主页 / ubuntu / 问题

问题[l2tp](ubuntu)

Martin Hope
Zulgrib
Asked: 2020-11-20 09:09:01 +0800 CST
  • 1

尝试将计算机连接到以这种方式配置的 VPN 服务器：

Router# show isakmp policy
ISAKMP policy: L2TP_VPN
  IKD_ID: 8
  negotiation mode: main
  proposal: 1
    encryption: aes256
    authentication: sha256
  proposal: 2
    encryption: aes256
    authentication: sha512
  SA lifetime: 86400
  key group: group20
  NAT traversal: yes
  dead peer detection: yes
  my address: wan1
    type: interface
  secure gateway address: 1
    address: 0.0.0.0
  secure gateway address: 2
    address: 0.0.0.0
  fall back: deactivate
  fall back check interval: 300
  authentication method: pre-share
  pre-shared key: PRESHAREDKEYHERE
  certificate: default
  local ID: 0.0.0.0
    type: ip
  peer ID: 
    type: any
  user ID: 
  type: 
  X-Auth: no
    type: server
    method: default
    allowed user: Utilisateurs_VPN
    username: 
    password: 
  EAP-Auth: no
    type: 
    aaa method: 
    allowed user: 
    allowed auth method: mschapv2
    username: 
    auth method: mschapv2
    password: 
  vcp reference count: 0
  IKE_version: IKEv1
  active: yes

第二阶段部分

Router> show crypto map VPN_CONNECTION1
cryptography mapping: VPN_CONNECTION1
  VPN gateway: L2TP_VPN
  Gateway IP Version: IPv4
  encapsulation: transport
  active protocol: esp
  transform set: 1
    encryption: aes256
    authentication: sha512
  transform set: 2
    encryption: aes256
    authentication: sha256
  SA lifetime: 28800
  PFS: group15
  nail up: no
  scenario: remote-access-server
  l2tp: yes
  local policy: L2TP_VPN_LOCAL
  remote policy: any
  protocol type: any
  configuration provide:   
    mode config: no
    configuration payload: no
    address pool: 
    first dns: 
    second dns: 
    first wins: 
    second wins: 
  policy enforcement: no
  replay detection: no
  narrowed: yes
  adjust mss: yes
  mss value: 0
  stop rekeying: no
  NetBIOS broadcast over IPSec: no
  outbound SNAT: no
    source: 
    destination: 
    target: 
  inbound SNAT: no
    source: 
    destination: 
    target: 
  inbound DNAT: no
  vcp reference count: 0
  active: yes
  VTI: 
  VPN ID: 2
  connected: no
  connectivity check: no
    check method: none
    IP address: none
    period: none
    timeout: none
    fail tolerance: none
    port: none
    log: no
  rule type: 4in4

L2TP部分：

Router# show l2tp-over-ipsec ;
L2TP over IPSec:
  activate          : yes
  crypto            : VPN_CONNECTION1
  address pool      : L2TP_VPN_IP_ADDRESS_POOL
  authentication    : default
  certificate       : default
  user              : Utilisateurs_VPN
  keepalive timer   : 60
  first dns server  : 
  second dns server : 
  first wins server : 
  second wins server:

这是 ike-scan 看到服务器的方式：

Zulgrib@computer:~$ sudo ./ike-scan.sh GATEWAYIP | grep SA=
    SA=(Enc=AES Hash=SHA2-512 Auth=PSK Group=21 KeyLength=256 LifeType=Seconds LifeDuration(4)=0x00007080)

我使用 NetworkManager 配置了客户端。

[connection]
id=MyVpnName
uuid=3a6d0094-ff3e-49a2-95a3-54303542b2da
type=vpn
autoconnect=false
permissions=user:Zulgrib:;
timestamp=1605784830

[vpn]
gateway=GATEWAYIP
ipsec-enabled=yes
ipsec-esp=aes256-sha256-ecp384
ipsec-ike=aes256-sha256-ecp384
ipsec-psk=PRESHAREDKEY
password-flags=1
user=testvpn
service-type=org.freedesktop.NetworkManager.l2tp

