mirror of
https://github.com/hwdsl2/docker-ipsec-vpn-server.git
synced 2026-04-25 17:45:55 +03:00
[GH-ISSUE #242] Connecting to IPsec/XAuth stops working after some time #222
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @niksy on GitHub (Jun 7, 2021).
Original GitHub issue: https://github.com/hwdsl2/docker-ipsec-vpn-server/issues/242
Describe the issue
When trying to connect to IPsec/XAuth VPN server, I get the following error:
The VPN server did not respond. Verify the server address and try reconnecting.This seems to be happening after some time and it could be related to the issue #175. After I restart Docker container, everything works OK.Connecting to IPsec/L2TP works OK.
I haven’t tried changing
rekeyoption since I’m not entirely sure this should fix the issue. Seems like a strange behavior.Server
Client
@hwdsl2 commented on GitHub (Jun 7, 2021):
@niksy Hello! iPhones disconnect Wi-Fi automatically shortly after entering sleep mode, and as a result, the IPsec VPN disconnects. This is by design and cannot be customized. However, you can try IKEv2 mode with the VPN on-demand feature. See [1] for more details.
[1] https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/clients.md#iosandroid-sleep-mode
@niksy commented on GitHub (Jun 7, 2021):
When I started Docker container I was able to connect to the VPN. This worked all the time in the span of 3-4 hours. This morning (that was more than 12 hours later I think) I tried it and I always get the same message. When I restart Docker container, everything works.
This behavior happend 2 times already. I don’t think this is related to iPhone Wi-Fi.
@hwdsl2 commented on GitHub (Jun 7, 2021):
@niksy I see. In that case you'll need to enable Libreswan logs for the container, try to reproduce the issue again and check the logs for errors. See README for more information. If you have findings feel free to reply here.
@niksy commented on GitHub (Jun 10, 2021):
@hwdsl2 it happened again, and here are the logs. L2TP works, but XAuth doesn’t.
L2TP
XAuth
@hwdsl2 commented on GitHub (Jun 10, 2021):
@niksy Thanks for the details. This is a known limitation, that you cannot have a mix of IPsec/L2TP and IPsec/XAuth ("Cisco IPsec") mode clients connected from behind the same NAT (e.g. home router). Please use only one of the two modes (or IKEv2, which does not have this limitation) for clients from the same NAT.
Your logs indicate that when an IPsec/L2TP client is already connected, the VPN server temporarily "remembers" the connection mode and refuses to connect an IPsec/XAuth mode client from the same NAT. Restarting the Docker container will clear the server's state and after that you can connect.
@niksy commented on GitHub (Jun 10, 2021):
Oh, okay! How can I use only L2TP or XAuth? I don’t need IKEv2 "complexity" for this particular case. Can I disable one and use only other one?
@hwdsl2 commented on GitHub (Jun 11, 2021):
@niksy It's configured on the client. There are different documents in this repo to configure clients for each mode, please refer to the docs.
@niksy commented on GitHub (Jun 12, 2021):
So, there are 2 issues related to mine: https://github.com/hwdsl2/setup-ipsec-vpn/issues/557, https://github.com/hwdsl2/setup-ipsec-vpn/issues/43
I’ve looked up configuration and I think this is the block I need to remove to only have IPsec/XAuth configuration? I haven’t seen anything in the docs which explains this.
@hwdsl2 commented on GitHub (Jun 12, 2021):
@niksy That is correct. To disable IPsec/L2TP mode, first start a Bash shell inside the container [1]. Then remove the
conn l2tp-pskblock from both/etc/ipsec.confAND/opt/src/run.sh. The latter is required because/etc/ipsec.confis overwritten at container restart. Finally, runservice ipsec restart.I understand that you want to disable IPsec/L2TP mode on the VPN server. My previous comment was saying that it is not necessary to do that on the VPN server. Instead, if you do not configure any VPN client to use IPsec/L2TP mode [2], and instead only configure clients to use IPsec/XAuth mode [3], then you shouldn't encounter the
policy does not allow Extended Authentication (XAUTH) ...errors. This error only happens when you have a VPN client configured to use IPsec/L2TP mode, and another VPN client configured to use IPsec/XAuth mode from behind the same NAT. So instead of disabling IPsec/L2TP on the VPN server, you can simply configure clients to use IPsec/XAuth mode only.I plan to add a section to "troubleshooting" to clarify that these two modes should not be mixed for VPN clients connecting from behind the same NAT.
