L2TP VPN not working over internet

Question

Level 1

14 points

L2TP VPN not working over internet

Hello Mac Community,

It is pretty clear to me that even though I have forwarded the required ports for L2TP, that Mavericks and Server 3 break the L2TP VPN capabilites I was actively using in Mountain Lion.

I can connect locally, but when done from an external network via port forwarding, L2TP fails to connect. Before you query me on port forwarding and router make and model, let me assure you, I have been successfully doing L2TP VPN with Mountain Lion and Server 2.x.x with no issue. Pretty clear to me that Mavericks broke something.

Suggestions specific to the OS platform are appreciated! (The network is in good working order.)

OSX Server-OTHER

Posted on Oct 29, 2013 4:35 PM

Reply

Answer 1

Oct 30, 2013 2:16 AM in response to TonyPHX_623

Hello there,

I have the same problem. Some other threads I've found, are talking about it as an iOS-Problem, cause it seems, that you can connect with an Mac running new Mac OS X Mavericks as well. I couldn't test that 'til now.

Why do we allways have to buy a new Version of OS X Server, when upgrading the System?? Software should ever be downwards compatible.... So Apple: Do something to fix your bugs in Mavericks!!

Since Steve Jobe died, the Quality of Mac Software is going down more and more!!

Regards,

Heiner

Reply

Answer 2

Oct 30, 2013 2:30 AM in response to TonyPHX_623

Hello there as well,

I've the same issue and I investigate the problem. The reason why it does not work is, that the racoon (IKE Daemon) does not accept connections on port 4500 (IKE for NAT-T) if the source port is random generated.

Since Mavericks and IOS7 the source port from the client is no longer 4500, this lead to this problem (except you have a old VPN connection already setup bevor you update to IOS7 on your Phone).

If you are in the same network like your server, the IKE NAT-T is not used. In this case the regular port 500 (IKE) is used, and this works as expected. At the moment we have to wait if the problem is fixed by Apple.

There are two possibilities, they can adjust the clients or the server configuration. However if you want to use VPN with OS X native methods, use PPTP. This is not affected but of course it provides no Layer 2 Tunneling.

Regards,

Daniel

Reply

Answer 3

TonyPHX_623 Author

Level 1

14 points

Oct 30, 2013 6:23 AM in response to powercore

Powercore,

A very well done investigation! Thank you for illuminating what is actually taking place! Now for Apple to resolve.... I am hoping they will see the logic of the reality of the situation.

Tony

Reply

Answer 4

Oct 31, 2013 8:34 AM in response to TonyPHX_623

I'm a bit confused between the use of vpnd and racoon, but I think that vpnd uses racoon for IKE. The fun bit is that racoon can do NATT, but I can't seem to make it work. I'm not convinced that we have to wait for Apple to fix this.

Reply

Answer 5

TonyPHX_623 Author

Level 1

14 points

Oct 31, 2013 8:43 AM in response to JonThompson

I like your enthusiasm! I wish I had more time to tackle making racoon work then, but if you find a solution Jon, please share. Or if you write a stable and reliable VPN server, please sell. I will be first in line. : )

Reply

Answer 6

Oct 31, 2013 11:30 AM in response to TonyPHX_623

I replaced /usr/sbin/racooon with the version from Mountain Lion and that seems to work (though seemed to screw up Screen Sharing authentication until I rebooted).

Reply

Answer 7

Oct 31, 2013 1:52 PM in response to TonyPHX_623

I just made post with my observations with Verizon FIOS Router at this other link but still uncomfortable with

this being unresolved definatively in so many years of discussion.

My link asks about bad rule in IPSec definition.

UDP Source in IPSec is 500 as well as destination.

What will this do ?

I was Live chatting on Actiontec when tech disconected after an hour without notice.

Reply

Answer 8

Oct 31, 2013 3:20 PM in response to Graeme Wood

replacing /usr/sbin/racoon (with two 'o's) didn't work for me.

Reply

Answer 9

Oct 31, 2013 11:47 PM in response to Graeme Wood

It took a reboot, but it did finally work. Thanks! I was mucking around with the settings, not thinking of trying a binary replacement.

Reply

Answer 10

TonyPHX_623 Author

Level 1

14 points

Nov 1, 2013 12:10 AM in response to TonyPHX_623

I know you gents may laugh, but I ah...upgraded all of my machines. Time to build a VM to get that old binary....

Reply

Answer 11

Dec 19, 2013 2:39 PM in response to TonyPHX_623

Looks like there is a VPN Update for OS X Server that just came out. It requires OS X 10.9.1. Installing it myself now.

Good luck to everyone.

Reply

Answer 12

TonyPHX_623 Author

Level 1

14 points

Dec 20, 2013 10:43 AM in response to laundry bleach

Laundry Bleach - thanks for posting! This update did in fact work for me. Glad that Apple fixed this, finally. : )

Reply

Answer 13

Dec 20, 2013 10:45 AM in response to TonyPHX_623

Hi TonyPHX_623,

I'm glad it fixed you up. Thank you for the courtesy of awarding the "solved" for this thread, it is much appreciated.

Reply

Answer 14

Apr 11, 2015 7:12 AM in response to powercore

Hello - I seem to be having the same problem but on OSX 10.10.3 Yosemite with Server 4.0.3.

Is there any fix available for this or workaround? Screenshot below show the log connecting from outside my Airport express (where it does not work) and then over the LAN (where it does work).

Reply