Не поднимается соединение l2tp+ipsec

[sunny1983]

Не получалось поднять соединение l2tp+ipsec. Решил, чтобы не мучаться, сначала попробовать поднять l2tp+ipsec в том дистрибутиве, в котором оно работает из коробки, а потом перенести. Поставил на виртуалку Ubuntu, настроил l2tp+ipsec в network-manager - поднялось, network-manager сформировал следующие конфиги:
/var/run/nm-l2tp-c5f29679-a00e-48eb-a077-b6f6e996fae3/ipsec.conf
/etc/ipsec.d/ipsec.nm-l2tp.secrets
/var/run/nm-l2tp-c5f29679-a00e-48eb-a077-b6f6e996fae3/xl2tpd.conf
/var/run/nm-l2tp-c5f29679-a00e-48eb-a077-b6f6e996fae3/ppp-options

Скопировал их содержимое в:
/etc/ipsec.conf
/etc/ipsec.secrets
/etc/xl2tpd/xl2tpd.conf
/etc/ipsec.conf
/etc/ppp/options.l2tp
затем отключил автозагрузку network-manager, перезагрузился и пытаюсь поднять соединение l2tp+ipsec вручную
Включена автозагрузка юнитов strongswan.service и xl2tpd.service, реализующих соединения ipsec и l2tp соответственно

Содержимое конфигов:
/etc/ipsec.conf (в нём я заменил значение опции auto, чтобы ipsec-тоннель поднимался при загрузке)

Код: Выделить всё

config setup

conn sp??????
  auto=start
  type=transport
  authby=secret
  left=%defaultroute
  right=178.215.???.???
  rightid=%any
  rightprotoport=udp/l2tp
  keyingtries=%forever
  ike=aes256-sha2_256-modp2048,aes256-sha2_256-modp1536,aes256-sha2_256-modp1024,aes256-sha1-modp2048,aes256-sha1-modp1536,aes256-sha1-modp1024,aes256-sha1-ecp384,aes128-sha1-modp1024,aes128-sha1-ecp256,3des-sha1-modp2048,3des-sha1-modp1024!
  esp=aes256-sha1,aes128-sha1,3des-sha1!
  keyexchange=ikev1

/etc/ipsec.secrets

Код: Выделить всё

: PSK 0sUk??????

/etc/xl2tpd/xl2tpd.conf

Код: Выделить всё

[global]
access control = yes
port = 0

[lac l2tp]
lns = 178.215.???.???
pppoptfile = /etc/ppp/options.l2tp
autodial = yes
redial = yes
tunnel rws = 8
tx bps = 100000000
rx bps = 100000000

/etc/ppp/options.l2tp (из него я убрал опцию «plugin /usr/lib/pppd/2.4.7/nm-l2tp-pppd-plugin.so» поскольку network-manager не используется и добавил require-mschap-v2 и name):

Код: Выделить всё

nodetach
usepeerdns
noipdefault
nodefaultroute
noauth
noccp
lcp-echo-failure 0
lcp-echo-interval 0
mru 1400
mtu 1400
require-mschap-v2
name sto??????

/etc/ppp/chap-secrets

Код: Выделить всё

sto??????    *       "Sho??????"              *

Соединение не поднимается. В journalctl следующее:

Код: Выделить всё

апр 19 16:21:07 cmp2 xl2tpd[894]: Not looking for kernel SAref support.
апр 19 16:21:07 cmp2 xl2tpd[894]: Using l2tp kernel support.
апр 19 16:21:07 cmp2 xl2tpd[869]: Starting xl2tpd: xl2tpd.
апр 19 16:21:07 cmp2 xl2tpd[905]: xl2tpd version xl2tpd-1.3.6 started on cmp2 PID:905
апр 19 16:21:07 cmp2 xl2tpd[905]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc.
апр 19 16:21:07 cmp2 xl2tpd[905]: Forked by Scott Balmos and David Stipp, (C) 2001
апр 19 16:21:07 cmp2 xl2tpd[905]: Inherited by Jeff McAdams, (C) 2002
апр 19 16:21:07 cmp2 xl2tpd[905]: Forked again by Xelerance (www.xelerance.com) (C) 2006
апр 19 16:21:07 cmp2 xl2tpd[905]: Listening on IP address 0.0.0.0, port 59756
апр 19 16:21:07 cmp2 xl2tpd[905]: Connecting to host 178.215.???.???, port 1701
апр 19 16:21:07 cmp2 xl2tpd[905]: Connection established to 178.215.???.???, 1701.  Local: 64445, Remote: 6635 (ref=0/0).
апр 19 16:21:07 cmp2 xl2tpd[905]: Calling on tunnel 64445
апр 19 16:21:07 cmp2 xl2tpd[905]: Call established with 178.215.???.???, Local: 5722, Remote: 1, Serial: 1 (ref=0/0)
апр 19 16:21:07 cmp2 xl2tpd[905]: start_pppd: I'm running:
апр 19 16:21:07 cmp2 xl2tpd[905]: "/usr/sbin/pppd"
апр 19 16:21:07 cmp2 xl2tpd[905]: "passive"
апр 19 16:21:07 cmp2 xl2tpd[905]: "nodetach"
апр 19 16:21:07 cmp2 xl2tpd[905]: ":"
апр 19 16:21:07 cmp2 xl2tpd[905]: "file"
апр 19 16:21:07 cmp2 xl2tpd[905]: "/etc/ppp/options.l2tp"
апр 19 16:21:07 cmp2 xl2tpd[905]: "plugin"
апр 19 16:21:07 cmp2 xl2tpd[905]: "pppol2tp.so"
апр 19 16:21:07 cmp2 xl2tpd[905]: "pppol2tp"
апр 19 16:21:07 cmp2 xl2tpd[905]: "8"
апр 19 16:21:07 cmp2 xl2tpd[905]: result_code_avp: avp is incorrect size.  8 < 10
апр 19 16:21:07 cmp2 xl2tpd[905]: handle_avps: Bad exit status handling attribute 1 (Result Code) on mandatory packet.
апр 19 16:21:07 cmp2 xl2tpd[905]: call_close: Call 5722 to 178.215.???.??? disconnected
апр 19 16:21:07 cmp2 xl2tpd[905]: result_code_avp: avp is incorrect size.  8 < 10
апр 19 16:21:07 cmp2 xl2tpd[905]: handle_avps: Bad exit status handling attribute 1 (Result Code) on mandatory packet.
апр 19 16:21:07 cmp2 xl2tpd[905]: Terminating pppd: sending TERM signal to pid 907
апр 19 16:21:07 cmp2 xl2tpd[905]: Connection 6635 closed to 178.215.???.???, port 1701 (Result Code: expected at least 10, got 8)
апр 19 16:21:07 cmp2 ipsec_starter[880]: Starting strongSwan 5.3.5 IPsec [starter]...
апр 19 16:21:07 cmp2 charon[940]: 00[DMN] Starting IKE charon daemon (strongSwan 5.3.5, Linux 4.15.0-142-generic, x86_64)
апр 19 16:21:07 cmp2 charon[940]: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
апр 19 16:21:07 cmp2 charon[940]: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
апр 19 16:21:07 cmp2 charon[940]: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
апр 19 16:21:07 cmp2 charon[940]: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
апр 19 16:21:07 cmp2 charon[940]: 00[CFG] loading crls from '/etc/ipsec.d/crls'
апр 19 16:21:07 cmp2 charon[940]: 00[CFG] loading secrets from '/etc/ipsec.secrets'
апр 19 16:21:07 cmp2 charon[940]: 00[CFG]   loaded IKE secret for %any
