k) Click on “IPsec Settings”.
l) Check the box “Use pre-shared key for authentication”, type in the pre-shared key that you created in Step 7 and then click “OK”.
m) Select the “Networking” tab on top and then select “L2TP IPSec VPN” from “Type of VPN” drop-down menu.
n) Highlight “Internet Protocol (TCP/IP)” from the list below and click on “Properties”.
o) Click the “Advanced” button on the lower side of the window.
p) In “General” tab uncheck “Use default gateway on remote network”.
q) Click OK.
r) Click OK again.
s) Click OK again to finish configuring the VPN client.
t) Type in the username and password given by your administrator and then click “Connect” to establish a VPN session.
The window should say “Verifying username and password” and then it should get minimized into the tray, just like when a modem connection is established. Try to ping some local servers to see if the connection is working.
If you are running an earlier version of Windows XP (either original XP or with SP1), you will either have to install SP2 or download a NAT patch (818043) from Windows Update.
That’s it! You are finally done! Congratulations :-)
If you find this guide useful or helpful, please post your feedback below!
Used Resources:
1) Using a Linux L2TP/IPsec VPN server by Jacco de Leeuw. His guide is probably the best VPN guide you can find on the Internet. If you are looking for a detailed explanation of how VPN works (plus many other things), definitely check out his page! His guide also covers SSL-based authentication instead of PSKs.
2) l2tpd patch by one4vision GmbH
3) Google
About Nasim Mansurov
Hello
Your tutorial looks really nice, I am going to try it with SuSE. I will give you my feedback with the good init scripts. Maybe something missing in your tutorial is a network topology of what you are doing (what are the gateways, left sides, right sides etc..).
BTW, good job :)
thanks,
have you tried certificate authentication?
The best!!!! Thank you very much!
Can we make this work on direct ethernet connection? or do we need PPPoE to solve that purpose? I am confused…
Excelent guide!! Congratulations.
And thank you very much for the Pty patch for L2TPD. It solved my problem on Fedora Core 3.
Best regards, Alan.
hmm.. wonder why i cannot compile the ” l2tpd ” im using Redhat 9, any suggest ?
I did well till point 9)
I also got success to start using ‘/etc/rc.d/init.d/l2tpd start’ command.
But while starting openswan ,it gives me error like
“– ‘start’ abortedpsec.conf,line 2) unknown config section “setup
What is it means?
Pls suggest something to resolve this issue.
Thanks and regards
Vishal S.
Great Idea!! It was a great HELP! thank you
I did well till point 9)
I also got success to start using ‘/etc/rc.d/init.d/l2tpd start’ command.
But while starting openswan ,it gives me error like
“– ‘start’ abortedpsec.conf,line 2) unknown config section “setup
What is it means?
Please suggest something to resolve this issue.
Big thanks and regards
Hi, sorry for disturbance but I don’t understand a step about l2tpd installation:
mv l2tpd /etc/rc.d/init.d
.. but at this point I don’t have a l2tpd file ?? where I mistake ??
thanks.
Salvatore.
Hi and sorry for my banal question but when excute:
chkconfig –add /etc/rc.d/init.d/l2tpd
I have how result then l2tpd not supported chkconfig, but pheraps the problem is then I have copied the incorrect l2tpd file in /etc/rc.d/init.d/, but where is the correct l2tpd file for chkconfig ??
I have used alway rpm file and now I have a difficult.
still thanks.
Salvatore.
Hi all,
Thanks for the guide – it worked perefectly.
I just have 2 questions:
1 – Is it possible to log the username of a rodawarrior logging in, not just the ip? If so, how?
2 – Our internal LAN is split into 2 subnets. When a roadwarrior connects, he gets an ip on our subnet A, but no gateway to subnet B (this is our default gateway on the LAN). The results in the roadwarrior having perfect access to subnet A but not B. The actual VPN box can reach both subnets with no problems. How can I get the roadwarrior to access both subnets?
Any help would be greatly appreciated.
Regards
Shafi
I also wonder if we can we make this work on direct ethernet connection? if we could then how? And thank very much….
