>>: Connection refused
</i>><i> [errno 111, origin ICMP type 3 code 3 (not authenticated)]
</i>><i>
</i>><i>
</i>><i> _______________________________________________
</i>><i> Users mailing list
</i>><i> <a href="https://lists.strongswan.org/mailman/listinfo/users">Users at <a href="http://lists.strongswan.org">lists.strongswan.org</a></a>
</i>><i> <a href="https://lists.strongswan.org/mailman/listinfo/users"><a href="https://lists.strongswan.org/mailman/listinfo/users">https://lists.strongswan.org/mailman/listinfo/users</a></a>
</i>Hi Dan,
It looks like your connection cannot be matched right. I'm a newby so
may advices may be misleading, but you can try a two more configuration
for your ipsec.conf ( one at a time)
ipsec.conf of openswan/debian:
config setup
nat_traversal=yes
charonstart=yes
plutostart=yes
conn L2TP-PSK-NAT-OSX
authby=secret
forceencaps=yes
pfs=no
auto=add
keyingtries=3
dpdtimeout=60
dpdaction=clear
rekey=no
left=%defaultroute
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
rightsubnet=vhost:%priv,%no
or
conn %default
nat_traversal=yes
charonstart=yes
plutostart=yes
forceencaps=yes
dpddelay=10
dpdtimeout=60
dpdaction=clear
auto=add
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=192.168.1.10
leftprotoport=17/1701
leftnexthop=53.74.66.108 ( or whatever pub IP you have)
rightnexthop=%defaultroute
right=%any
rightprotoport=17/%any
if you get any errors for some of the options , just comment them.
make sure that xl2tpd is running and listening on port 1701, and ipsec(pluto or charon I'm not shure) are listenning on port 500,4500,
you can check with #netstat -lpna
and if still is not working paste #tcpdump proto UDP , and the same output log that you include in fur firs mail
You better disable port forward 1701 on your router, only VPN pass-trough and if does not work correctly then enable forward UDP 500, 4500 to
192.168.1.10,
Also #iptables -L will be useful but not necessary .
Recently I had problems with IPhone connecting to Ubuntu box, second time, because tunnel cannot be disconnected, but you are not there yet ;) I sow fix for that in strongswan 4.5.1.
Regards
Martin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <a href="http://lists.strongswan.org/pipermail/users/attachments/20110328/18cac209/attachment-0001.html"><a href="http://lists.strongswan.org/pipermail/users/attachments/20110328/18cac209/attachment-0001.html">http://lists.strongswan.org/pipermail/users/attachments/20110328/18cac209/attachment-0001.html</a></a>
</pre></span></blockquote><div><span class="Apple-style-span" style="font-family: Times; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469); font-size: medium; "><pre>Hi, </pre><pre>I tried the very same with my Ipad and I hat the wall, the NAT firewall, to be more precise.</pre><pre>My settings worked well via WLAN even into a NATed VM but as soon as I tried to connect from the outside I ran into the same error.</pre><pre>The problem sems to be caused by the fact that the IPAD is NATed as well with a dynamic IP adrees. Two NATed dynamic IP addresses seems to be more than strongswan can handle.</pre><pre>There's been another posting on that this month asking whether this is a bug or a feature. It's a pity that it doesn't work because I would love to be able to access my home network with my Ipad in a safer way.</pre><pre>I hope I didn't discourage you, please keep trying if you have the time and energy. I'd be happy to know if there is a solution to that.</pre><pre>Somewhere I read that Openswan may do the trick. Did you try that one?</pre><pre>Cheers</pre><pre>Uli</pre></span></div></body></html>