3

I have 2 PCs which I want to connect to a L2TP/IPSec VPN, one of them runs Ubuntu 16.04 and it works fine. The other one runs 18.04 and it can't connect to the server, although the settings are exactly the same. I compared every detail in the settings between the two computers. I even exported the settings on the working one and imported them on the other one, but it still doesn't work. On a Windows computer and on my Android phone it is also working.

So I'm wondering what's the difference between the VPN software on 16.04 and 18.04. Can anyone help me with that?

I already tried installing Libreswan, stopping xl2tpd and deleting the secrets file as suggested on these pages, but my problem still persists:

Pablo Bianchi
  • 15,657
jenald
  • 107
  • Can you please provide details how did you configure VPN site ? – KK Patel Nov 21 '19 at 16:32
  • Pretty basic but: Already seen journalctl -xe -p warning? Checked firewall/port issues? – Pablo Bianchi Nov 22 '19 at 01:47
  • @KetanPatel: It is an L2TP Server with IPSec and a Preshared Key on a Synology NAS. Do you need any other information? – jenald Nov 22 '19 at 12:39
  • @PabloA: the command outputs the following: Nov 22 13:36:49 HOSTNAME nautilus[16806]: Unexpected plugin response. This probably indicates a bug in a Nautilus extension: handle=0x55ef2f7ab450 But I think this has anything to do with the VPN – jenald Nov 22 '19 at 12:41
  • Stupid question but have you logged out and back in after setting it up on 18.04? – ognjen011 Nov 23 '19 at 22:06
  • A while ago (i.e., I probably can't find the link for you), I was trying to set up a VPN connection which worked easily on Windows and Android, but not Ubuntu. I found out that Windows has some default settings that most VPN servers agree with. However, Ubuntu feels that these settings are less secure and have left it for users to decide. Thus, there is more work to be done with Ubuntu (and presumably Debian?) and the default values won't do. This probably doesn't help much but it might explain why it was so easy for a Windows client. – Ray Nov 25 '19 at 02:08

3 Answers3

0

I assume that you are using default Ubuntu. The problem could be, that Network Manager has not all plugins. In 16.04 there is no default Network Manager L2TP/IPsec plugin. It was first introduced in 17.04. So you have somehow installed L2TP/IPsec plugin or you are using other third-party software than Network Manager.

So try to install this third-party software. Or in 18.04 for Network-Manager there is L2TP/IPsec plugin.

You can install them with this terminal command: 

sudo apt install network-manager-l2tp network-manager-l2tp-gnome

Next reboot your 18.04 PC and try again. If it fails, post your logs from log viewer when you are trying to establish VPN connection.

Pablo Bianchi
  • 15,657
UNIm95
  • 696
  • 7
  • 21
  • Thanks for your hint. These pakets are exactly what I'm using. Although they're not installed by default, they are something like the default pakets for L2TP on Ubuntu – jenald Nov 25 '19 at 11:31
  • And what are you using on 16.04? This plugins are not in 16.04 repository. – UNIm95 Nov 25 '19 at 12:27
0

I would recommend using network-manager-l2tp 1.2.16 from the following PPA, which is a backport from Debian Sid:

For backwards compatibility with most L2TP/IPsec VPN servers out there, network-manager-l2tp 1.2.16 no longer uses the strongSwan or libreswan default set of allowed algorithms, instead algorithms that are a merge of Windows 10 and macOS/iOS/iPadOS L2TP/IPsec clients' IKEv1 proposals are used instead for the default. The weakest proposals that were not common to both Win10 and iOS were dropped, but all of the strongest ones were kept.

More info in the "IPsec IKEv1 weak legacy algorithms and backwards compatibility" section near the end of the README.md file :

The version of strongSwan that shipped with Ubuntu 18.04 dropped all algorithms it considers broken from its default set of allowed algorithms, while the version that shipped with Ubuntu 16.04 still has most of them.

Douglas Kosovic
  • 721
  • Consequently you shouldn't need to fill in the Phase 1 & 2 algorithms anymore in the IPsec Options dialog box if your VPN server is using "broken" algorithms. – Douglas Kosovic Nov 25 '19 at 22:15
0

Another alternative that worked in my case is to use the command-line Cisco client VPNC.

I was connecting to the L2TP/IPsec VPN of my organization on Ubuntu 18.04, and other methods such as installing network manager plugins didn't work. Hope it might work for you as well.

  1. Install: sudo apt install vpnc
  2. Configure: Edit the /etc/vpnc/default.conf
  3. Connect: sudo vpnc --local-port 0
  4. Disconnect: sudo vpnc-disconnect

For configuration:

IPSec gateway <gateway> 
IPSec ID <group-id>
IPSec secret <group-psk>
IKE Authmode hybrid
Xauth username <username>
Xauth password <password>

Points to note:

  • I made up the IPSec ID and commented out the IKE Authmode as it is by default, and it still works.
  • To connect, just sudo vpnc or sudo vpnc-connect may work, but the port binding error may occur.

Here is a page for reference: https://www.lullabot.com/articles/using-vpnc-as-a-command-line-vpn-client

Claire
  • 148
  • 6