Help. Everything seems to be going fine until chkconfig –add l2tpd returns the crptic message ‘No such device’. Google reveals nothing relevant.
What am I doing wrong?
Hi,
wanted to know whether anyone had success downloading the patches. When I try to download the patches and the startup file, they show up as text files. should I cut and paste the contents to the right file names? Pls help. Thanks
praveen
Hai All.
Installed everything without a hitch on a FC3 Box, tried the same thing on a FC4 Box, and now I get the following error:
aaa.c:28: error: static declaration of âuaddrâ follows non-static declaration
aaa.h:49: error: previous declaration of âuaddrâ was here
(…)
make: *** [aaa.o] Error 1
I have applied the sysv patch!
Any help would be appreciated!
Kind regards,
Onno.
[b]Onno:[/b] remove the word “static” before “struct addr_ent *uaddr[ADDR_HASH_SIZE];” in file aaa.c (line 28) and it will compile fine :)
Hi,
I installed everything, but my left side is not the same as Nasim’s configuration. The Linux box is behind a router that hands out the DHCP addresses. The linux box has a static IP within the subnet. I am allowing vpn passthroughs for port UDP/TCP 500 and 4500 as well as 1723. How does the configuration change with the above setup, meaning how do I setup the conf files? I tried a couple of changes to mimic the local segment but to no avail. Anybody have this setup? Please help. I feel I am close but have a problem with some configuration items. Specifically, I am getting errors 789 and 792 on the windows VPN client. Thanks for your help.
praveen
I have installed everthing like the guide said.
But in the secure log i see the following
initial phase 1 message is invalid: its Encrypted Flag is on
sending notification INVALID_FLAGS to
Can anybody help me?
Erik
Hi
I have o problem with ipsec , when i try to start show this messege.
/etc/init.d/ipsec: (/etc/ipsec.conf, line 3) section header “interfaces=%defaultroute” has wrong number of fields (1) — `start aborted [FAILED]
I have a linux box whit FC3 and openswan-2.4.4-0.FC3.1 , kernel 2.6.12-1.1381_FC3
jhony, I ran into the same problem where %defaultroute was bombing on me when starting the service. The problem was the indentation of ipsec.conf was not showing properly within the instructions. The instructions look to be updated now.
hi there,
this guide is works!
everything is going fine, but i still have a bug,
why this vpn cannot connect multiple user to server?
i mean if im logged in and my friend wants to connect too, he cant connect
im checking tail -f /var/log/secure and /var/log/mesages no indicator that my friend is rejected
although we use different user?
any one have same problem with me?
any one help me?
:’(
thanks
Thanx for this great howto! Building a VPN server has never been so simple. But I have a little problem getting my connections to work. I used your ipsec.conf, and only changed the relevant IP-addresses. Now every time I try to connect from some remote computer, I get an error message (in /var/log/messages) saying “cannot respond to IPsec SA request because no connection is known for [my PUBLIC ip-address]/32===[local IP of my VPN server]:17/1701…[public IP of remote computer][@Username]:17/1701″. The server then sends an encrypted notification INVALID_ID_INFORMATION to the remote computer.
What am I doing wrong? Could you please help me?
Not work whit shorewall 3.x firewall, any idea for configuring?. Read a wiki shorewall, but not a clear info for this pruposes. Help please, thanks.-
Wonderful web site, for VPN solution.
Thanks for this guide.I m able to stablish vpn connection but only one client can access the server.I have already add the client in /etc/ppp/chap-secrets.But it can’t work.How can I give permission to unlimited access(client)?
This is perfect but to install a VPN server in fedora core5 you do not have to patch l2tpd.
Just yum that with
yum install l2tpd
yum install Openswan
and follow the same configuration options.
