TonyPHX_623
Level 1 (5 points)

Q: L2TP VPN not working over internet

Hello Mac Community,

 

It is pretty clear to me that even though I have forwarded the required ports for L2TP, that Mavericks and Server 3 break the L2TP VPN capabilites I was actively using in Mountain Lion.

 

I can connect locally, but when done from an external network via port forwarding, L2TP fails to connect.  Before you query me on port forwarding and router make and model, let me assure you, I have been successfully doing L2TP VPN with Mountain Lion and Server 2.x.x with no issue.  Pretty clear to me that Mavericks broke something. 

 

Suggestions specific to the OS platform are appreciated!  (The network is in good working order.)

OSX Server

Posted on Oct 29, 2013 4:35 PM

by laundry bleach,Solvedanswer
laundry bleach laundry bleach
Level 5 (6,982 points)
Safari
A:

Looks like there is a VPN Update for OS X Server that just came out. It requires OS X 10.9.1. Installing it myself now.

 

Good luck to everyone.

Posted on Dec 19, 2013 2:39 PM

Close
TonyPHX_623

Q: L2TP VPN not working over internet

  • All replies
  • Helpful answers

  • by heinerfromhamburg,

    heinerfromhamburg heinerfromhamburg Oct 30, 2013 2:16 AM in response to TonyPHX_623
    Level 1 (0 points)
    Oct 30, 2013 2:16 AM in response to TonyPHX_623

    Hello there,

    I have the same problem. Some other threads I've found, are talking about it as an iOS-Problem, cause it seems, that you can connect with an Mac running new Mac OS X Mavericks as well. I couldn't test that 'til now.

     

    Why do we allways have to buy a new Version of OS X Server, when upgrading the System?? Software should ever be downwards compatible.... So Apple: Do something to fix your bugs in Mavericks!!

     

    Since Steve Jobe died, the Quality of Mac Software is going down more and more!!

     

    Regards,

    Heiner

  • by powercore,Helpful

    powercore powercore Oct 30, 2013 2:30 AM in response to TonyPHX_623
    Level 1 (10 points)
    Oct 30, 2013 2:30 AM in response to TonyPHX_623

    Hello there as well,

     

    I've the same issue and I investigate the problem. The reason why it does not work is, that the racoon (IKE Daemon) does not accept connections on port 4500 (IKE for NAT-T) if the source port is random generated.

     

    Since Mavericks and IOS7 the source port from the client is no longer 4500, this lead to this problem (except you have a old VPN connection already setup bevor you update to IOS7 on your Phone).

     

    If you are in the same network like your server, the IKE NAT-T is not used. In this case the regular port 500 (IKE) is used, and this works as expected. At the moment we have to wait if the problem is fixed by Apple.

     

    There are two possibilities, they can adjust the clients or the server configuration. However if you want to use VPN with OS X native methods, use PPTP. This is not affected but of course it provides no Layer 2 Tunneling.

     

    Regards,

    Daniel

  • by TonyPHX_623,

    TonyPHX_623 TonyPHX_623 Oct 30, 2013 6:23 AM in response to powercore
    Level 1 (5 points)
    Oct 30, 2013 6:23 AM in response to powercore

    Powercore,


    A very well done investigation!  Thank you for illuminating what is actually taking place!  Now for Apple to resolve.... I am hoping they will see the logic of the reality of the situation.

     

    Tony

  • by JonThompson,

    JonThompson JonThompson Oct 31, 2013 8:34 AM in response to TonyPHX_623
    Level 1 (5 points)
    Oct 31, 2013 8:34 AM in response to TonyPHX_623

    I'm a bit confused between the use of vpnd and racoon, but I think that vpnd uses racoon for IKE. The fun bit is that racoon can do NATT, but I can't seem to make it work. I'm not convinced that we have to wait for Apple to fix this.