апр 19 16:21:07 cmp2 charon[940]: 00[CFG] expanding file expression '/etc/ipsec.d/ipsec.nm-l2tp.secrets' failed
апр 19 16:21:07 cmp2 charon[940]: 00[LIB] loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown
апр 19 16:21:07 cmp2 charon[940]: 00[LIB] dropped capabilities, running as uid 0, gid 0
апр 19 16:21:07 cmp2 charon[940]: 00[JOB] spawning 16 worker threads
апр 19 16:21:07 cmp2 ipsec_starter[937]: charon (940) started after 40 ms
апр 19 16:21:07 cmp2 charon[940]: 11[CFG] received stroke: add connection 'sp??????'
апр 19 16:21:07 cmp2 charon[940]: 11[CFG] added configuration 'sp??????'
апр 19 16:21:07 cmp2 charon[940]: 13[CFG] received stroke: initiate 'sp??????'
апр 19 16:21:07 cmp2 charon[940]: 13[IKE] initiating Main Mode IKE_SA sp??????[1] to 178.215.???.???
апр 19 16:21:07 cmp2 charon[940]: 13[IKE] initiating Main Mode IKE_SA sp??????[1] to 178.215.???.???
апр 19 16:21:07 cmp2 charon[940]: 13[ENC] generating ID_PROT request 0 [ SA V V V V ]
апр 19 16:21:07 cmp2 charon[940]: 13[NET] sending packet: from 192.168.68.10[500] to 178.215.???.???[500] (508 bytes)
апр 19 16:21:07 cmp2 charon[940]: 06[NET] received packet: from 178.215.???.???[500] to 192.168.68.10[500] (136 bytes)
апр 19 16:21:07 cmp2 charon[940]: 06[ENC] parsed ID_PROT response 0 [ SA V V V ]
апр 19 16:21:07 cmp2 charon[940]: 06[IKE] received NAT-T (RFC 3947) vendor ID
апр 19 16:21:07 cmp2 charon[940]: 06[IKE] received XAuth vendor ID
апр 19 16:21:07 cmp2 charon[940]: 06[IKE] received DPD vendor ID
апр 19 16:21:07 cmp2 charon[940]: 06[ENC] generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
апр 19 16:21:07 cmp2 charon[940]: 06[NET] sending packet: from 192.168.68.10[500] to 178.215.???.???[500] (372 bytes)
апр 19 16:21:07 cmp2 charon[940]: 15[NET] received packet: from 178.215.???.???[500] to 192.168.68.10[500] (364 bytes)
апр 19 16:21:07 cmp2 charon[940]: 15[ENC] parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]
апр 19 16:21:07 cmp2 charon[940]: 15[IKE] local host is behind NAT, sending keep alives
апр 19 16:21:07 cmp2 charon[940]: 15[ENC] generating ID_PROT request 0 [ ID HASH ]
апр 19 16:21:07 cmp2 charon[940]: 15[NET] sending packet: from 192.168.68.10[4500] to 178.215.???.???[4500] (76 bytes)
апр 19 16:21:07 cmp2 charon[940]: 16[NET] received packet: from 178.215.???.???[4500] to 192.168.68.10[4500] (76 bytes)
апр 19 16:21:07 cmp2 charon[940]: 16[ENC] parsed ID_PROT response 0 [ ID HASH ]
апр 19 16:21:07 cmp2 charon[940]: 16[IKE] IKE_SA sp??????[1] established between 192.168.68.10[192.168.68.10]...178.215.???.???[178.215.???.???]
апр 19 16:21:07 cmp2 charon[940]: 16[IKE] IKE_SA sp??????[1] established between 192.168.68.10[192.168.68.10]...178.215.???.???[178.215.???.???]
апр 19 16:21:07 cmp2 charon[940]: 16[IKE] scheduling reauthentication in 9988s
апр 19 16:21:07 cmp2 charon[940]: 16[IKE] maximum IKE_SA lifetime 10528s
апр 19 16:21:07 cmp2 charon[940]: 16[ENC] generating QUICK_MODE request 3057299808 [ HASH SA No ID ID NAT-OA NAT-OA ]
апр 19 16:21:07 cmp2 charon[940]: 16[NET] sending packet: from 192.168.68.10[4500] to 178.215.???.???[4500] (252 bytes)
апр 19 16:21:07 cmp2 charon[940]: 05[NET] received packet: from 178.215.???.???[4500] to 192.168.68.10[4500] (188 bytes)
