Migrated VPN Service Broken with Catalina

My Mac mini has been working just fine with macOS Mojave as a VPN server following the migration method described in https://developer.apple.com/support/downloads/macOS-Server-Service-Migration-Guide.pdf , but after upgrading to macOS Catalina there is trouble:

The VPN clients connect just fine on the internal network, but not on an external network; which makes the VPN server a bit pointless! I can confirm that all was working well with the server running macOS Mojave, and my iOS 13 and iPadOS 13 clients have been connecting just fine; it is the upgrade to macOS Catalina on the server that has caused this problem.

Here are the log entries for a failed connection:

vpnd.log

Posted on Oct 11, 2019 9:42 AM

Top-ranking reply

Grahamh51

Level 1

4 points

Posted on Nov 15, 2019 1:54 AM

I have tried VPN Enabler mention by lcrooks earlier and have managed to get the connection working back to my Catalina OS Mac Mini. I have done this locally from another desktop and remotely from my iphone. The later needed the OpenVPN app installed.

I also needed to edit the config file created by VPN Enabler as it didn't want to work by default. This was a bit of trial and error really as I am certainly no expert on this, but noticed when using the client part of VPN Enabler that the config file didn't seem to reference my server url but the port number instead. I simply replaced the port number with my url and it worked. The lines I changed are below

<key>RemoteAddress</key>

<string>xxx.ddns.net</string> This simply contained "REMOTE"

<key>remote</key>

<string>xxx.ddns.net</string> Note: this is where the port number 1194 was

View in context

Similar questions

120 replies

lcrooks

Level 1

9 points

Nov 5, 2019 3:42 PM in response to TrainsAndWellbeing

Anyone currently on Catalina - does the 10.15.1 update released today fix this problem? There is nothing within the support notes in regards to VPN, but still have my fingers crossed. I cannot update to Catalina until this issue is resolved. Tks.

https://support.apple.com/en-ca/HT210642

Dec 2, 2019 9:26 AM in response to VDalto

Thanks for your input but unfortunately it doesn't help us in this thread:

Our problem is that we used macOS as a VPN server and upgrading our server computers to Catalina has broken our ability to connect from anywhere that is not our internal network.

I suspect quite a few of us might move to Windows Server or a POSIX style system other than macOS.

lcrooks

Level 1

9 points

Dec 5, 2019 8:37 AM in response to TrainsAndWellbeing

This is really a sad state of affairs. None of these options are really facile and provide a long-term solution for future Apple updates. Apple should really fix this issue. I am astounded at Apple's lack of regard for this problem.

Dec 5, 2019 9:55 PM in response to TrainsAndWellbeing

Does anyone know what the change to /usr/sbin/racoon was from Mountain Lion (10.8) to Mavericks (10.9)?

A work-around decribed on https://macminicolo.net/racoon details copying /usr/sbin/racoon from an old system to fix an issue that prevented L2TP VPN connectivity in Server 3.0.1. Any ideas if the current issue with Catalina is related?

Dec 20, 2019 2:34 AM in response to Ivan Pavlov

I have, but I'm not expecting to see a fix at this stage. I've reported issues with migrated server services before and including this one, and been in e-mail contact with support and nothing seems to get fixed. Given that Apple removed the DNS service that Profile Manager depends on I suspect they want us to use and ISP hosting solution for things like DNS and VPN's which is something I won't be spending money on. I also don't want to surrender my security and privacy to an external provider. I suppose one solution would be to replace macOS with an open source alternative and running Linux systems on Mac's was quite popular at a time.

I'm using an older mac now for my VPN but if this issue does get resolved I'd appreciate it if somebody posted here if that happened.

Thanks

Bisucas

Level 1

4 points

Jan 15, 2020 10:06 AM in response to lcrooks

Good request! I am going through the ropes best I can but not that easy with the info available! Already installed Xcode and MacPorts. That bit was the easy part. Getting it setup and configured (I only need Mail and VPN) is a whole new challenge!

Jan 15, 2020 12:23 PM in response to lcrooks

Ugh perhaps I posted too soon, but perhaps not. I’m also seeing the behavior mentioned by the OP on some external networks, but not others.

I’ll follow up in a bit with a few quick technical pointers and try to characterize when/how the issue arises.

Bisucas

Level 1

4 points

Jan 15, 2020 2:39 PM in response to essandess

Great you reported it! I was getting frustrated not to be able to make a connection from my ISP or any other external networks. So it is not my settings files!

Apple, please fix Catalina. This just doesn't make sense!!!

wa1oui

Level 1

39 points

Mar 14, 2020 5:25 AM in response to Ivan Pavlov

I agree, but since this is a personal VPN, I have 32G of memory, AND if I'm using the VPN I'm not home to use the server itself it's a cheap and easy solution. Haven't noticed any degradation in performance when I'm home and the Parallels client is running anyway.

Mar 19, 2020 1:16 PM in response to lcrooks

Why unbelievable? They've triaged this and decided that only a relative few of us use it, and so our screams won't be loud enough to rock the prioritizers. Just because that's true doesn't make it right or good, of course, but Apple's the biggest gorilla in this jungle, so…. And honestly, there are worse bugs which go unresolved forever, although I'd guess this one would be pretty easy to identify and fix. Maybe we should scream louder, but given the stripping Apple gave MacOS Server, I'm guessing it wouldn't help.

wa1oui

Level 1

39 points

Apr 14, 2020 7:51 AM in response to e-nando

@e-nando Great find, but how did you copy vend into /usr/sbin?

I made sure my Mojave vpnd had root:wheel ownership, but kept getting errors. I turned off System Integrity Protection and got the error Read-only file system. How did you bypass these copy errors.

Thanks.

Apr 14, 2020 11:50 AM in response to lcrooks

I don't have access to a Mojave vpnd binary, if someone would provide one I'd be happy to provide a step-by-step set of instructions.

Edit: NVM, found one tucked away in a time capsule backup. Instructions incoming.

lcrooks

Level 1

9 points

Apr 14, 2020 1:04 PM in response to ElKoeppe10

Thanks so much for posting. I am still on Mojave so can send you vpnd if you would like?

Does this actually work? I need VPN access for my current setup so cannot upgrade to Catalina if this is not functional?

wa1oui

Level 1

39 points

Apr 16, 2020 7:19 AM in response to Ivan Pavlov

I thought I had solved the problem, but not quite. I can get the Mojave vpnd to work fine on Catalina *IF* I connect from my local network which is not much use. If I connect from the Internet I get 7 incoming calls, and then 7 hangups. I assumed there might have been a port forwarding problem, so I tried forwarding to the Mojave Parallels client I had been using to get around this problem and that worked fine. If I forwarded back to Catalina... NG. VPN Log extracts follow.

VPN Log

Apr 16, 2020 12:36 PM in response to Gib Henry

Oh, come on...

You always could connect to a VPN server running on Catalina from the same local network.

External connections never worked.

Before posting a “solution” here, please make sure that it actually works.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Migrated VPN Service Broken with Catalina