Hi @misc,
I have a box with relatively fresh install of 68/amd64, fully syspatched. There
is a npppd server running on it. The problem is that I can have only one nppp
session at one time. If the second vpn user connects the box, the first nppp
session hangs/drops. I probably have missed something obvious in my setup but I
really can't find what it is.
Please help me to solve the problem.
Thank you.
$cat /etc/npppd/npppd.conf
authentication LOCAL type local {
users-file "/etc/npppd/npppd-users"
}
tunnel L2TP protocol l2tp {
listen on X.Y.Z.13
}
ipcp IPCP {
pool-address 10.109.4.1-10.109.4.32
dns-servers 1.1.1.1
}
# use pppx(4) interface. use an interface per a ppp session.
interface pppx0 address 10.109.4.254 ipcp IPCP
bind tunnel from L2TP authenticated by LOCAL to pppx0
$cat /etc/hostname.enc0
up
$cat /etc/sysctl.conf
net.inet.ip.forwarding=1
net.inet.ipcomp.enable=1
net.inet.esp.enable=1
net.inet.gre.allow=1
net.pipex.enable=1
$cat /etc/rc.conf.local
ipsec=YES
ipsec_rules=/etc/ipsec.conf
isakmpd_flags="-K"
npppd_flags=""
$cat /etc/ipsec.conf
wan_ipv4 = X.Y.Z.13
ike passive esp transport \
proto udp from $wan_ipv4 to any port 1701 \
main auth "hmac-sha1" enc "3des" group modp1024 \
quick auth "hmac-sha1" enc "aes" group modp1024 \
psk "pskpskpsk"
$cat /etc/pf.conf
[...]
vpn_if = "pppx"
vpn_local = "10.109.4.0/24"
pass in on $ext_if proto udp from any to (egress:0) port
{isakmp,ipsec-nat-t,l2tp}
pass in on $ext_if proto {ah,esp}
pass log proto { gre } from any to any keep state
# filter all IPSec traffic on the enc interface
pass on enc0 keep state (if-bound)
# allow all trafic in on and out to the VPN network
pass on $vpn_if from $vpn_local
pass on $vpn_if to $vpn_local
# NAT VPN traffic going out on the public interface with the public IP
match out log on $ext_if inet proto { tcp, udp, icmp } from $vpn_local nat-to
($ext_if) set prio (3,7)
some logs...
Jan 6 20:53:14 fw-u last message repeated 4 times
Jan 6 20:53:16 fw-u isakmpd[11638]: attribute_unacceptable:
ENCRYPTION_ALGORITHM: got AES_CBC, expected 3DES_CBC
Jan 6 20:53:16 fw-u last message repeated 2 times
Jan 6 20:53:16 fw-u isakmpd[11638]: attribute_unacceptable: GROUP_DESCRIPTION:
got MODP_2048, expected MODP_1024
Jan 6 20:53:16 fw-u npppd[82720]: l2tpd ctrl=1 logtype=Started RecvSCCRQ
from=A.B.C.D:1701/udp tunnel_id=1/26 protocol=1.0 winsize=8 hostname=w520
vendor=Microsoft firm=0601
Jan 6 20:53:16 fw-u npppd[82720]: l2tpd ctrl=1 SendSCCRP
Jan 6 20:53:16 fw-u npppd[82720]: l2tpd ctrl=1 RecvSCCN
Jan 6 20:53:16 fw-u npppd[82720]: l2tpd ctrl=1 SendZLB
Jan 6 20:53:16 fw-u npppd[82720]: l2tpd ctrl=1 RecvZLB
Jan 6 20:53:16 fw-u npppd[82720]: l2tpd ctrl=1 call=6499 RecvICRQ session_id=1
Jan 6 20:53:16 fw-u npppd[82720]: l2tpd ctrl=1 call=6499 SendICRP
session_id=6499
Jan 6 20:53:16 fw-u npppd[82720]: l2tpd ctrl=1 call=6499 RecvICCN session_id=1
calling_number= tx_conn_speed=100000000 framing=sync
Jan 6 20:53:16 fw-u npppd[82720]: l2tpd ctrl=1 call=6499 logtype=PPPBind ppp=0
Jan 6 20:53:16 fw-u npppd[82720]: ppp id=0 layer=base logtype=Started
tunnel=L2TP(A.B.C.D:1701)
Jan 6 20:53:16 fw-u npppd[82720]: l2tpd ctrl=1 call=6499 SendZLB
Jan 6 20:53:16 fw-u npppd[82720]: ppp id=0 layer=lcp logtype=Opened
mru=1360/1400 auth=MS-CHAP-V2 magic=e916be4d/3c630a24
Jan 6 20:53:16 fw-u npppd[82720]: ppp id=0 layer=lcp RecvId magic=3c630a24
text=MSRASV5.20
Jan 6 20:53:16 fw-u npppd[82720]: ppp id=0 layer=lcp RecvId magic=3c630a24
text=MSRAS-0-W520
Jan 6 20:53:16 fw-u npppd[82720]: ppp id=0 layer=lcp RecvId magic=3c630a24
text=.=. .`.M........