Thanks
Simple reporting for the L2TPD/IPSEC VPN Server
1. place the following script in your /etc/cron.hourly directory
#————————————————————————-
#!/bin/sh
# retrieve date in 3 letter form and assign the value to DTNOW
DTNOW=`date`
# retrieve date in 3 letter form and assign the value to P1
P1=`date +%b`
# retrieve day of the month in leading space removed format and assign it to P2
P2=`date +%e`
# retrieve Hour in 24 format and assign it to P3
P3=`date +%H`
# retrieve the integer value of P3 and decrement it by one because
# the script is run hourly and searches for the last hour access
P4=`expr $P3 – 1`
# Create a file in the /tmp directory
# a randomly named file
echo > /tmp/k30fsf98.log
echo -e “VPN Connections made from $P4:00 to $P3:00 on $DTNOW and closedrn”>> /tmp/k30fsf98.log
echo -e “Total Number of Connections: rn” >> /tmp/k30fsf98.log
grep “$P1 $P2 $P4″ /var/log/messages | grep “name = ” | grep Response | wc -l >> /tmp/k30fsf98.log
echo -e “Connection details: rn” >> /tmp/k30fsf98.log
grep “$P1 $P2 $P4″ /var/log/messages | grep “name = ” | grep Response >> /tmp/k30fsf98.log
echo -e “rn” >> /tmp/k30fsf98.log
grep “$P1 $P2 $P4″ /var/log/messages | grep “Connection closed” >> /tmp/k30fsf98.log
echo -e “rn” >> /tmp/k30fsf98.log
grep “$P1 $P2 $P4″ /var/log/messages | grep “: Connect time” >> /tmp/k30fsf98.log
cat /tmp/k30fsf98.log | mail -s “Hourly VPN log from $P4 and $P3 on $DTNOW” SOME_EMAIL@SOME_DOMAIN.COM
#—————————————————————————
2. Replace SOME_EMAIL@SOME_DOMAIN.COM with the email that is supposed to receive the hourly access report.
HOSSEIN
hello everyone
this guide just rocks
can any body guid me how we can configure l2tpd/ipsec client for linux machine
thanks
How can I configure this with windows 2000, and some other versions of windows??
hi
when i first saw your name i guess that you are iranian ( as i am iranian).
i comment here to say that your guide help me a lot. but i am writing a guide in persian
for debian release and i want to use some part of your articles.
Do u know persian?
can use your article in my guide?
tanx
its an honor for me if you came to my very very small weblog. tanx again
hi
Thanks for your help;your guide I help myself much.
Thanks again
would you like to give me flow chart to descript your VPN (L2TP with IPsec)…???
i hope you will help me….tahnx before.-ian- (sorry, if my english is not good :D )
Hello Ian if you speak Spanish i will help you with your VPN (L2TP with IPsec)
do you have VPN Linux configuration with radius as database authentication?
may i know howto IPsec work at ur VPN configuration??
for my thesis :D thank
hi to all,
I need help in creating a vpn connection between winxp and fedora where fedora is acting as server while winxp is client.
on server openswan is installed while using l2tp ipsec vpn on windows.
my mail id : techsolnltd at gmail dot com
Regards
I followd all of youre steps and while connecting from XP with SP2 i get error no. 721 after saying verifying username and passwod. can you trace what is my my error
Hi
It is the most comprehensive document on VPN which I have come across and everything worked fine on RHEL5 and it is functioning in it’s first attempt :-) thanks for everything
dillip
Hi, can comebody let me know what is the configuration required on the Linux client.
I’ve now employed Hamachi as well and ditched the problematic MS VPN solution.
There would be miss dials, I’d have to restart the
“Routing and Remote Access” service sometimes as well as power cycle the modem.
Now I have no issues. Install Hamachi on the client pc’s and set their
hosts file up and all is well. The notebook users benefit as well.
Hamachi is intelligent and knows when to use the
Local Area Network to peer when it can.
When remote and there is an internet connect a route is found via the net.
Hamchi – it just works – it’s great!!!
I have to wonder how that comparison would fare if it was Vista vs Linux? We bought a new HP Vista machine and converted an old WIn 2K based desktop to SUSE Linux – http://file.sh/SUSE+Linux+torrent.html . After 2 months the hassles with Linux are far fewer! There are hassles with both, but the Linux hassles are well documented and Novell ($60 SUSE Linux support) actually DOES provide solutions in real English! We are preparing to convert the new machine to Linux as well.