Unable to connect to El Capitan server VPN from outside the network

Question

Unable to connect to El Capitan server VPN from outside the network

Hi.

I am having problems connecting to my VPN from outside of my network. When testing internally connections succeed and I am able to use the VPN. However, from outside of the network using an external Wifi network or over 3G / 4G the connection fails every time. I have tested this using two Android devices, a Windows PC and a MacBook. I have included the server log file as it demonstrates the point of failure. Can anyone advise.

DNS Resolves to my static home IP fine but then fails at the point shown below.

My system spec is:

Mac Mini - mid 2010

El Caption 10.11

OSX Server 5.0.4(15S2259)

I am using an Apple Airport as my router which is handling DHCP and NAT. All required ports are open and automatically handled via Server

Thanks

Barry.

#Start-Date: 2015-10-10 10:41:47 BST
#Fields: date time s-comment
2015-10-10 10:41:47 BST Loading plugin /System/Library/Extensions/L2TP.ppp
2015-10-10 10:41:47 BST Listening for connections...
2015-10-10 10:43:26 BST Incoming call... Address given to client = 10.0.1.224
Sat Oct 10 10:43:26 2015 : Directory Services Authentication plugin initialized
Sat Oct 10 10:43:26 2015 : Directory Services Authorization plugin initialized
Sat Oct 10 10:43:26 2015 : publish_entry SCDSet() failed: Success!
Sat Oct 10 10:43:26 2015 : publish_entry SCDSet() failed: Success!
Sat Oct 10 10:43:26 2015 : publish_entry SCDSet() failed: Success!
Sat Oct 10 10:43:26 2015 : L2TP incoming call in progress from '<device_external_ip_address_is_displayed_here>'...
Sat Oct 10 10:43:26 2015 : L2TP received SCCRQ
Sat Oct 10 10:43:26 2015 : L2TP sent SCCRP
2015-10-10 10:43:46 BST   --> Client with address = 10.0.1.224 has hungup

OSX Server-OTHER, OS X El Capitan (10.11), OSX Server 5.0.4 (15S2259)

Posted on Oct 10, 2015 3:01 AM

Reply

Answer 1

Oct 17, 2015 2:33 AM in response to barrrrrrrrrry

i am also having a problem reaching my vpn server (Server 5.0.4 (Build 15S2259)) from external networks since upgraded to 10.11:

For testing my server is in DMZ, all other services (mail, web,...) are working fine, only the vpn doesn't work. It looks like the server is not listening on port 4500 (L2TP) for incoming connections (tested with nmap from an external network).

The server also replies that the VPN service isn't reachable from the internet - but the service is on and listening for connections:

#Fields: date time s-comment

2015-10-17 11:16:45 CEST Loading plugin /System/Library/Extensions/L2TP.ppp

2015-10-17 11:16:45 CEST Listening for connections...

2015-10-17 11:17:51 CEST terminating on signal 15

#End-Date: 2015-10-17 11:17:51 CEST

#Start-Date: 2015-10-17 11:17:53 CEST

#Fields: date time s-comment

2015-10-17 11:17:53 CEST Loading plugin /System/Library/Extensions/L2TP.ppp

2015-10-17 11:17:53 CEST Listening for connections...

Oct 17 11:28:50 <host> servermgr_vpn[20169]: Connected to the Auth Service

the VPN was working fine before (no settings changed since the upgrade)...

any ideas ?

thx, Alex

Reply

Answer 2

Oct 18, 2015 9:05 PM in response to Linc Davis

Just browsing these posts really helps. Reading your reply reminded me about updating my host name to a changed incoming IP Address. Now my VPN works again. I keep thinking it's the name servers that have to match which I did when I installed new updated OS X Server. Again thanks for all your replies.

Reply

Answer 3

Oct 19, 2015 2:49 AM in response to lexontuxi

I have the same issue as described, just i'm running Server 5.0.4 on Yosemite 10.10.5, which is a complete fresh install.

L2TP works fine internally, but not externally. DNS is correct both internally and externally. Checked network settings as Linc suggested.

PPTP works fine internally and externally. I opened up the DMZ just to ensure all ports were routing and that sadly made no difference to ext L2TP connections.

Noticed that in the vpnd.log when i try and connect externally on L2TP nothing registers.

Thanks
Darren

Reply

Answer 4

Oct 19, 2015 5:25 AM in response to SquirrelMac

HHave you tested to be sure your ISP isn't blocking the port? I know mine blocks L2TP. http://www.canyouseeme.org/

Reply

Answer 5

Oct 19, 2015 6:09 AM in response to Walter Starks

Called ISP and they say no ports are blocked.

1701, 500 & 4500 are all showing as Error.

I've disabled all VPN services on the Draytek 2860 router incase there was a conflict and opened the DMZ temporarily until i work it out.

Something somewhere is blocking these ports.

Reply

Answer 6

Oct 19, 2015 6:18 AM in response to SquirrelMac

I'm also having problems connecting to a Softether vpn server using the Mac L2TP client. This worked fine in Yosemite but not after upgrade to El Capitain. The error is the vpn server did not respond. The same connection works fine in ubuntu or android using lt2p and in windows using the softether client.

I added google dns (8.8.8.8, 8.8.4.4) to the dns tab in advanced settings but it still did not work.

No ports are blocked and I can ping the vpn server. My local LAN is class C and the vpn dns issues class B. The server is on a class A lan.

Reply

Answer 7

Oct 19, 2015 8:13 AM in response to markhorrocks

Here's an update.

Just set L2TP VPN on my 10.8 server and that connects from external with no issues.

Ran the port 1701 on canyouseeme.org from the server that's successfully running L2TP and that still shows an error!

Must be a problem with the Server App surely?

Reply

Answer 8

Oct 19, 2015 8:31 AM in response to SquirrelMac

UPDATE 2!

Can confirm it's 100% the server app.

Just connected my working 10.8 Server L2TP to the router that i'm having trouble with and it works from the outside.

Reply

Answer 9

AndreGB

Level 1

14 points

Oct 31, 2015 8:23 AM in response to SquirrelMac

Same problem here. Same symptoms and same log messages. The bad news is Apple doesn't care about us (OS X Server VPN users).

By the way, I believe this is not specific do OS X or Server. I can't connect to my SSH console from outside my network either. I changed absolutely nothing, not even my DNS and specially not my router.

Reply

Answer 10

Nov 1, 2015 1:04 AM in response to AndreGB

I have been having problems connecting iOS devices using L2TP since upgrading to El Capitan and iOS9. When using previous L2TP settings in iOS or exporting config profiles from server.app I get a fail. However if I create new iOS L2TP config settings manually on the iOS device itself all appears to work well with my network being accessible from the outside.

Connection from Android devices using L2TP still does not work.

Reply

Answer 11

AndreGB

Level 1

14 points

Nov 1, 2015 7:42 AM in response to barrrrrrrrrry

OK, I was finally able to make it work. It had to do with the Permissions configuration under the VPN settings. I set "Connecting from" to Private Networks, applied configurations (the VPN service must restart) and then changed it back to All Networks and applied them again. I'll be doing that to all my services now.

Reply