Jan 6 20:53:16 fw-u npppd[82720]: ppp id=0 layer=chap proto=mschap_v2
logtype=Success username="rdk" realm=LOCAL
Jan 6 20:53:16 fw-u npppd[82720]: ppp id=0 layer=mppe mismatch
our=40bit,128bit,56bit,stateless peer=stateless
Jan 6 20:53:16 fw-u npppd[82720]: ppp id=0 layer=ipcp IP Address peer=0.0.0.0
our=10.109.4.1.
Jan 6 20:53:16 fw-u npppd[82720]: ppp id=0 layer=ipcp logtype=Opened
ip=10.109.4.1 assignType=dynamic
Jan 6 20:53:16 fw-u npppd[82720]: ppp id=0 layer=base logtype=TUNNELSTART
user="rdk" duration=1sec layer2=L2TP layer2from=A.B.C.D:1701 auth=MS-CHAP-V2
ip=10.109.4.1 iface=pppx0
Jan 6 20:53:16 fw-u npppd[82720]: ppp id=0 layer=mppe logtype=Opened
our=128bit,stateless peer=128bit,stateless
Jan 6 20:53:16 fw-u npppd[82720]: ppp id=0 layer=base Using pipex=yes
Jan 6 20:53:43 fw-u isakmpd[11638]: attribute_unacceptable:
ENCRYPTION_ALGORITHM: got AES_CBC, expected 3DES_CBC
Jan 6 20:53:43 fw-u last message repeated 2 times
Jan 6 20:53:43 fw-u isakmpd[11638]: attribute_unacceptable: GROUP_DESCRIPTION:
got MODP_2048, expected MODP_1024
Jan 6 20:53:44 fw-u npppd[82720]: l2tpd ctrl=2 logtype=Started RecvSCCRQ
from=A.B.C.D:1701/udp tunnel_id=2/20 protocol=1.0 winsize=8 hostname=x
vendor=Microsoft firm=0601
Jan 6 20:53:44 fw-u npppd[82720]: l2tpd ctrl=2 SendSCCRP
Jan 6 20:53:44 fw-u npppd[82720]: l2tpd ctrl=2 RecvSCCN
Jan 6 20:53:44 fw-u npppd[82720]: l2tpd ctrl=2 SendZLB
Jan 6 20:53:44 fw-u npppd[82720]: l2tpd ctrl=2 RecvZLB
Jan 6 20:53:44 fw-u npppd[82720]: l2tpd ctrl=2 call=11788 RecvICRQ session_id=1
Jan 6 20:53:44 fw-u npppd[82720]: l2tpd ctrl=2 call=11788 SendICRP
session_id=11788
Jan 6 20:53:44 fw-u npppd[82720]: l2tpd ctrl=2 call=11788 RecvICCN
session_id=1 calling_number= tx_conn_speed=100000000 framing=sync
Jan 6 20:53:44 fw-u npppd[82720]: l2tpd ctrl=2 call=11788 logtype=PPPBind ppp=1
Jan 6 20:53:44 fw-u npppd[82720]: ppp id=1 layer=base logtype=Started
tunnel=L2TP(A.B.C.D:1701)
Jan 6 20:53:44 fw-u npppd[82720]: l2tpd ctrl=2 call=11788 SendZLB
Jan 6 20:53:44 fw-u npppd[82720]: l2tpd ctrl=2 RecvZLB
Jan 6 20:53:44 fw-u npppd[82720]: ppp id=1 layer=lcp logtype=Opened
mru=1360/1400 auth=MS-CHAP-V2 magic=9699e1a6/244d01eb
Jan 6 20:53:44 fw-u npppd[82720]: ppp id=1 layer=lcp RecvId magic=244d01eb
text=MSRASV5.20
Jan 6 20:53:44 fw-u npppd[82720]: ppp id=1 layer=lcp RecvId magic=244d01eb
text=MSRAS-0-X
Jan 6 20:53:44 fw-u npppd[82720]: ppp id=1 layer=lcp RecvId magic=244d01eb
text=.*.(...N.....Z68
Jan 6 20:53:44 fw-u npppd[82720]: ppp id=1 layer=chap proto=mschap_v2
logtype=Success username="rdk-test" realm=LOCAL
Jan 6 20:53:44 fw-u npppd[82720]: ppp id=1 layer=mppe mismatch
our=40bit,128bit,56bit,stateless peer=stateless
Jan 6 20:53:44 fw-u npppd[82720]: ppp id=1 layer=ipcp IP Address peer=0.0.0.0
our=10.109.4.11.
Jan 6 20:53:44 fw-u npppd[82720]: ppp id=1 layer=ipcp logtype=Opened
ip=10.109.4.11 assignType=dynamic
Jan 6 20:53:44 fw-u npppd[82720]: ppp id=1 layer=base logtype=TUNNELSTART
user="rdk-test" duration=1sec layer2=L2TP layer2from=A.B.C.D:1701
auth=MS-CHAP-V2 ip=10.109.4.11 iface=pppx0
Jan 6 20:53:44 fw-u npppd[82720]: ppp id=1 layer=mppe logtype=Opened
our=128bit,stateless peer=128bit,stateless
Jan 6 20:53:44 fw-u npppd[82720]: ppp id=1 layer=base Using pipex=yes
--
Radek
