I've successfully setup ipsec-tools/racoon/xl2tpd/pptpd/appropriate router port forwarding to operate a VPN for an Android phone. It works well from outside the network. I can seamlessly tunnel from Android through multiple NATs by connecting to the VPN's router's public IP. When I'm on the VPN's local network, I'm able to do this as well by changing Android's target IP to the VPN's local IP. I've verified using Wireshark that in the first scenario the data is tunneled using ESP-UDP over UDP port 4500. racoon.conf's nat traversal is set to force, so I believe this is also true for the second situation.

The problem comes when Android is connected to the VPN's local network and is targeted to the VPN's public IP instead of its local IP (the connection times out during phase1 negotiation). I'd like to be able to leave the VPN on indefinitely regardless of what network the phone is connected to (and this problem interferes with that goal).

I have tried to DMZthe VPN server on my router and simultaneously disable UFW and the problem persists.

The problem I see on the server side is:

racoon: ERROR: phase1 negotiation failed due to time up.

The problem I see on Android's side is:

mtpd: Timeout -> Sending SCCRQ

It repeats multiple times until it aborts.


This answer may not help you because it's so late, but hopefully it helps someone else who comes along. I've solved the problem you described by using domain names, a local DHCP server, and a local DNS server which can override public domain names.

This method obviously relies on you having a public DNS address which you can use in place of IP addresses no matter where you go. There are free dynamic DNS services which will serve that purpose. You can set the public IP address in their web interface.

In your LAN, you need a DNS server which gives priority to it's own record of domain names. On that server, you need to redefine your public domain name to point to your local LAN address for the server. Also, your DHCP server needs to provide that local DNS server's address to your android device whenever it assigns the device a LAN address -- otherwise you'll pull the public DNS record and get the public IP address even when you're in the LAN. After doing this, you can connect to the VPN using the domain name no matter where you are.

Broad view

When you are away from the LAN, your android device will query the public DNS servers provided by your ISP for your VPN's IP address.

myvpn.somepublicdomainname.net -> x.x.x.x (public IP)

When you are inside your LAN, your android device will query your local DNS server.

myvpn.somepublicdomainname.net -> (private IP)

This should work even if your VPN provides an additional DNS server to its clients.

Installing a DNS server (dnsmasq)

The easiest way to set up a DNS server the way I've described is to install and configure dnsmasq. It is a very lightweight caching DNS server (and DHCP server too, incidentally).

Type this into the terminal:

sudo apt-get update && sudo apt-get install -y dnsmasq

Insert the following line into the end of /etc/dnsmasq.conf:


Insert into the /etc/dnsmasq.hosts file or create it if it doesn't exist:   myvpn.somepublicdomainname.net.

That first part ( needs to be the local IP address of your VPN, and the last part (myvpn.somepublicdomainname.net.) needs to be the public domain name WITH A PERIOD AT THE END. Sorry for the caps, but it's important. That final period lets the server know that it is a top-level domain.

Now restart dnsmasq:

sudo service dnsmasq restart

At this point you should be able to query your DNS server for the IP address of your VPN and get the local IP address instead of the public one. Test it by using dig to query the DNS server (I'll assume the DNS server's IP is

dig @ myvpn.somepublicdomainname.net

That should give several lines of text, but you can ignore all the ones that start with a comma ; and focus on the one that doesn't:

myvpn.somepublicdomainname.net.    0       IN      A

If you see this, your local DNS server is giving the local IP address in response to queries. This is good news. If it actually gives the public IP address, you need to double-check your dnsmasq configuration. Maybe restart the server before going crazy with too many changes. That works a surprising number of times.

Now use the same dig command and replace myvpn.somepublicdomainname.net with other public domain names (like google.com) to make sure it's returning those correctly too. If they work, you can safely reconfigure your DHCP server to use your new DNS server!

Configuring a DHCP server

I'll assume you already have a DHCP server set up in your LAN. That is a service usually provided by your WiFi router. You'll need to configure it to use your new DNS server first, before any other DNS server. That procedure varies, so I'll leave the answer to another question.

Possible problem

If your android device is manually configured to use specific DNS servers (like Google's popular or you'll have to switch back to using DHCP-assigned DNS servers OR list your LAN's DNS server first, and use as a fall-back. Manually listing your LAN DNS server first will almost certainly result in slower domain name lookups whenever you aren't inside your LAN which will have a negative effect on your web browsing. There are ways around it, but I'll assume you just go with the DHCP-assigned DNS servers and leave this problem's answer to another question. If you don't know what I'm talking about, it probably doesn't apply to your situation anyway.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.