Ubuntu 18.04 VPN L2TP with PSK

Question

I tried to configure a vpn-connection having an username, a password and a pre-shared-key (psk) from my admin at office.

Over many hours I tried several possibilities and methods (openvpn, openswan, networkmanager-l2tp-gnome, xl2tpd), but I can't establish a connection to my office.

But the given parameters are still working, because I tried using Win7 and on my Android-Phone.

Why is it so heavy to configure such a simple thing like a vpn, where I've only to put in 3 parameters? On my phone, I put the parms in and it works fine.

Please help me to find out the right way to configure the vpn. Because I want use Linux!!!

Many thanks, GueBr

Answer 1

I had the same problem and changing the VPN server wasn't an option, out of my control.

I chased my tail with lots of solutions, edited and reverted many config files, and tried setting the phase 1 and phase 2 algorithms in the Network Manager VPN setup, IPSec config. None of it worked until I used ppa:nm-l2tp/network-manager-l2tpapt to install a sane version:

sudo add-apt-repository ppa:nm-l2tp/network-manager-l2tp
sudo apt update
sudo apt install network-manager-l2tp network-manager-l2tp-gnome
sudo apt upgrade

After installing that, updating network-manager-l2tp and rebooting, the VPN connection "just worked". My config still had the overrides for phase 1 and phase 2, so maybe that helped too. I also had disabled autostarting of xl2tpd, so in case those changes help, here they are:

VPN Settings → Configure → Identity → IPSec Settings:

• Phase 1: aes128-sha1-modp2048!
• Phase 2: 3des-sha1

Those were selected based on posts about it being the most likely combination and verified by running ike-scan:

sudo ike-scan <vpn hostname or ip>

Disabling xl2tpd:

sudo systemctl disable xl2tpd

Answer 2

Unfortunately there are many L2TP/IPsec VPN servers out there that are proposing only the IPsec algorithms that were introduced by Microsoft with Windows 2000 Server 18 years ago that are now considered weak or broken.

The L2TP/IPsec client also proposes a set of algorithms. For a connection to happen, the client and server need to have at least one common proposal.

networkmanager-l2tp uses libreswan or strongswan for IPsec support. Linux tends to be more security conscious than other platforms. libreswan and strongswan have dropped the weak algorithms in their default proposals but they still allow weak algorithms if you explicitly specify which weak algorithms you want to use.

But the correct fix is most definitely to configure the L2TP/IPsec server to also propose algorithms that aren't weak.

I would recommend reading the README.md file that comes with the network-manager-l2tp package, you can also find the README.md in the upstream source code here :

• https://github.com/nm-l2tp/network-manager-l2tp/blob/nm-1-2/README.md

In particular have a look at the "Issue with VPN servers only proposing IPsec IKEv1 weak legacy algorithms" section in that file. It provides details on how to run a ike-scan.sh script that can query the LP2TP/IPsec server for the phase 1 algorithms it uses, it also gives an example on how to specify the most common 3DES, SHA1 and MODP1024 weak algorithms.

Also have a look at the "Issue with not stopping system xl2tpd service" section in that file, you might need stop the system xl2tpd.

Answer 3

I just want to add that for me it was simpler than @jla's solution.
Perhaps the 18.04 repos have been updated since then.

What solved it for me was to use ike-scan.sh as described here.
From the result of that I was able to set this in my case:
Phase1: 3des-sha1-modp1024
Phase2: aes256-sha1,aes128-sha1,3des-sha1

I also had to disable xl2tpd, but that was all.