апр 19 16:21:07 cmp2 charon[940]: 05[ENC] parsed QUICK_MODE response 3057299808 [ HASH SA No ID ID NAT-OA NAT-OA ]
апр 19 16:21:07 cmp2 charon[940]: 05[IKE] CHILD_SA sp??????{1} established with SPIs c3048072_i 00d1f11b_o and TS 192.168.68.10/32 === 178.215.???.???/32[udp/l2f]
апр 19 16:21:07 cmp2 charon[940]: 05[IKE] CHILD_SA sp??????{1} established with SPIs c3048072_i 00d1f11b_o and TS 192.168.68.10/32 === 178.215.???.???/32[udp/l2f]
апр 19 16:21:07 cmp2 charon[940]: 05[ENC] generating QUICK_MODE request 3057299808 [ HASH ]
апр 19 16:21:07 cmp2 charon[940]: 05[NET] sending packet: from 192.168.68.10[4500] to 178.215.???.???[4500] (60 bytes)
апр 19 16:21:31 cmp2 charon[940]: 14[IKE] sending keep alive to 178.215.???.???[4500]
апр 19 16:21:36 cmp2 charon[940]: 11[IKE] sending DPD request
апр 19 16:21:36 cmp2 charon[940]: 11[ENC] generating INFORMATIONAL_V1 request 706600681 [ HASH N(DPD) ]
апр 19 16:21:36 cmp2 charon[940]: 11[NET] sending packet: from 192.168.68.10[4500] to 178.215.???.???[4500] (92 bytes)
апр 19 16:21:36 cmp2 charon[940]: 13[NET] received packet: from 178.215.???.???[4500] to 192.168.68.10[4500] (92 bytes)
апр 19 16:21:36 cmp2 charon[940]: 13[ENC] parsed INFORMATIONAL_V1 request 4232365515 [ HASH N(DPD_ACK) ]
апр 19 16:21:37 cmp2 xl2tpd[905]: Connecting to host 178.215.???.???, port 1701
апр 19 16:21:37 cmp2 xl2tpd[905]: Connection established to 178.215.???.???, 1701.  Local: 5468, Remote: 6636 (ref=0/0).
апр 19 16:21:37 cmp2 xl2tpd[905]: Calling on tunnel 5468
апр 19 16:21:37 cmp2 xl2tpd[905]: Call established with 178.215.???.???, Local: 23722, Remote: 1, Serial: 2 (ref=0/0)
апр 19 16:21:37 cmp2 xl2tpd[905]: start_pppd: I'm running:
апр 19 16:21:37 cmp2 xl2tpd[905]: "/usr/sbin/pppd"
апр 19 16:21:37 cmp2 xl2tpd[905]: "passive"
апр 19 16:21:37 cmp2 xl2tpd[905]: "nodetach"
апр 19 16:21:37 cmp2 xl2tpd[905]: ":"
апр 19 16:21:37 cmp2 xl2tpd[905]: "file"
апр 19 16:21:37 cmp2 xl2tpd[905]: "/etc/ppp/options.l2tp"
апр 19 16:21:37 cmp2 xl2tpd[905]: "plugin"
апр 19 16:21:37 cmp2 xl2tpd[905]: "pppol2tp.so"
апр 19 16:21:37 cmp2 xl2tpd[905]: "pppol2tp"
апр 19 16:21:37 cmp2 xl2tpd[905]: "8"
апр 19 16:21:37 cmp2 pppd[991]: Plugin pppol2tp.so loaded.
апр 19 16:21:37 cmp2 pppd[991]: pppd 2.4.7 started by root, uid 0
апр 19 16:21:37 cmp2 pppd[991]: Using interface ppp0
апр 19 16:21:37 cmp2 pppd[991]: Connect: ppp0 <-->
апр 19 16:21:37 cmp2 pppd[991]: Overriding mtu 1500 to 1400
апр 19 16:21:37 cmp2 pppd[991]: Overriding mru 1500 to mtu value 1400
апр 19 16:21:37 cmp2 pppd[991]: peer refused to authenticate: terminating link
апр 19 16:21:37 cmp2 pppd[991]: Overriding mtu 1500 to 1400
апр 19 16:21:37 cmp2 pppd[991]: Overriding mru 1500 to mtu value 1400
апр 19 16:21:37 cmp2 pppd[991]: Connection terminated.
апр 19 16:21:37 cmp2 xl2tpd[905]: result_code_avp: avp is incorrect size.  8 < 10
апр 19 16:21:37 cmp2 xl2tpd[905]: handle_avps: Bad exit status handling attribute 1 (Result Code) on mandatory packet.
апр 19 16:21:37 cmp2 xl2tpd[905]: call_close: Call 23722 to 178.215.???.??? disconnected
апр 19 16:21:37 cmp2 charon[940]: 04[KNL] interface ppp0 deleted
