vpnd rundown

Check out this posting. http://forums.macosxhints.com/showthread.php?p=149892
I am currently running vpnd on mac os x 10.5.7 client. Some of the config files I had to create as they were missing in the OS. I confirmed that when I rebooted the Mini that the server started up correctly. I can now connect to my VPN Server using my iPhone 3.0 OS and Windows XP SP 3. If you need any help let me know. I did delete the CHAP authentication in the xml file and I unchecked the "store share secret in key chain" option in iVPN application. Here is the link to iVPN 2.4b When you launch the app it will ask if you want to download the latest version, say no. http://ftp.heanet.ie/disk1/sourceforge/i/iv/ivpnd/iVPN-2.4b.zip

Here is the website where it explains how to configure using this tool: http://tinyapps.org/docs/osx_vpnserver.html

Message was edited by: silverfun

I seem to have this working, at least in part. I was able to even get my iPhone connected.

$ cat /Library/Preferences/SystemConfiguration/com.apple.RemoteAccessServers.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>ActiveServers</key>
<array>
<string>com.apple.ppp.l2tp</string>
</array>
<key>Servers</key>
<dict>
<key>com.apple.ppp.l2tp</key>
<dict>
<key>DNS</key>
<dict>
<key>OfferedSearchDomains</key>
<array/>
<key>OfferedServerAddresses</key>
<array/>
</dict>
<key>IPv4</key>
<dict>
<key>ConfigMethod</key>
<string>Manual</string>
<key>DestAddressRanges</key>
<array>
<string>192.0.2.1</string>
<string>192.0.2.1</string>
</array>
<key>OfferedRouteAddresses</key>
<array/>
<key>OfferedRouteMasks</key>
<array/>
<key>OfferedRouteTypes</key>
<array/>
</dict>
<key>Interface</key>
<dict>
<key>SubType</key>
<string>L2TP</string>
<key>Type</key>
<string>PPP</string>
</dict>
<key>L2TP</key>
<dict>
<key>IPSecSharedSecret</key>
<string>PlaintextPassword</string>
<key>Transport</key>
<string>IPSec</string>
</dict>
<key>PPP</key>
<dict>
<key>AuthenticatorProtocol</key>
<array/>
<key>LCPEchoEnabled</key>
<integer>1</integer>
<key>LCPEchoFailure</key>
<integer>5</integer>
<key>LCPEchoInterval</key>
<integer>60</integer>
<key>Logfile</key>
<string>/var/log/ppp/vpnd.log</string>
<key>VerboseLogging</key>
<integer>1</integer>
</dict>
<key>Server</key>
<dict>
<key>Logfile</key>
<string>/var/log/ppp/vpnd.log</string>
<key>MaximumSessions</key>
<integer>128</integer>
<key>VerboseLogging</key>
<integer>1</integer>
</dict>
</dict>
</dict>
</dict>
</plist>


Of note:

1. This must always be a range of IP addresses, even if you only want your server to listen on a single IP address. I’ve not looked too deeply into it, but when I specify only one address, vpnd will not start and log that a range was not specified.

<key>DestAddressRanges</key>
<array>
<string>192.0.2.1</string>
<string>192.0.2.1</string>
</array>

2. Set this to the Shared Secret that you will configure in your Network Preference Pane on the client machine.

<key>IPSecSharedSecret</key>
<string>PlaintextPassword</string>

3. I’m sure there are other values for this, but for now I leave it as “1”. Setting it to “0” will probably turn off verbose logging, which I might do once I’m certain it’s working exactly how I want it to.

<key>VerboseLogging</key>
<integer>1</integer>

4. I leave this section in its original place for completeness, but it seems that it can be safely removed; perhaps its absence imparts a default.

<key>AuthenticatorProtocol</key>
<array/>

Other settings are, for example:

<key>AuthenticatorProtocol</key>
<array>
<string>MSCHAP</string>
</array>


The only aspect of this I have not yet configured properly is having vpnd’s launchd property list configured to have it always on.

And, an update:

1. This must always be a range of IP addresses, because the key “DestAddressRanges” is not too intuitive. It’s not the destination address or “listener”, if you will, of vpnd, but the actual range of IP addresses provided by vpnd to a connecting client computer. So, specify only one address, vpnd will not start and log that a range was not specified.

<key>DestAddressRanges</key>
<array>
<string>192.0.2.1</string>
<string>192.0.2.1</string>
</array>

I setup VPND on Snow Leopard client with the help of these postings, and everything seemed to be working great until later I tried to connect and the connection began failing with this message:

2009-11-08 15:02:08 MST Incoming call... Address given to client = 10.0.2.109
Sun Nov 8 15:02:08 2009 : SCDynamicStoreCreate failed: Configuration daemon not (no longer) available
2009-11-08 15:02:08 MST --> Client with address = 10.0.2.109 has hungup

This persisted until restarting. My Mini had fallen asleep in-between, maybe that had something to with the error?

But what I am really asking about is setting it up to launch on boot and to be able to wake up a sleeping mini, (which works with the other services I have running).

I am assuming that I need to create a launchd plist for this, but have never done this before. Help would be appreciated.

One of my concerns is the switches to pass vpn when using launchd to daemonize correctly. So far I have been using it without any switches and it seems to load the proper configuration and daemonize, but according to the launchd docs, the process is NOT supposed to daemonize.

Thanks,
B

Out of interest:

I found in a different forum that if you have this problem:
2009-11-08 15:02:08 MST Incoming call... Address given to client = 10.0.2.109
Sun Nov 8 15:02:08 2009 : SCDynamicStoreCreate failed: Configuration daemon not (no longer) available
2009-11-08 15:02:08 MST --> Client with address = 10.0.2.109 has hungup

You can solve it by creating a startup item for VPND and rebooting.

I couldn't figure out how to do Launchd, so I ended up making a basic StartupItem for vpnd

Seems to be working for me so far.

I may have solved the other issue, depending on how my Mini and Airport Extreme behave regarding IP addresses... I use the free WakeOnLan utility to send a magic wakeup packet to my external address on one of the forwarded UDP ports for VPN. I think it works, but I've only tried it once.

Has anyone figured out how to start the vpnd using Launchd?

I have set this up, and I can connect to the VPN via my iPhone locally, but not through the internet, unless I turn on port range forwarding for ports 1 thru 32767 on my Linksys router (I have an Airport Express connected to that). Is there some list of port numbers that need to be forwarded to do this? Is there a better way?

I would not want all those ports open. For VPN, you need at minimum the following ports open in the router & your firewall:

Port 500 UDP
Port 4500 UDP
Port 1701 UDP
and
protocol 50 (ESP) <-- this is a protocol, not TCP or UDP port 50

-Doug

Thanks for the info. I did not want all those ports open either 🙂 I had only opened them on an experimental basis.

That list of ports does seem to be working, but for some reason, the VPN keeps dropping my iPhone, at least when used thru the internet and not WiFi. Anyone had that happen?

Also, my computer's ability to serve webpages seems to stop when vpnd is running. Is there any easy way of getting around this?

Are you running a true static IP, or using something like DynDNS to route your WAN connection to your server?

Have you looked at your vpnd and ppp logs to see if there's a clue there?

-Doug