[1] https://github.com/hwdsl2/docker-ipsec-vpn-server#bash-shell-inside-container
[2] https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/clients.md
[3] https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/clients-xauth.md
@niksy commented on GitHub (Jun 13, 2021):
The thing is I’m currently the only client using this VPN server and that means I only have maximum of 1 connection active, so it can either be IPsec/XAuth or IPsec/L2TP.
One must be disconnected to connect to the other one, but this happens anyways. I even tried waiting for longer periods (half day).
That’s why I’m asking if I should disable one type of VPN server connection.
But, reading your answer:
What do you mean by "configured"? If I just add connection type in my iPhone, that’s enough for VPN server to show this error? I don’t even need to connect one time to that type of connection?
Maybe add option to disable/enable on Docker container creation, controlled with environment variable? That way users can avoid editing configuration files everytime they recreate containers.
@hwdsl2 commented on GitHub (Jun 13, 2021):
@niksy By "configured" I mean that the VPN client is both set up AND connect to the VPN server using IPsec/L2TP mode. If you only set up the client to use this mode but don't connect, it won't trigger this issue.
From my understanding, this issue only occurs in the following scenarios: First, client "A" connects to the VPN server using IPsec/L2TP mode. Then another VPN client "B" from behind the same NAT tries to connect to the VPN server using IPsec/XAuth mode. Generally, if "A" has already disconnected before "B" connects, the issue doesn't occur. However, some earlier Android versions have a bug where they don't properly terminate the VPN connection, resulting in the VPN server still "remembering" the connection type. If such an Android client is client "A", then client "B" cannot connect regardless of whether "A" disconnected, until after the connection times out or until a restart of the IPsec service.
Your setup seems a bit uncommon because your logs show that the VPN server is at (local) IP 172.26.0.4, while the client is behind IP 172.26.0.1 with local IP 10.123.214.X. This means any other VPN client connecting from behind 172.26.0.1 could trigger this issue. I guess this may be due to special networking setup in Docker Desktop for Mac?
If you check your VPN logs when the error
policy does not allow Extended Authentication (XAUTH)...is encountered, you should see (earlier in the logs) another client connecting using IPsec/L2TP mode. What I suggested was that if you don't configure that client to use IPsec/L2TP mode, the issue won't occur regardless of whether you disable IPsec/L2TP mode on the server.@niksy commented on GitHub (Jun 13, 2021):
OK, I will restart Docker container and I only try to connect with IPsec/XAuth to see if the issue still occurs.
Maybe you’re right, maybe networking on Docker for Mac works differently than on Linux.
@niksy commented on GitHub (Jun 14, 2021):
OK, I’ve tried it again, only with IPsec/XAuth and this is what I get, first is successful connection, other two ones are failed connections:
It seems like it’s trying to connect with L2TP even though after I restarted Docker container I only used XAuth.
@hwdsl2 commented on GitHub (Jun 14, 2021):
@niksy Not sure about the root cause but I was unable to reproduce the issue with Docker on Linux. If all three attempts are from your VPN client, it may be a bug specific to Docker for Mac. If the second attempt is not from your VPN client, it may be an attacker trying to connect using IPsec/L2TP mode. I would suggest that you disable IPsec/L2TP mode on the VPN server as previously discussed.
@niksy commented on GitHub (Jun 14, 2021):
Yeah, all three are from my VPN client. I guess it’s a bug specific to macOS version.
OK, I’m going to try with L2TP disabled. If that works, do you think it would be possible to make activation/deactivation with environment variables, like I mentioned earlier? There are currently 3 steps needed to perform this operation which could be achieved with properly defined environment variable.
For example,
USE_IPSEC_L2TPwhich controls L2TP mode and which is enabled by default.And also, of course, mention this bug and behavior in docs and how to adjust configuration.
@hwdsl2 commented on GitHub (Jun 15, 2021):
@niksy I will need time to think about how to implement this variable properly, possibly with other variables that disable IPsec/XAuth mode and/or limit to IKEv2 only. Disabling IPsec/L2TP is an uncommon use case. In the meantime please continue to use the workaround discussed earlier by commenting out the l2tp-psk block in both files.
@niksy commented on GitHub (Jun 16, 2021):
Thank you!
Yeah, but as you said in one of the previous comments, using both modes behind same NAT is a known limitation, and offering easy way of disabling one and enabling other could be potential solution for that.
@hwdsl2 commented on GitHub (Jul 19, 2021):
This has been implemented in the latest Docker image version. Use the following variables to selectively disable VPN modes: