Newsroom Update

Beginning in May, a special Today at Apple series titled “Made for Business” will offer small business owners and entrepreneurs free opportunities to learn how Apple products and services can support their growth and success. Learn more >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Is Lion Server a good personal VPN solution?

I'd like to set up a VPN server on my home network for the following reasons:

  1. Enable access to my network shares from my Air when I'm away from home
  2. Encrypt my connections from my iPad, iPhone, and Air when on unsecured WiFi networks


For #2, I currently use Witopia, but it's a fairly expensive service and with Lion Server now just $50, why not do it myself and add the ability to access my local network from anywhere?


What I'm wondering is whether running Lion Server on my Mini is a good option for achieving this without undue risk to my local network, or is it going to be a big pain to setup?

Posted on Aug 4, 2011 6:44 AM

Reply
12 replies

Aug 4, 2011 8:18 AM in response to lh99

Sorry but you need in this case the Snow Leopard Server... ;-)

Because the Lion Server doesnt has built in the VPN Config in the Serveradmin anymore...

Apple has castrated the Lion Server to minimal... also MySQL is missing, same about php and and and...


It has a reason, why the Snow Leopard Server was so expensive...


You get, what you paid for...

Aug 4, 2011 12:59 PM in response to TechArea

Yeah, I found information about the configuration options (i.e. there are none), and I'm OK with that because all I need is L2TP/IPSec.


What I'm really looking for is experience from other users with this setup. I've come across plenty of information about how it works technically, the specs, some specific troubleshooting discussions, and what the Admin app looks like, but no one saying "it works for me!" or "not worth the trouble because of X."

Aug 4, 2011 2:03 PM in response to lh99

In order to be able to access my network I use Mac OS X 10.7 Server to be my VPN endpoint for my Macs and iOS devices. The VPN technologies that you could use are the Layer Two Tunneling Protocol (L2TP) with IPSec Authentication. You have the ability to decide what IP address range to assign. From the Apple menu, select System Preferences. When the System Preferences window opens, from the View menu, select Network. Near the bottom left corner of the Network window, click the + (plus sign). In the sheet that appears, next to "Interface:", choose VPN. Next to "VPN Type:", choose L2TP over IPSec. Click Create.In the "Server Address:" field, enter your server address. To display a VPN icon in the upper right corner of your screen, leave Show VPN status in menu bar checked. You can then click this icon and select from several options in the pull-down menu, rather than having to access VPN options from System Preferences. "it works for me!"

Aug 6, 2011 9:43 AM in response to lh99

After posting this, I realized that I could check out reviews on the App Store as well. There weren't too many people talking about VPN, but from what little information was there, the results seemed to be mixed. Either people hated Lion Server (most of them migrating from Snow Leopard Server and having huge problems) or absolutely loved it. Put me in the 2nd camp.


I just went ahead and bought it, and installation went extremely smoothly - it literally took 15 minutes. Setting up VPN was as simple as flipping a switch -- since I have an Airport Extreme, the Server admin panel automatically detected this and offered to automatically configure port forwarding to enable VPN access from the internet. Then I just configured the OS X VPN client as DrMacApple describes above, configured my iPhone and iPad using iPhone Configuration Utility (save a moble profile from the Server Admin, then load it onto the iOS devices using the Utility), and everything Just Worked.


Note: iPhone Configuration Utility is not necessary, but I used a 50-character shared secret, so this approach allowed me to avoid typing the code in by hand.

Sep 1, 2011 8:01 AM in response to lh99

I have been trying to get the VPN server to respond for several days with no success on a brand new Mac Mini.


Immediately after logging into the OS I ran an OS X Lion software update, then I installed the Lion server (10.7.1).


I was able to set up the file sharing, the iCal and address book server, the web server and the Wiki without hassle from within the "server.app" and the Open Directory server and the firewall from within the server admin app (this one is part of the Server Admin Tools 10.7 that you have to download separately from http://support.apple.com/kb/DL1419 – why is that, Apple?).


Also, the DNS server was put into operation to correctly translate the server name "server.mycompany.private" into the corresponding IP in my local network behind the router. What irritates me, however, is that a second local server name appears from time to time ("server.local").


It is as easy as 1-2-3 to launch the VPN server, too.

So far so good - it is running but endlessly keeps listening for connections without any success. Simply doesn't work for me with the firewall down - neither locally (in my home network) nor from the Internet. This is the /var/log/ppp/vpnd.log after connection attempts:


#Start-Date: 2011-08-31 18:39:52 CEST

#Fields: date time s-comment

2011-08-31 18:39:52 CEST Loading plugin /System/Library/Extensions/L2TP.ppp

2011-08-31 18:39:52 CEST Listening for connections...


Any ideas???

Sep 11, 2011 6:13 AM in response to lh99

After the Genius Bar guys at our Hamburg Apple Store had given up on this issue, I finally solved the problem - my VPN is up and running!


After re-installing both OS X Lion and Lion Server several times I realized that certain settings (apparently also for the VPN server) are kept in the invisble recovery partition that Lion installed on my Mac Mini (e.g., 'com.apple.RemoteAccessServers.plist'). They even survived a reformatting of the hard drive. Something must have gone wrong the first time I tried to set up the VPN server and the "sudo serveradmin settings vpn" command revealed that the settings survived every re-installation.


Therefore, I physically removed the hard drive and formatted it using a different Mac running Snow Leopard.

It is important not only to erase the disk but also to partition it. This might even work under Lion without having to remove the drive...


After another re-installation of OS X Lion on the clean drive over the Internet from Apple's server (pressing the command-R keys while rebooting) I did a system update and subsequently installed the Server app.

After that I was able to start the VPN server from the Server app.


Inside my local network it was then possible to connect to the VPN server from an iPad 2 (iOS 4.3.5) and from an old Powerbook G4 (Leopard), but not from a MacBook Pro with Snow Leopard.


However, all clients were able to make an external connection through my Deutsche Telekom Router (SpeedPort 722V) with forwarding of ports 1701 (UDP), 500 (UDP) and 4500 (UDP) and enabled GRE and ESP protocols.


For the sake of security I have disabled (closed) all arbitrary ports of the server's own firewall while it's local network ports (192.168.x.y) are all open to enable any internal connections.


It is a serious restriction, however, that the Lion Server only offers the L2TP VPN protocol. Maybe the commercial iVPN solution is an acceptable workaround: http://macserve.org.uk/.


Regards, Björn

Is Lion Server a good personal VPN solution?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.