[ipv4]
dns-search=
method=auto

[ipv6]
addr-gen-mode=stable-privacy
dns-search=
method=auto

但是路由器方面，日志声称 VPN 客户端尝试使用 AES128 和 modp3072。

Recv:[SA][VID][VID][VID][VID][VID]
Recv IKE sa: SA([0] protocol = IKE (1), AES CBC key len = 256, HMAC-SHA256 PRF, HMAC-SHA256-128, 384 bit ECP, AES CBC key len = 128, 3072 bit MODP; ).
The cookie pair is : 0xhexhexhex / 0xhexhexhex [count=2]
Send:[SA][VID][VID][VID][VID][VID][VID][VID][VID][VID][VID][VID]
Recv:[NOTIFY:INVALID_KEY_INFORMATION]

客户端，协商时也出错：

nov. 19 17:28:16 computer NetworkManager[1337]: initiating Main Mode IKE_SA 3a6d0094-ff3e-49a2-95a3-54303542b2da[1] to GATEWAYIP
nov. 19 17:28:16 computer NetworkManager[1337]: generating ID_PROT request 0 [ SA V V V V V ]
nov. 19 17:28:16 computer NetworkManager[1337]: sending packet: from 192.168.170.52[500] to GATEWAYIP[500] (216 bytes)
nov. 19 17:28:16 computer NetworkManager[1337]: received packet: from GATEWAYIP[500] to 192.168.170.52[500] (410 bytes)
nov. 19 17:28:16 computer NetworkManager[1337]: parsed ID_PROT response 0 [ SA V V V V V V V V V V V ]
nov. 19 17:28:16 computer NetworkManager[1337]: received unknown vendor ID: f7:58:f2:26:68:75:0f:03:b0:8d:f6:eb:e1:d0:04:03
nov. 19 17:28:16 computer NetworkManager[1337]: received draft-ietf-ipsec-nat-t-ike-02 vendor ID
nov. 19 17:28:16 computer NetworkManager[1337]: received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
nov. 19 17:28:16 computer NetworkManager[1337]: received draft-ietf-ipsec-nat-t-ike-03 vendor ID
nov. 19 17:28:16 computer NetworkManager[1337]: received NAT-T (RFC 3947) vendor ID
nov. 19 17:28:16 computer NetworkManager[1337]: received XAuth vendor ID
nov. 19 17:28:16 computer NetworkManager[1337]: received DPD vendor ID
nov. 19 17:28:16 computer NetworkManager[1337]: received unknown vendor ID: af:ca:d7:13:68:a1:f1:c9:6b:86:96:fc:77:57
nov. 19 17:28:16 computer NetworkManager[1337]: received unknown vendor ID: f9:19:6d:f8:6b:81:2f:b0:f6:80:26:d8:87:6d:cb:7b:00:04:32:00
nov. 19 17:28:16 computer NetworkManager[1337]: received unknown vendor ID: ac:40:f8:c4:38:99:27:c6:e8:ac:24:53:1b:b7:8b:2b:27:fc:b5:21:73:53:c1:94:4a:02:92:52:ac:c9:ab:03:8e:fa:5c:a1:d1:c6:24:15:c3:df:8e:e1:58:61:fa:ea:48:80:9d:c2:a6:c4:b
nov. 19 17:28:16 computer NetworkManager[1337]: received unknown vendor ID: b6:c9:8c:ca:29:0a:eb:be:37:f1:9f:31:12:d2:d7:cb
nov. 19 17:28:16 computer NetworkManager[1337]: negotiated DH group not supported
nov. 19 17:28:16 computer NetworkManager[1337]: generating INFORMATIONAL_V1 request 1203248937 [ N(INVAL_KE) ]
nov. 19 17:28:16 computer NetworkManager[1337]: sending packet: from 192.168.170.52[500] to GATEWAYIP[500] (56 bytes)
nov. 19 17:28:16 computer NetworkManager[1337]: establishing connection '3a6d0094-ff3e-49a2-95a3-54303542b2da' failed
nov. 19 17:28:16 computer charon[30591]: 12[IKE] negotiated DH group not supported
nov. 19 17:28:16 computer charon[30591]: 12[ENC] generating INFORMATIONAL_V1 request 1203248937 [ N(INVAL_KE) ]
nov. 19 17:28:16 computer charon[30591]: 12[NET] sending packet: from 192.168.170.52[500] to GATEWAYIP[500] (56 bytes)
nov. 19 17:28:16 computer NetworkManager[1337]: Stopping strongSwan IPsec...

