24

I am looking for a solution in order to connect to a vpn l2tp ipsec server from my Xubuntu 16.04 pc. I used to have Xubuntu 14.04 and I could connect without any problems following these tutorials: https://www.elastichosts.com/blog/linux-l2tpipsec-vpn-client/ https://soeasytomakeitwork.wordpress.com/2014/05/02/set-up-a-l2tpipsec-vpn-connection-on-ubuntu-desktop/

Unfortunately Openswan package seems to be old and not available anymore. I've tried everything including everything from this page: How to connect to L2TP over IPSec VPN? but nothing woks. After some dependency packages failure with libctemplate2 I succeeded to install ipsec service but i got the following error when I'm trying to ipsec auto --up: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")

systemctl restart ipsec.service does not show any error but when I'm checking with status I got this:

root@Vapor:/usr/lib/ipsec# systemctl status ipsec.service
● ipsec.service - LSB: Start Openswan IPsec at boot time
   Loaded: loaded (/etc/init.d/ipsec; bad; vendor preset: enabled)
   Active: active (exited) since Lu 2016-06-20 21:23:33 EEST; 31s ago
     Docs: man:systemd-sysv-generator(8)
  Process: 14634 ExecStop=/etc/init.d/ipsec stop (code=exited, status=0/SUCCESS)
  Process: 14654 ExecStart=/etc/init.d/ipsec start (code=exited, status=0/SUCCESS)

iun 20 21:23:33 Vapor ipsec__plutorun[14776]:         [--nat_traversal] [--keep_alive <delay_sec>] \
iun 20 21:23:33 Vapor ipsec__plutorun[14776]:         [--force_keepalive] [--disable_port_floating] \
iun 20 21:23:33 Vapor ipsec__plutorun[14776]:         [--virtual_private <network_list>]
iun 20 21:23:33 Vapor ipsec__plutorun[14776]: Openswan 2.6.38
iun 20 21:23:33 Vapor ipsec__plutorun[14776]: pluto unexpectedly said `exit'
iun 20 21:23:33 Vapor ipsec__plutorun[14776]: pluto unexpectedly said `1'
iun 20 21:23:33 Vapor ipsec__plutorun[14776]: connect(pluto_ctl) failed: No such file or directory
iun 20 21:23:33 Vapor ipsec__plutorun[14776]: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
iun 20 21:23:33 Vapor ipsec__plutorun[14776]: pluto died without exit status!?!
iun 20 21:23:33 Vapor ipsec__plutorun[14776]: internal failure in pluto scripts, impossible to carry on
root@Vapor:/usr/lib/ipsec# 

I've never thought that this can be so difficult. I've read that the ipsec Openswan was replaced by Strongswan but I don't understand what I have to do in order to connect to a L2tp IPSEC server using a preshared key. The server I am talking about is hardware built in.

This start to be extremely annoying and I'm thinking to go back to some previous versions of ubuntu.

This shouldn't be happening in an LTS version.

Any help will be very much appreciated. Even a fresh idea, different software, whatever, doesn't matter what, I want to make it work!!!

1

5 Answers 5

27

You can use

sudo add-apt-repository ppa:nm-l2tp/network-manager-l2tp  
sudo apt-get update  
sudo apt-get install network-manager-l2tp
sudo apt-get install network-manager-l2tp-gnome

To install the network manager l2tp that supports L2TP for ubuntu 16.04

Walkthrough for building from source: http://blog.z-proj.com/enabling-l2tp-over-ipsec-on-ubuntu-16-04/

2
  • 6
    You also need to sudo apt-get install network-manager-l2tp-gnome before you can use the GUI in Network Manager.
    – BenFreke
    Mar 29, 2017 at 23:37
  • Also, this works for Ubuntu 17.04. Great!
    – socketpair
    Oct 11, 2017 at 6:37
12

On 16.04, you could try building and installing network-manager-l2tp which is a L2TP/IPsec VPN plugin for NetworkManager.

See the following page for the package prerequisites and strongSwan AppArmor workaround: https://github.com/nm-l2tp/network-manager-l2tp/wiki

also as that page mentions upgrade to NetworkManager 1.2.2 or later.

First install the following dependencies:

sudo apt install intltool libtool network-manager-dev libnm-util-dev libnm-glib-dev libnm-glib-vpn-dev libnm-gtk-dev libnm-dev libnma-dev ppp-dev libdbus-glib-1-dev libsecret-1-dev libgtk-3-dev libglib2.0-dev xl2tpd strongswan

Issue the following on the command-line (note: the backslash character \ is the shell line continuation character which can safely be copy and pasted) :

git clone https://github.com/nm-l2tp/network-manager-l2tp.git
cd network-manager-l2tp
autoreconf -fi
intltoolize

./configure \
  --disable-static --prefix=/usr \
  --sysconfdir=/etc --libdir=/usr/lib/x86_64-linux-gnu \
  --libexecdir=/usr/lib/NetworkManager \
  --localstatedir=/var \
  --with-pppd-plugin-dir=/usr/lib/pppd/2.4.7

make
sudo make install
6
  • 1
    I have succeeded to install the manager, I put the connection in it but ofc is not working after connect: The vpn connection failed. Aug 6, 2016 at 12:09
  • 1
    I'm not sure what ofc is. I would also need a bit of the log to work out what the error is. Aug 8, 2016 at 1:38
  • 5
    Worked well... Here is a tutorial for everyone: blog.z-proj.com/enabling-l2tp-over-ipsec-on-ubuntu-16-04
    – zed
    Aug 22, 2016 at 18:57
  • I'm on a frash install of Ubunu 16.04 and I can't configure. libnma is looking for a much higher version than the one that ships. checking for GTK... yes checking for LIBNMA... no configure: error: Package requirements (libnma >= 1.8.0) were not met: Requested 'libnma >= 1.8.0' but version of libnma is 1.2.6 Apr 3, 2018 at 11:44
  • See github.com/nm-l2tp/network-manager-l2tp/wiki/Building for building instructions on Ubuntu 16.04. You have been trying to build using the master branch which needs NetworkManager > 1.8, so as mentioned in the instructions, use the nm-1-2 branch instead. Alternatively use the prebuilt packages, see github.com/nm-l2tp/network-manager-l2tp/wiki/Prebuilt-Packages Apr 4, 2018 at 12:24
9

The OP didn't say if the remote end was a Meraki firewall but J Wiese's answer is one of only two I found, anywhere, that hits on setting Phase 1 and Phase 2 protocols which is what it takes to connect to a Meraki. I thought it would be helpful to see all the steps for the Meraki configuration in one place. This also includes commands to disable xl2tpd which interferes with the NetworkManager configuration created in the GUI.

These steps are from Anthony Mayes' comment at http://blog.z-proj.com/enabling-l2tp-over-ipsec-on-ubuntu-16-04/.

  1. On Ubuntu < 19.10, add the required apt source repository sudo add-apt-repository ppa:nm-l2tp/network-manager-l2tp sudo apt-get update
  2. Install network-manager-l2tp: sudo apt-get install network-manager-l2tp
  3. If using gnome, install the gnome plugin (if using another desktop environment, see if there's a plugin for its network manager): sudo apt-get install network-manager-l2tp-gnome
  4. Navigate to Settings > Network and click the + button next to VPN enter image description here
  5. Select "Layer 2 Tunneling Protocol (L2TP)" enter image description here
  6. Fill out the basic VPN information
    • Provide a descriptive name
    • Put the VPN endpoint in the Gateway field.
    • Put your assigned username the "User name" field. (Might be an email address)
    • Click the icon in the Password field and select your preference for how to supply the password. enter image description here
  7. Click IPSec Settings...
    • Click the box for "Enable IPsec tunnel to L2TP host"
    • Enter the shared secret into the Pre-shared key field.
    • Leave the Gateway ID field empty.
    • Expand the Advanced options area
    • Enter "3des-sha1-modp1024" into the Phase 1 Algorithms box.
    • Enter "3des-sha1" into the Phase 2 Algorithms box.
    • Leave the box checked for "Enforce UDP encapsulation". enter image description here
    • Click OK.
  8. Click Save.
  9. Open a terminal and enter the following commands to permanently disable the xl2tpd service: sudo service xl2tpd stop sudo systemctl disable xl2tpd
  10. Open Network Settings and try to turn the VPN on.
2
  • Using the Algorithms and checking the "Enforce UDP encapsulation" was the solution! Thanks
    – byf-ferdy
    Sep 21, 2018 at 13:29
  • 1
    Disabling x12tpd did it for me, thanks! Any explanation why it needs to be disabled?
    – barro32
    Feb 28, 2020 at 11:07
4

The author of network-manager-l2tp plugin has created a PPA for Ubuntu.

It can be found here: https://launchpad.net/~nm-l2tp/+archive/ubuntu/network-manager-l2tp

3

I hate to necro this thread but it may help someone else with a Meraki MX firewall.

First, remove all previous VPN stuff.

HINT: you can tail out the VPN connection for troubleshooting by:

sudo tail -f /var/log/syslog

Add the repository mentioned above:

sudo add-apt-repository ppa:nm-l2tp/network-manager-l2tp

Then add the dependencies:

sudo apt install intltool libtool network-manager-dev libnm-util-dev libnm-glib-dev libnm-glib-vpn-dev libnm-gtk-dev libnm-dev libnma-dev ppp-dev libdbus-glib-1-dev libsecret-1-dev libgtk-3-dev libglib2.0-dev xl2tpd strongswan

Then add the gnome network manager for the GUI:

sudo apt-get install network-manager-l2tp-gnome

reboot

If you have a Meraki device you have to enter the Phase 1 and Phase 2 Algorithms:

go to "IPsec Settings..." on the "VPN" tab, drop down the "Advanced" area and enter these:

Phase1 Algorithms: 3des-sha1-modp1024 Phase2 Algorithms: 3des-sha1

enter image description here

1
  • Thanks for the image with the Gateway ID unset, this clicked in my brain that it could be empty or an FQDN which I believe if empty leaves the left "side" of the /etc/ipsec.d/nm-l2tp-ipsec-*.secrets file empty (left of the :) which may improve the odds of connecting if going through NAT or something else where the packets coming back from the VPN host may not always match directly, though it does fall back to the IP by default.
    – dragon788
    Jul 19, 2017 at 20:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .