Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm trying to set an L2TP/IPsec VPN. I have installed openswan from the repository on Ubuntu 13.04

Section: universe/net
Architecture: amd64
Version: 1:2.6.38-1

and configured it following the community docs.

# cat /etc/ipsec.conf 
config setup
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.168.23.0/24
    oe=off
    protostack=netkey

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    # Apple iOS doesn't send delete notify so we need dead peer detection
    # to detect vanishing clients
    dpddelay=30
    dpdtimeout=120
    dpdaction=clear
    # Set ikelifetime and keylife to same defaults windows has
    ikelifetime=8h
    keylife=1h
    type=transport
    # Replace IP address with your local IP (private, behind NAT IP is okay as well)
    left=my.ip
    # For updated Windows 2000/XP clients,
    # to support old clients as well, use leftprotoport=17/%any
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any
    #force all to be nat'ed. because of iOS
    forceencaps=yes

It starts fine but fails the verification

# ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.38/K3.8.0-29-generic (netkey)
Checking for IPsec support in kernel                            [OK]
 SAref kernel support                                           [N/A]
 NETKEY:  Testing XFRM related proc values                      [OK]
[OK]
[OK]
Checking that pluto is running                                  [OK]
 Pluto listening for IKE on udp 500                             [OK]
 Pluto listening for NAT-T on udp 4500                          [OK]
Two or more interfaces found, checking IP forwarding            [FAILED]
Checking NAT and MASQUERADEing                                  [OK]
Checking for 'ip' command                                       [OK]
Checking /bin/sh is not /bin/dash                               [OK]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support                                [DISABLED]

even though forwarding seems to be enabled

# cat /proc/sys/net/ipv4/ip_forward
1

What's wrong and how do I fix it?

share|improve this question
    
Did you ever fix this? –  Will Gunn Oct 4 at 17:42
    
@WillGunn No. I ditched IPsec in favour of OpenVPN. OpenVPN is supported well through VPN API starting with Android 4.something. I remember that IPsec kinda worked on 12.04 though. –  Damn Terminal Nov 6 at 13:48

1 Answer 1

Stumbled over this while looking up the error :

I think this is the answer :

https://lists.openswan.org/pipermail/users/2009-September/017423.html

I have just upgraded to 2.6.23 and run ipsec verify and I get an unexpected error: Two or more interfaces found, checking IP forwarding [FAILED]

cat /proc/sys/net/ipv4/ip_forward gives 1 so I am confused.

If it helps eth0 is my WAN, eth1 is my normal LAN, eth1:0 is a virtual IP on eth1 to get round a problem I have been having with running Openswan on a combined gateway/file server, and eth2 is a second, unused LAN adaptor.

Then you can ignore it. It's a warning when running a subnet-subnet or subnet-host tunnel on the subnet side, where you need forwarding to go from the public side (internet) to the lan.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.