如何将 NetworkManager 配置为在所有阶段使用 ecp384 (DH20) 而不是 modp3072 (DH15) 以及 AES256？

路由器端配置无法更改，因为它是目前（据说）被 strongswan（由网络管理员使用）和 Win10 IPSec 客户端都支持的最强配置。

vpn network-manager 18.04 ipsec l2tp
Martin Hope
Storms786
Asked: 2020-10-13 11:31:42 +0800 CST
  • 0

我正在使用 Kubuntu 20.04 并且遇到 L2TP VPN 问题

顺便说一句，直到今天它工作正常，可以连接，所有流量都很好。现在 VPN 已连接，但我无能为力.. 甚至www.google.com也无法正常工作。

奇怪的是我有另一台具有相同操作系统的机器，我在那里设置了 VPN，它工作正常。此外，我之前也遇到过同样的问题（两次！）.. 重新安装了 kubuntu，它又可以正常工作了！我不想再次重新安装 kubuntu，因为设置我需要的所有东西是一件很痛苦的事。

顺便说一句，遵循这个解决方案似乎可以部分解决它：How to disable systemd-resolved in Ubuntu?

上述解决方案的问题是VPN变得非常慢。任何人都知道问题是什么以及我该如何解决？就像我说的，如果我新安装操作系统，那么它工作得非常好.. 但几周后我又遇到了这个问题！

iptables vpn resolv.conf docker l2tp
Martin Hope
Chemdream
Asked: 2020-08-24 12:14:53 +0800 CST
  • 4

我正在尝试在 20.04 中创建一个使用 LDAP 进行用户身份验证的 L2TP/IPSEC VPN 服务器。

我假设Strongswan会这样做。

在 Strongswan 或其他配置中，我应该在哪里添加 LDAP 服务器信息？

还是它只是使用 SSSD 或 PAM 或其他东西，而您只是将 Strongswan 指向它？

我专门寻找 LDAP，而不是 Radius。我知道半径是可能的。

任何帮助，将不胜感激。我意识到有几个问题接近这个问题。但他们所有的答案都需要一个 GUI。这是一个云服务器，所以没有 gui。谢谢！

vpn ldap ipsec l2tp
Martin Hope
Lonnie Best
Asked: 2019-10-27 00:58:23 +0800 CST
  • 0

在 Ubuntu 19.10 中，我能够成功添加一个自安装 19.10 以来一直运行良好的 L2TP VPN。

然而，在添加一个额外的 L2TP VPN 后，它不仅没有工作，而且还破坏了第一个“已经添加并工作”的 L2TP VPN。

这种损坏非常严重，即使我删除了所有 VPN 配置文件，重新启动并再次添加，它仍然无法正常工作。同时，我可以将完全相同的 L2TP VPN 配置添加到 19.10 的虚拟机中，并且 L2TP VPN 工作正常。

我在这里提交了关于此的错误：

  1. https://gitlab.gnome.org/GNOME/gnome-control-center/issues/746
  2. https://bugs.launchpad.net/ubuntu/+source/gnome-control-center/+bug/1849930

您可以在上面的链接中查看失败连接尝试的 syslog 详细信息。

如果没有重新安装 Ubuntu 19.10，我该如何撤消由于添加第二个 L2TP VPN 配置文件而导致的损坏？也许有一些文件我可以删除以使事情变得新鲜。请指教。

vpn network-manager gnome-control-center 19.10 l2tp