  • by TonyPHX_623,

    TonyPHX_623 TonyPHX_623 Oct 31, 2013 8:43 AM in response to JonThompson
    Level 1 (5 points)
    Oct 31, 2013 8:43 AM in response to JonThompson

    I like your enthusiasm!  I wish I had more time to tackle making racoon work then, but if you find a solution Jon, please share.  Or if you write a stable and reliable VPN server, please sell.  I will be first in line.  : )

  • by Graeme Wood,

    Graeme Wood Graeme Wood Oct 31, 2013 11:30 AM in response to TonyPHX_623
    Level 1 (10 points)
    Oct 31, 2013 11:30 AM in response to TonyPHX_623

    I replaced /usr/sbin/racooon with the version from Mountain Lion and that seems to work (though seemed to screw up Screen Sharing authentication until I rebooted).

  • by Cool Games,

    Cool Games Cool Games Oct 31, 2013 1:52 PM in response to TonyPHX_623
    Level 1 (0 points)
    Oct 31, 2013 1:52 PM in response to TonyPHX_623

    I just made post with my observations with Verizon FIOS Router at this other link but still uncomfortable with

    this being unresolved definatively in so many years of discussion.

    My link asks about bad rule in IPSec definition.

     

    UDP Source in IPSec is 500 as well as destination.

    What will this do ?

    I was Live chatting on Actiontec when tech disconected after an hour without notice.

  • by JonThompson,

    JonThompson JonThompson Oct 31, 2013 3:20 PM in response to Graeme Wood
    Level 1 (5 points)
    Oct 31, 2013 3:20 PM in response to Graeme Wood

    replacing /usr/sbin/racoon (with two 'o's) didn't work for me.

  • by JonThompson,

    JonThompson JonThompson Oct 31, 2013 11:47 PM in response to Graeme Wood
    Level 1 (5 points)
    Oct 31, 2013 11:47 PM in response to Graeme Wood

    It took a reboot, but it did finally work. Thanks! I was mucking around with the settings, not thinking of trying a binary replacement.

  • by TonyPHX_623,

    TonyPHX_623 TonyPHX_623 Nov 1, 2013 12:10 AM in response to TonyPHX_623
    Level 1 (5 points)
    Nov 1, 2013 12:10 AM in response to TonyPHX_623

    I know you gents may laugh, but I ah...upgraded all of my machines.  Time to build a VM to get that old binary.... 

  • by laundry bleach,Solvedanswer

    laundry bleach laundry bleach Dec 19, 2013 2:39 PM in response to TonyPHX_623
    Level 5 (6,982 points)
    Safari
    Dec 19, 2013 2:39 PM in response to TonyPHX_623

    Looks like there is a VPN Update for OS X Server that just came out. It requires OS X 10.9.1. Installing it myself now.

     

    Good luck to everyone.

  • by TonyPHX_623,

    TonyPHX_623 TonyPHX_623 Dec 20, 2013 10:43 AM in response to laundry bleach
    Level 1 (5 points)
    Dec 20, 2013 10:43 AM in response to laundry bleach

    Laundry Bleach - thanks for posting!  This update did in fact work for me.  Glad that Apple fixed this, finally.  : )

  • by laundry bleach,

    laundry bleach laundry bleach Dec 20, 2013 10:45 AM in response to TonyPHX_623
    Level 5 (6,982 points)
    Safari
    Dec 20, 2013 10:45 AM in response to TonyPHX_623

    Hi TonyPHX_623,

     

    I'm glad it fixed you up. Thank you for the courtesy of awarding the "solved" for this thread, it is much appreciated.

  • by antwerpenR,

    antwerpenR antwerpenR Apr 11, 2015 7:12 AM in response to powercore
    Level 1 (4 points)
    Apr 11, 2015 7:12 AM in response to powercore

    Hello - I seem to be having the same problem but on OSX 10.10.3 Yosemite with Server 4.0.3.

     

    Is there any fix available for this or workaround?  Screenshot below show the log connecting from outside my Airport express (where it does not work) and then over the LAN (where it does work).

    racoon error.jpg