30

enter image description here

Previously, I was trying to figure out how to install the L2TP/IPSEC manager code. I guess Ubuntu/Canonical switched away from OpenSwan to StrongSwan, but didn't really announce it. So that was figured out in this AskUbuntu question: L2TP IPsec VPN client on Ubuntu 14.10

Since then, I've been trying to figure out how to use Pre-Shared Keys for Authentication to the Server. As shown in the screenshot, the Network Manager allows for a Certificate (.pem file), but not a Pre-shared key.

My network admin doesn't want to mess around with Certs because PSKs are good enough for the situation we're working with. I've already tested these PSKs with Windows and they work great.

He's given me 4 pieces of info.

  • Server name
  • PSK for said server
  • User name
  • password for said username

I can see on this screenshot where to put the server name and username, but cannot see where to put the PSK for the server, nor where to enter the password (maybe I'm prompted for that at connection time.)

Anyone know how to do this?

UPDATE: So I tried hackerb9's suggestion, but it didn't appear to do anything. I also tried alci's suggestion of downloading the 1.3.1 version of Network-Manager for L2TP and compiling manually. After installing a bunch of packages and re-running ./configure a few times, I eventually was able to "make" and then "make install" the code.

The plug-in for network manager now shows a Pre-shared Key option, but it still doesn't work. It now looks like this:

enter image description here

The problem with this is that the "Certificate" option is still being displayed (instaed of the Pre-shared key field.)

Where in this Ubuntu Network Manager plugin am I supposed to enter the Pre-shared Key for Server authentication?

As an example for contrast, in Windows 8, it has an option that looks like this:

enter image description here

5
  • 2
    It seems PSK was added in version 1.3.1 of the nm plugin, but utopic (or debian, for that matters) ships 1.3.0... see wiki.strongswan.org/issues/254 Maybe you should try to build it from download.strongswan.org/NetworkManager
    – alci
    Feb 20, 2015 at 21:46
  • Ok, I'll give that a shot.
    – Pretzel
    Feb 23, 2015 at 20:40
  • 2
    So, I downloaded the source, ran the ./configure (which required that I install like 5 to 10 more missing packages), then ran make, and make install. Now, Pre-Shared Key shows up as an option in drop down for client. Unfortunately, Pre-Shared is still not an option for Server. (I'm using Pre-shared keys for both the Authentication to the Server as well as Username/Client AUTH.)
    – Pretzel
    Feb 27, 2015 at 17:21
  • 1
    Hey @Pretzel. Did you end up getting it working? I have the same exact issue (with the addition that I am using Gnome 3), and so far no success :S.
    – jlengrand
    May 10, 2015 at 18:59
  • 3
    keep in mind that strongswan does not provide support for the l2tp part of L2TP/IPsec, but only for the IPsec. All settings in network-manager-strongswan relate to IKEv2
    – user448115
    Oct 6, 2015 at 7:42

2 Answers 2

8

If you want a GUI solution, you can install an L2TP Network Manager plugin from ppa.

It can be done by

sudo add-apt-repository ppa:nm-l2tp/network-manager-l2tp
sudo apt-get update
sudo apt-get install network-manager-l2tp-gnome

It works with trusty and xenial, but the author did not build packages for vivid.

After you install the package you will be able to configure an L2TP connection in Network Manager

Update: Now the packages have been included in official Ubuntu repositories and PPA is not needed for Ubuntu 18.04+.

For new Ubuntu releases just run:

sudo apt-get install network-manager-l2tp-gnome

enter image description here enter image description here enter image description here enter image description here

8
  • Doesn't apply; there's nothing like Group configured.
    – Oxwivi
    Oct 6, 2015 at 9:16
  • Did you check "Enable IPsec"?
    – Pilot6
    Oct 6, 2015 at 10:01
  • 1
    Sorry if I confused you; what I meant is, I've a PSK but no "group". Enabling the tunnel doesn't allow me to define PSK without Group Name.
    – Oxwivi
    Oct 6, 2015 at 10:28
  • Worked for me to connect to Ubiquiti EdgeMAX. I used group name "nogroup". I had to reboot after installing network-manager-l2tp from the PPA. Oct 11, 2016 at 10:33
  • where does that first screen comes from?? Apr 22, 2020 at 5:52
7
+250

Are you comfortable with editing configuration files with a text editor? If so, I believe the answer of where to put the PSK is /etc/ipsec.secrets. You can try something like this:

: PSK "strongSwan" 

The file is documented in man ipsec.secrets or you can read about it here:

https://wiki.strongswan.org/projects/strongswan/wiki/IpsecSecrets

Let us know if that doesn't work for you.

3
  • Editing? Sure, no problem. I'll give this a shot and report back.
    – Pretzel
    Feb 23, 2015 at 19:13
  • 3
    Ok, I tried that. It prompted me for a password and said "VPN connection failed because of invalid VPN secrets." (As a side note, I found Windows eminently more helpful when it failed to connect. It usually had an error code/number. Where might I go to look for an error code? /var/log/ ???)
    – Pretzel
    Feb 23, 2015 at 19:18
  • 1
    @Pretzel You need to add this information (and the one from the other answer) into your question so that it's obvious to new people looking at the question. Feb 25, 2015 at 19:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .