I cannot for the life of me get L2TP w/ IPSec working. I've read all the wiki docs and almost all of the forum threads by those with similar issues and still cannot get it working.
I am trying to setup VPN access to connect from my MacBook Pro laptop to RB500, running latest ROS 3.22 (so NOT router to router like most of the docs describe). MacBook is running OS X 10.5 which supports L2TP/IPSec out of the box.
Enabled L2TP Server:
Code: Select all
/interface l2tp-server server> export
# mar/19/2009 19:57:04 by RouterOS 3.22
# software id = xxxxxxx
#
/interface l2tp-server server
set authentication=pap,chap,mschap1,mschap2 default-profile=default-encryption enabled=yes max-mru=1460 max-mtu=1460 \
mrru=disabled
Added PPP secret:
Code: Select all
/ppp secret> export
# mar/19/2009 19:54:10 by RouterOS 3.22
# software id = xxxxxx
#
/ppp secret
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 local-address=192.168.1.160 name=stroob \
password=****** profile=default-encryption remote-address=192.168.1.161 routes="" service=l2tp
Added IPSec peer:
Code: Select all
/ip ipsec peer> export
# mar/19/2009 19:55:39 by RouterOS 3.22
# software id = xxxxxxx
#
/ip ipsec peer
add address=0.0.0.0/32:500 auth-method=pre-shared-key dh-group=modp1024 disabled=no dpd-interval=disable-dpd \
dpd-maximum-failures=1 enc-algorithm=3des exchange-mode=main generate-policy=yes hash-algorithm=sha1 lifebytes=0 \
lifetime=1d nat-traversal=no proposal-check=obey secret=****** send-initial-contact=yes
Another question is how can I see debug-level info about this connection in ROS? I'd probably be able to figure it out if I could get this info. I added a logging rule for topics "l2tp, ipsec, ppp" with action "memory" but I don't see output in the log window.
Code: Select all
Firewall rules:
# mar/19/2009 17:45:32 by RouterOS 3.22
# software id = xxxxxxx
#
/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s tcp-close-wait-timeout=10s \
tcp-established-timeout=1d tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s tcp-syn-received-timeout=5s \
tcp-syn-sent-timeout=5s tcp-syncookie=no tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall filter
add action=drop chain=input comment="Drop invalid connections" connection-state=invalid disabled=no
add action=accept chain=input comment="Allow already-established connections" connection-state=established disabled=no
add action=accept chain=input comment="Allow UDP" disabled=no protocol=udp
add action=accept chain=input comment="Allow ICMP" disabled=no protocol=icmp
add action=accept chain=input comment="Allow access from LAN" disabled=no src-address=192.168.1.0/24
add action=drop chain=input comment="Drop everything else" disabled=no
add action=drop chain=forward comment="Drop invalid connections" connection-state=invalid disabled=no
add action=accept chain=foward comment="Allow already-established connections" connection-state=established disabled=no
add action=drop chain=forward comment="Drop bogons" disabled=no src-address=0.0.0.0/8
add action=drop chain=forward comment="" disabled=no dst-address=0.0.0.0/8
add action=drop chain=forward comment="" disabled=no src-address=127.0.0.0/8
add action=drop chain=forward comment="" disabled=no dst-address=127.0.0.0/8
add action=drop chain=forward comment="" disabled=no src-address=224.0.0.0/3
add action=drop chain=forward comment="" disabled=no dst-address=224.0.0.0/3
/ip firewall nat
add action=masquerade chain=srcnat comment="" disabled=no out-interface=wan0
add action=dst-nat chain=dstnat comment=server1 disabled=no dst-port=922 in-interface=wan0 protocol=tcp to-addresses=\
192.168.1.150 to-ports=22
add action=dst-nat chain=dstnat comment=server2 disabled=no dst-port=924 in-interface=wan0 protocol=tcp to-addresses=\
192.168.2.3 to-ports=22
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no
- Any ideas on either setting up the VPN or why I cannot get any debug-level logging to try and troubleshoot myself? I'd just like to get some visibility as to what's going on and why it's failing. Thanks!
