Unable to set up VPN server

Question

m3dusa Author

Level 1

8 points

Unable to set up VPN server

I am unable to properly set up and access a VPN server. Help is much appreciated.

Setup

Server: 2009 MBP, 15", 8 GB ram; OSX 10.10.5 ; Server.app 4.1.5.

Client: 2015 MBP retina, 13"; OSX 10.10.5

Router: 2009 Time Capsule (firmware 7.6.4)

Using Airport Utility (6.3.5), I have given the server a reserved IP and forwarded ports 500, 1701, 1723 and 4500 to that IP (and also 22 for SSH).

I have set up a DDNS for the server (using MAC address of wireless card, which I am using for now).

Using Server.app I have set up the VPN to allow only my user access. There's a green dot on the Services>VPN item in the sidebar, but in Server><computer_name> in Overview:Server:Internet it says Reachable at 87.––.––.––. (–– is my redaction), no services available.

With the url for my DDNS, I can log in to the server using ssh, which I take to mean that I am on the right track.

But when trying to connect to the VPN (having set the same URL as hostname), I get no response from the server and hence no connection.

I have tried verifying the port openness using http://www.yougetsignal.com/, but this is apparently unable to reach any port, perhaps this is a clue.

I don't really have any prior networking experience. What could I be doing wrong?

Posted on Aug 30, 2015 7:14 AM

Reply

Answer 1

Linc Davis

Level 10

209,547 points

Aug 30, 2015 8:55 AM in response to m3dusa

Select the Network tab in AirPort Utility and click Network Options. In the sheet that opens, check the box marked

Allow incoming IPSec authentication

if it's not already checked, and save the change.

Reply

Answer 2

m3dusa Author

Level 1

8 points

Aug 30, 2015 11:12 AM in response to Linc Davis

Thank you for the suggestion, Linc.

I did not have the option, though. I found it using Airport Utility 5.6.1 (http://coreyjmahler.com/2013/10/24/airport-utility-5-6-1-on-os-x-10-9-mavericks/). The option is now also available in Airport Utility 6.3.

Setting "Block incomming IPv6 connections" gives the option to "Allow incoming IPSec authentication". The time capsule is now blinking amber, with the message: "IPv6 Relay Error".

Outbound activity seems to function as normal, but there is no change in VPN.

Reply

Answer 3

Linc Davis

Level 10

209,547 points

Aug 30, 2015 11:20 AM in response to m3dusa

Can you connect to the VPN from within the local network?

Reply

Answer 4

m3dusa Author

Level 1

8 points

Aug 30, 2015 12:21 PM in response to Linc Davis

Yes.

(By "connecting within" i assume you mean setting the hostname on Server.app and the client to e.g. <servername>.local)

Reply

Answer 5

Linc Davis

Level 10

209,547 points

Aug 30, 2015 1:38 PM in response to m3dusa

No, I mean that you should try to connect to the host by its external domain name from inside the network.

Reply

Answer 6

m3dusa Author

Level 1

8 points

Aug 30, 2015 1:43 PM in response to Linc Davis

Oh, well in that case, no, it doesn't work ("server did not respond")

Reply

Answer 7

Linc Davis

Level 10

209,547 points

Aug 30, 2015 5:08 PM in response to m3dusa

Check the Access setting for the service. It should be All Networks.

Reply

Answer 8

m3dusa Author

Level 1

8 points

Aug 30, 2015 10:14 PM in response to Linc Davis

"Users" is set to my user, "Network" is set to "all networks".

Reply

Answer 9

Linc Davis

Level 10

209,547 points

Aug 31, 2015 7:07 AM in response to m3dusa

Logs?

Reply

Answer 10

m3dusa Author

Level 1

8 points

Aug 31, 2015 12:19 PM in response to Linc Davis

I am unsure which logs would be helpful.

I tried a traceroute, and it turns out I was mistaken about how the routing worked, when I said that ssh worked.

When I said that, I was on a different network, but that was the guest network provided by the time capsule. When entering the ddns-adress, I thought it would have to make a loop over the internet. Traceroute tells me I was wrong.

When I try the same thing over my cellphone, ssh also stops working.

Can something be deduced from this?

Reply

Answer 11

Linc Davis

Level 10

209,547 points

Aug 31, 2015 1:47 PM in response to m3dusa

The story seems to have changed. I'm not sure now what does or doesn't work. Please summarize.

Reply

Answer 12

m3dusa Author

Level 1

8 points

Aug 31, 2015 2:35 PM in response to Linc Davis

ssh-connection qualified by DDNS to server :

Working on local network.

Not working through cell connection.

VPN-connection :

Working with server set to servername.localhost

Not working on local net with DDNS-qualified IP.

Not working over cell connection.

Reply

Answer 13

Linc Davis

Level 10

209,547 points

Aug 31, 2015 7:01 PM in response to m3dusa

Can you ping or traceroute the router from outside the network?

Reply

Answer 14

m3dusa Author

Level 1

8 points

Aug 31, 2015 11:04 PM in response to Linc Davis

From an outside network (cell connection)

traceroute -I reaches my router in 10 hops

traceroute (without -I) hangs on the last IP before mine

ping gets through

Reply

Answer 15

Linc Davis

Level 10

209,547 points

Sep 1, 2015 5:23 AM in response to m3dusa

Some ISP's statefully block UDP datagrams at the headend that don't follow a reciprocal outgoing packet, unless you pay for business-class service. Incoming L2TP VPN connections would then also be blocked. That's what seems to be happening. If UDP is blocked, you may be able to connect with PPTP, which uses TCP rather than UDP.

Reply