EzDevInfo.com

Windows Server VPS as L2TP VPN Server with one NIC

I just installed the OpenVPN Access Server on a Linux VPS (Azure Virtual Maschine) and it works perfectly! (The purpose is to be online at "unsafe" locations.)

But I would prefer the a Windows Server with a running L2TP VPN Server. But I wasn't able to simple share the internet through VPN, because the Wizard demands two Network Interfaces.

Has anyone accomplished to run a VPN Server on Windows Server with Internet Sharing with one Network Interface?

Does any body know how to make a VPN connection programmatically using L2TP/IPSec server protocol in android?

Does any body know how to make a VPN connection programmatically using L2TP/IPSec server protocol in android?

I'm trying to connect to my VPN server with L2TP/IPSec protocol through my android application, as i was researching I found out that with android.net.vpnservice I could connect, but as I read some of documentation it was not clear how to connect to VPN (there were no API to set username or password, and also no API to set my VPN type(l2tp,pptp); I also tested example application Google provided(toyvpn) and there were none of what I mentioned earlier there too.

Any help would be really appreciated. Thanks in advance

why a layer 2 tunneling protocol when we already have layer 3 tunneling protocol

In network, a tunnel is a logical connection between two nodes. In the tunnel, there are multiple routers that physically comprise the path. Hence the packets in a tunnel are essentially routed via IP. (correct me if I am wrong)

This makes sense to a layer 3 tunneling protocol, where a passenger protocol is encapsulated in an IP protcol. Routeres inside a tunnel can make use of the extra IP headers to route packets to tunnel endpoints.

However in a layer 2 tunneling protocol, a passenger protocol is encapsulated in an layer2 protcol. For example, in L2TP as below, we can see the original packet(ppp header+ppp payload) is encapsulated within a L2TP header, UDP header, IPSec header, IP header, Data-link header. Since we already have a outer IP header, which sufficies to route the whole packets through the tunnel to its endpoints. why do we bother to add another extra data-link header? The only reason that seemes possible to me is that it tries to send this packets over a ppp link or a WAN link, but in practice this link is logical and consists of numerous physical routers. So why would you want to add a extra link layer header? and how would this packet be processed in the tunnel?

Connect to existing VPN connection iOS

I was wondering if anybody knew if it is possible to write a program to turn on a VPN connection from within an app, either automatically or via button press. The VPN profile has already been pushed to the device via AirWatch. The VPN is an L2TP type.

Thanks for your help,

Kyle.

Establish IPSEC Tunnel between two Ubuntu 12.04 PCs over LAN

I have two ubuntu 12.04 32 Bit PCs between which I want IPSec Tunnel to be setup. I have setup ipsec in both systems and ipsec verify runs fine on both. Since I have no prior experience of openswan, I am finding it hard to set config files.

Here is the snippet of ipsec.config

config setup
# Do not set debug options to debug configuration issues!
# plutodebug / klipsdebug = "all", "none" or a combation from below:
# "raw crypt parsing emitting control klips pfkey natt x509 dpd private"
# eg:
# plutodebug="control parsing"
# Again: only enable plutodebug or klipsdebug when asked by a developer
#
# enable to get logs per-peer
# plutoopts="--perpeerlog"
#
# Enable core dumps (might require system changes, like ulimit -C)
# This is required for abrtd to work properly
# Note: incorrect SElinux policies might prevent pluto writing the core
dumpdir=/var/run/pluto/
#
# NAT-TRAVERSAL support, see README.NAT-Traversal
nat_traversal=yes
# exclude networks used on server side by adding %v4:!a.b.c.0/24
# It seems that T-Mobile in the US and Rogers/Fido in Canada are
# using 25/8 as "private" address space on their 3G network.
# This range has not been announced via BGP (at least upto 2010-12-21)
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
# OE is now off by default. Uncomment and change to on, to enable.
oe=off
# which IPsec stack to use. auto will try netkey, then klips then mast
protostack=netkey
# Use this to log to a file, or disable logging on embedded systems (like openwrt)
#plutostderrlog=/dev/null

# Add connections here

# sample VPN connection
# for more examples, see /etc/ipsec.d/examples/
conn linux-to-linux
#       # Left security gateway, subnet behind it, nexthop toward right.
        left=192.168.58.17
#       leftsubnet=172.16.0.0/24
#       leftnexthop=10.22.33.44
#       # Right security gateway, subnet behind it, nexthop toward left.
        right=192.168.58.32
#       rightsubnet=192.168.0.0/24
#       rightnexthop=10.101.102.103
#       # To authorize this connection, but not actually start it, 
#       # at startup, uncomment this.
        auto=start

Queries:

1. Now based on the given topology (see image) of my network, is the above config correct for both the PCs.
2. Is it have to be same for both left and right PCs.
3. After it is setup how do I confirm that secure tunnel is working, what is the best tool to check the algos being used and packet's content.
4. Inside LAN the secure ipsec tunnel is called host-to-host tunnel and the site-to-site connection refers to when VPN kicks in, right?