апр 19 16:21:37 cmp2 xl2tpd[905]: result_code_avp: avp is incorrect size.  8 < 10
апр 19 16:21:37 cmp2 xl2tpd[905]: handle_avps: Bad exit status handling attribute 1 (Result Code) on mandatory packet.
апр 19 16:21:37 cmp2 xl2tpd[905]: Terminating pppd: sending TERM signal to pid 991
апр 19 16:21:37 cmp2 xl2tpd[905]: Connection 6636 closed to 178.215.???.???, port 1701 (Result Code: expected at least 10, got 8)
апр 19 16:21:37 cmp2 pppd[991]: Exit.
апр 19 16:21:57 cmp2 charon[940]: 12[IKE] sending keep alive to 178.215.???.???[4500]
апр 19 16:22:07 cmp2 xl2tpd[905]: Connecting to host 178.215.???.???, port 1701
апр 19 16:22:07 cmp2 xl2tpd[905]: Connection established to 178.215.???.???, 1701.  Local: 44009, Remote: 6637 (ref=0/0).
апр 19 16:22:07 cmp2 xl2tpd[905]: Calling on tunnel 44009
апр 19 16:22:07 cmp2 xl2tpd[905]: Call established with 178.215.???.???, Local: 2559, Remote: 1, Serial: 3 (ref=0/0)
апр 19 16:22:07 cmp2 xl2tpd[905]: start_pppd: I'm running:
апр 19 16:22:07 cmp2 xl2tpd[905]: "/usr/sbin/pppd"
апр 19 16:22:07 cmp2 xl2tpd[905]: "passive"
апр 19 16:22:07 cmp2 xl2tpd[905]: "nodetach"
апр 19 16:22:07 cmp2 xl2tpd[905]: ":"
апр 19 16:22:07 cmp2 xl2tpd[905]: "file"
апр 19 16:22:07 cmp2 xl2tpd[905]: "/etc/ppp/options.l2tp"
апр 19 16:22:07 cmp2 xl2tpd[905]: "plugin"
апр 19 16:22:07 cmp2 xl2tpd[905]: "pppol2tp.so"
апр 19 16:22:07 cmp2 xl2tpd[905]: "pppol2tp"
апр 19 16:22:07 cmp2 xl2tpd[905]: "8"
апр 19 16:22:07 cmp2 pppd[1005]: Plugin pppol2tp.so loaded.
апр 19 16:22:07 cmp2 pppd[1005]: pppd 2.4.7 started by root, uid 0
апр 19 16:22:07 cmp2 pppd[1005]: Using interface ppp0
апр 19 16:22:07 cmp2 pppd[1005]: Connect: ppp0 <-->
апр 19 16:22:07 cmp2 pppd[1005]: Overriding mtu 1500 to 1400
апр 19 16:22:07 cmp2 pppd[1005]: Overriding mru 1500 to mtu value 1400
апр 19 16:22:07 cmp2 pppd[1005]: peer refused to authenticate: terminating link
апр 19 16:22:07 cmp2 pppd[1005]: Overriding mtu 1500 to 1400
апр 19 16:22:07 cmp2 pppd[1005]: Overriding mru 1500 to mtu value 1400
апр 19 16:22:07 cmp2 pppd[1005]: Connection terminated.
апр 19 16:22:07 cmp2 xl2tpd[905]: result_code_avp: avp is incorrect size.  8 < 10
апр 19 16:22:07 cmp2 xl2tpd[905]: handle_avps: Bad exit status handling attribute 1 (Result Code) on mandatory packet.
апр 19 16:22:07 cmp2 xl2tpd[905]: call_close: Call 2559 to 178.215.???.??? disconnected
апр 19 16:22:07 cmp2 charon[940]: 16[KNL] interface ppp0 deleted
апр 19 16:22:07 cmp2 xl2tpd[905]: result_code_avp: avp is incorrect size.  8 < 10
апр 19 16:22:07 cmp2 xl2tpd[905]: handle_avps: Bad exit status handling attribute 1 (Result Code) on mandatory packet.
апр 19 16:22:07 cmp2 xl2tpd[905]: Terminating pppd: sending TERM signal to pid 1005
апр 19 16:22:07 cmp2 xl2tpd[905]: Connection 6637 closed to 178.215.???.???, port 1701 (Result Code: expected at least 10, got 8)
апр 19 16:22:07 cmp2 pppd[1005]: Exit.

[sunny1983]

Нашёл ошибку сам, она в файле /etc/ppp/options.l2tp, это конфиг для демона pppd и опция require-mschap-v2 в нём лишняя, она нужна только для сервера, если её прописать на клиента, то клиент будет пытаться авторизовать сервер. Убрал опцию и всё заработало.