Trying to setup an L2TP VPN on a EdgeRouter Lite v 1.10.6. been following this guide https://help.ubnt.com/hc/en-us/articles/204950294-EdgeMAX-servidor-L2TP. For extra information, the same router has also an IPsec site to site VPN working properly.
I have even rebuilt the config a couple of times but still nothing.
sudo swanctl --log
Is not showing anything at all.
The only thing I get is this:
sudo tcpdump -npi eth0 port 500 or port 4500 or port 1701
20:34:08.407450 IP XXX.XXX.XXX.31.500 > XXX.XXX.XXX.33.500: isakmp: phase 1 I ident
20:34:11.407450 IP XXX.XXX.XXX.31.500 > XXX.XXX.XXX.33.500: isakmp: phase 1 I ident
20:34:14.407450 IP XXX.XXX.XXX.31.500 > XXX.XXX.XXX.33.500: isakmp: phase 1 I ident
20:34:17.407450 IP XXX.XXX.XXX.31.500 > XXX.XXX.XXX.33.500: isakmp: phase 1 I ident
That is all I get on the server side and the client throws an error. I have tried connecting from an iPhone as well as different Windows 10 machines.
Statistics for the firewall rules which show 0 packets
rule packets bytes action description
---- ------- ----- ------ -----------
10 5373 747906 ACCEPT Allow established/related
20 215 14863 DROP Drop invalid state
23 <disabled> <disabled> ACCEPT Allow iCMP
24 0 0 ACCEPT Allow IKE for VPN
25 0 0 ACCEPT Allow L2TP for VPN
26 0 0 ACCEPT Allow ESP for VPN
27 0 0 ACCEPT Allow NAT-T for VPN
10000 44 1584 DROP DEFAULT ACTION
Any other thing I can do to troubleshoot this?
This is the full vpn config if it helps:
ipsec {
auto-firewall-nat-exclude enable
esp-group FOO0 {
compression disable
lifetime 3600
mode tunnel
pfs enable
proposal 1 {
encryption aes256
hash sha1
}
}
ike-group FOO0 {
ikev2-reauth no
key-exchange ikev1
lifetime 28800
proposal 1 {
dh-group 14
encryption aes256
hash sha1
}
}
nat-traversal enable
site-to-site {
peer XXX.XXX.XXX.84 {
authentication {
mode pre-shared-secret
pre-shared-secret %SECRET%
}
connection-type initiate
description "REMOTE"
ike-group FOO0
ikev2-reauth inherit
local-address XXX.XXX.XXX.33
tunnel 1 {
allow-nat-networks disable
allow-public-networks disable
esp-group FOO0
local {
prefix 192.168.5.0/24
}
remote {
prefix 192.168.6.0/24
}
}
tunnel 2 {
allow-nat-networks disable
allow-public-networks disable
esp-group FOO0
local {
prefix 192.168.4.0/24
}
remote {
prefix 192.168.6.0/24
}
}
}
}
}
l2tp {
remote-access {
authentication {
local-users {
username romo {
password TestPass#2018
}
}
mode local
}
client-ip-pool {
start 192.168.4.10
stop 192.168.4.30
}
dns-servers {
server-1 192.168.5.3
}
idle 1800
ipsec-settings {
authentication {
mode pre-shared-secret
pre-shared-secret ANOTHER-SECRET-4
}
ike-lifetime 3600
lifetime 3600
}
mtu 1400
outside-address XXX.XXX.XXX.33
}
}
.