Tools for monitoring users on L2TP VPN

I'm looking for some help and advice in terms of monitoring network connections to a L2TP / Ipse VPN platform Ubuntu 14.04.

My basic requirement is to get visibility of:

1) Who's logged in (over time). 2) How much data they have consumed.

A nice to have would be some configurable variables to show activity over a period of time (day, week, month).

Previously, I've been using PPTPD, and have used a great little script which is simple, but does the job. https://github.com/boukeversteegh/pptpd-monitor

I'm struggling to find anything for L2TP which has the same functionality. The only thing that comes close that I've found is 'bandwidthd', however, the available docs are pretty thin, and I'm struggling to get it configured and working.

Has anyone else managed to solve this problem in the past ?

L2TP/Ipsec redirect/prerouting to socks

I`m running a L2TP/Ipsec VPN and a TOR socks proxy on same machine. I need route all IPsec client traffic to socks port. I get only mask in traffic to leave Internet server with the IP but I can not do PREROUTING to route it.

I use this rule to POSTROUTING:

iptables -t nat -I POSTROUTING -s 10.10.8.0/24 -o eth+ -j SNAT --to-source MYSERVERIP

Without this rule i tried to apply this PREROUTING rule thats works with OPENVPN but not with L2TP/Ipsec:

iptables -t nat -A PREROUTING -s 10.10.8.0/24 -i tun0 -p tcp -j DNAT --to-destination 127.0.0.1:9050
iptables -t nat -A PREROUTING -s 10.10.8.0/24 -i tun0 -p udp -j DNAT --to-destination 127.0.0.1:9050

Any idea?

This is my sysctl.conf configuration:

net.ipv4.ip_forward = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.lo.send_redirects = 0
net.ipv4.conf.eth0.send_redirects = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.eth0.rp_filter = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

'error: ‘CKM_AES_CTR’ undeclared' while compiling libreswan-3.15

I am getting compilation error while compiling libreswan-3.15 source code.

make[3]: Entering directory /root/libreswan-3.15/OBJ.linux.i386/programs/pluto' cc -g -O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-all -fno-strict-aliasing -fPIE -DPIE -DFORCE_PR_ASSERT -DDNSSEC -DFIPS_CHECK -DFIPSPRODUCTCHECK=\"/etc/system-fips\" -DKLIPS -DLIBCURL -DUSE_LINUX_AUDIT -DUSE_MD5 -DHAVE_NM -DUSE_SHA2 -DUSE_SHA1 -DFIPSPRODUCTCHECK=\"/etc/system-fips\" -DIPSEC_CONF=\"/etc/ipsec.conf\" -DIPSEC_CONFDDIR=\"/etc/ipsec.d\" -DIPSEC_NSSDIR=\"/etc/ipsec.d\" -DIPSEC_CONFDIR=\"/etc\" -DIPSEC_EXECDIR=\"/usr/local/libexec/ipsec\" -DIPSEC_SBINDIR=\"/usr/local/sbin\" -DIPSEC_VARDIR=\"/var\" -DPOLICYGROUPSDIR=\"/etc/ipsec.d/policies\" -DSHARED_SECRETS_FILE=\"/etc/ipsec.secrets\" -DGCC_LINT -DALLOW_MICROSOFT_BAD_PROPOSAL -Wall -Wextra -Wformat -Wformat-nonliteral -Wformat-security -Wundef -Wmissing-declarations -Wredundant-decls -Wnested-externs -I/root/libreswan-3.15/ports/linux/include -I/root/libreswan-3.15/ports/linux/include -I/root/libreswan-3.15/ports/linux/include -I/root/libreswan-3.15/ports/linux/include -I/root/libreswan-3.15/programs/pluto/linux26 -I/root/libreswan-3.15/include -I/root/libreswan-3.15/lib/libcrypto -I/root/libreswan-3.15/linux/include -DUSE_KEYRR -DNETKEY_SUPPORT -DKERNEL26_HAS_KAME_DUPLICATES -DPFKEY -DUSE_TWOFISH -DUSE_SERPENT -DKLIPS -DPFKEY -DUSE_AES -DUSE_3DES -DUSE_SHA2 -DUSE_SHA1 -DUSE_MD5 -DUSE_CAMELLIA -DXAUTH_HAVE_PAM -DLIBCURL -DFIPS_CHECK -DHAVE_LIBCAP_NG -DHAVE_NM -I/usr/include/nss3 -I/usr/include/nspr4 \ -MMD -MF ./ctr_test_vectors.d \ -o ./ctr_test_vectors.o \ -c /root/libreswan-3.15/programs/pluto/ctr_test_vectors.c /root/libreswan-3.15/programs/pluto/ctr_test_vectors.c: In function ‘test_aes_ctr’: /root/libreswan-3.15/programs/pluto/ctr_test_vectors.c:243: error: ‘CKM_AES_CTR’ undeclared (first use in this function) /root/libreswan-3.15/programs/pluto/ctr_test_vectors.c:243: error: (Each undeclared identifier is reported only once /root/libreswan-3.15/programs/pluto/ctr_test_vectors.c:243: error: for each function it appears in.) make[3]: *** [ctr_test_vectors.o] Error 1 make[3]: Leaving directory/root/libreswan-3.15/OBJ.linux.i386/programs/pluto' make[2]: * [local-base] Error 2 make[2]: Leaving directory /root/libreswan-3.15/programs/pluto' make[1]: *** [all] Error 2 make[1]: Leaving directory/root/libreswan-3.15/programs' make: * [all] Error 2

Tried searching on internet but did not find the solution. Please provide some pointers so that I can fix this issue.

L2TP/IPSEC PSK Application for Android using C# and DotRas

I have been searching for couple months and still didn't get the solution to build a VPN application using L2TP/IPSEC PSK using Android native language. I tried ToyVpn but didn't see how you pass username and password to server. I didn't tried openvpn since it didn't support TAP mode. So I just want to ask:

1. Is it possible to build L2TP/IPSEC PSK applications for Android 4.x using vpnservice API?
2. Is it possible to build L2TP/IPSEC PSK applications for Android 4.x using C# and DotRas (https://dotras.codeplex.com/)?

Create a L2TP/IPSec VPN connection programmatically in Android

I read that Android >=4 no longer include VPN Connection Profiles ( for eg: L2TP/IPSec ) and provided just a base handler VpnService.

Now that we have to implement everything ourselves, is there any java library which provides a basic L2TP/IPSec Communication Code ?

I want to be able to take this library, integrate it with VPN Service and use it in the android app.

Thanks in advance everyone.

What's the point of using L2TP together with IPSec?

According to my limited understanding, IPSec authenticates peers and encapsulates/encrypts IP packets in tunnel mode.

On another hand, L2TP itself does not offer authentication/encryption, but offers encapsulation, which is already achieved by IPSec.

In my application, I would like to secure end-to-end data transfer using IPSec. I am also considering "L2TP/IPSec" but cannot figure out which L2TP feature is not offered by IPSec? Why would I choose to use L2TP/IPSec rather than IPSec alone?

Create a vpn client support l2tp on Android 4+

I have a server which I install l2tp vpn server. I want to create an vpn client to connect to it with app I've created.

I know i can config system and use l2tp. But, how can I do my own client with the VPN API (VpnService, ...) Because I want to connect vpn with more control with the app; Thx!

Use .ppk file to connect to a L2TP VPN (Mac)

I was given a .ppk file (which I know is only for putty). However, I have am using OS X Yosemite.

I followed this: Use PPK file in Mac Terminal to connect to remote connection over SSH to convert the .ppk file to a .pem file. This worked fine. However, when I double click the .pem file it says unable to import.

I need to import it because when I try to choose the certificate from network preferences on a VPN(L2TP), the certificate is not listed. What can I do to use the .ppk file so I can connect to the VPN?

L2TP / PPTP server with multi external IP

I have a Debian VPS with 2 IP addresses : example 1.1.1.1 and 2.2.2.2

I've already setup a PPTP service and a L2TP service that work great.

When a VPN client connect to the VPS (IP 1.1.1.1) : his public IP address is 1.1.1.1

But the issue is that when a VPN client connect to the VPS (IP 2.2.2.2) : his public IP address is still 1.1.1.1 instead of 2.2.2.2

How can I fix this ?

Thanks !

Debian vServer: Cannot connect to VPN with multiple devices in same network

I set up a VPN on my virtual Server using openswan, xl2tpd and ppp (see this tutorial: https://raymii.org/s/tutorials/IPSEC_L2TP_vpn_with_Ubuntu_14.04.html). So I am talking about a L2TP/IPSec VPN with a PSK.

The problem I have: I can connect a smartphone with the VPN using the on-board API. But after that I cannot connect any more devices to the VPN using a device from the same network (others or cell-networks are working). For me that means NAT-support isn't enabled but as shown in the tutorial I set the nat_traversal-value in /etc/ipsec.conf to "yes".

Actually, if I connect a windows-computer first, I CAN connect both the computer and one more other device (smartphone), but I am NOT able to connect another device.

I am sure the problem isn't: - the phone: Sometimes I can connect, sometimes not, as shown above. No installations block anything. - the router: A connection to the VPN is not impossible. - the server itself: A connection to the VPN is not impossible.

I see the problem in the configs but I have no clue where to look for these settings. If someone knows what to do I appreciate every answer. Thank you.