[SOLVED] L2TP/IPSec road warrior setup; but packets aren't being encrypted.

systemlordanubis · 02-11-2013, 05:58 PM

Hi All,

I've followed the following example setup of an L2TP/IPSec VPN for a dynamic VPN client (Windows 7).

http://wingloon.com/2012/01/11/how-t...-debian-lenny/

However, when checking that the data is being encrypted, I'm seeing the packets being encapsulated in l2tp, but the payload is clear; no encryption at all.

I've checked and double-checked the config and it matches, but still no success.

The VPN server is Debian using ipsec and xl2tpd. The process show:

Code:

23051 ?        S      0:00 /bin/sh /usr/lib/ipsec/_plutorun --debug  --uniqueids yes --force_busy no --nocrsend no --strictcrlpolicy no --nat_traversal yes --keep_alive  --protostack netkey --force_keepalive
23053 ?        S      0:00  \_ /bin/sh /usr/lib/ipsec/_plutorun --debug  --uniqueids yes --force_busy no --nocrsend no --strictcrlpolicy no --nat_traversal yes --keep_alive  --protostack netkey --force_keepa
23058 ?        S      0:00  |   \_ /usr/lib/ipsec/pluto --nofork --secretsfile /etc/ipsec.secrets --ipsecdir /etc/ipsec.d --use-netkey --uniqueids --nat_traversal --virtual_private %v4:10.0.0.0/8,%v4:192.168
23085 ?        S      0:00  |       \_ _pluto_adns
23054 ?        S      0:00  \_ /bin/sh /usr/lib/ipsec/_plutoload --wait no --post 
23052 ?        S      0:00 logger -s -p daemon.error -t ipsec__plutorun
23102 ?        Ss     0:01 /usr/sbin/xl2tpd

When testing the connection from the VPN client, I can see that I'm properly tunneling to the server and getting internet through it, but all as clear packets.

How can I ensure the payloads are being encrypted?

Thanks
Anubis.

Skaperen · 02-11-2013, 09:18 PM

If the packets are in clear, then IPsec does not have the outer IP addresses mapped to be encrypted. Check IPsec configs.

systemlordanubis · 02-11-2013, 09:52 PM

Hi,

Thanks for the reply.

Below is the ipsec.conf I'm running on; does anything stand out in here as I was following a tutorial (link posted in first post) which was supposed to enable ipsec on the link.

Thanks
Anubis

Code:

# /etc/ipsec.conf - Openswan IPsec configuration file

# This file:  /usr/share/doc/openswan/ipsec.conf-sample
#
# Manual:     ipsec.conf.5


version	2.0	# conforms to second version of ipsec.conf specification

# basic configuration
config setup
	nat_traversal=yes
	virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
	nhelpers=0
	protostack=netkey
	oe=off

# Add connections here
conn L2TP-PSK-CLIENTS
	authby=secret
	pfs=no
	auto=add
	keyingtries=3
	rekey=no
	type=transport
	#left=%defaultroute
	#leftnexthop=%defaultroute
	#leftprotoport=17/1701
	left=XXX.XXX.XXX.XXX  <<< vpn server's wan address
	leftnexthop=XXX.XXX.XXX.XXX <<< vpn server's default gateway
	leftprotoport=17/1701
	right=%any
	rightsubnet=vhost:%priv,%no
	rightprotoport=17/%any
	dpddelay=40
	dpdtimeout=130
	dpdaction=clear

systemlordanubis · 02-14-2013, 08:06 PM

Hi All,

The problem's been resolved. The issue was some old VPN software that was installed on the client PC which was some how overriding the built-in windows VPN settings/control. Removing this software returned windows to normal and the VPN connection now works as expected.

Thanks
Anubis.

jefro · 02-14-2013, 08:47 PM

Thanks for the update.