0

I have tried the vpn l2tp connection, but I can't connect. I use GUI Network Manager. this is the debug code

nm-l2tp[25816] <info>  starting ipsec
Stopping strongSwan IPsec failed: starter is not running
Starting strongSwan 5.5.1 IPsec [starter]...
Loading config setup
Loading conn 'b90b8bb2-cbd9-456c-a33e-b43adc975dec'
found netkey IPsec stack
nm-l2tp[25816] <info>  Spawned ipsec up script with PID 25879.
initiating Main Mode IKE_SA b90b8bb2-cbd9-456c-a33e-b43adc975dec[1] to 103.76.22.130
generating ID_PROT request 0 [ SA V V V V V ]
sending packet: from 192.168.42.162[500] to 103.76.22.130[500] (240 bytes)
sending retransmit 1 of request message ID 0, seq 1
sending packet: from 192.168.42.162[500] to 103.76.22.130[500] (240 bytes)
nm-l2tp[25816] <warn>  Timeout trying to establish IPsec connection
nm-l2tp[25816] <info>  Terminating ipsec script with PID 25879.
Stopping strongSwan IPsec...
destroying IKE_SA in state CONNECTING without notification
establishing connection 'b90b8bb2-cbd9-456c-a33e-b43adc975dec' failed
nm-l2tp[25816] <warn>  Could not establish IPsec tunnel.

(nm-l2tp-service:25816): GLib-GIO-CRITICAL **: g_dbus_method_invocation_take_error: assertion 'error != NULL' failed

can someone help me what happened or fix it? i have tried tutorial in here and here

oman kopyor
  • 1
  • 2

1 Answers1

0

Running ./ike-scan.sh script from the second link you provided results in :

    sudo ipsec stop
    sudo ./ike-scan.sh 103.76.22.130 | grep SA=
      SA=(Enc=3DES Hash=SHA1 Auth=PSK Group=2:modp1024 LifeType=Seconds LifeDuration(4)=0x00007080)
      SA=(Enc=3DES Hash=SHA1 Auth=PSK Group=14:modp2048 LifeType=Seconds LifeDuration(4)=0x00007080)
      SA=(Enc=AES Hash=SHA1 Auth=PSK Group=2:modp1024 KeyLength=128 LifeType=Seconds LifeDuration(4)=0x00007080)
      SA=(Enc=AES Hash=SHA1 Auth=PSK Group=14:modp2048 KeyLength=128 LifeType=Seconds LifeDuration(4)=0x00007080)
      SA=(Enc=AES Hash=SHA1 Auth=PSK Group=2:modp1024 KeyLength=192 LifeType=Seconds LifeDuration(4)=0x00007080)
      SA=(Enc=AES Hash=SHA1 Auth=PSK Group=14:modp2048 KeyLength=192 LifeType=Seconds LifeDuration(4)=0x00007080)
      SA=(Enc=AES Hash=SHA1 Auth=PSK Group=2:modp1024 KeyLength=256 LifeType=Seconds LifeDuration(4)=0x00007080)
      SA=(Enc=AES Hash=SHA1 Auth=PSK Group=14:modp2048 KeyLength=256 LifeType=Seconds LifeDuration(4)=0x00007080)

All of the proposals from that VPN server are considered weak as they are using SHA1 and/or modp1024. Could you try the following phase 1 and 2 algorithms :

  • Phase1 Algorithms : aes256-sha1-modp2048,aes256-sha1-modp1024!
  • Phase2 Algorithms : aes256-sha1!

I've picked the two strongest proposals offered by the VPN server for phase 1. The exclamation mark (!) is to restrict the VPN client to the specified proposals and not include strongSwan's default proposals. Some VPN servers don't like being flooded with lots of proposals from the client.

Douglas Kosovic
  • 101
  • 1