嗨，大家好，我已经在centos 7（内核3.10.0-514.16.1.el7.x86_64）上的l2tp / ipsec（Libreswan 3.15）服务器，问题是我不能从Android设备连接，但三星（三星vpn客户端是不同的） 。 正如我在日志中所看到的IPSEC进程成功完成，但l2tp进程无法启动。 我的理论是服务器无法解密ipsec包。 我将提供configuration文件。
/etc/ipsec.conf中
config setup nat_traversal=yes virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12 oe=off protostack=netkey conn L2TP-PSK-NAT rightsubnet=vhost:%priv also=L2TP-PSK-noNAT conn L2TP-PSK-noNAT authby=secret pfs=no auto=add keyingtries=3 rekey=no ikelifetime=8h keylife=1h type=transport left=(my publicip) leftprotoport=17/1701 right=%any rightprotoport=17/%any dpddelay=10 dpdtimeout=90 dpdaction=clear /etc/xl2tpd/xl2tpd.conf
[global] listen-addr = (my publicip) auth file = /etc/ppp/chap-secrets [lns default] ip range = 10.30.30.100-10.30.30.200 local ip = 10.30.30.1 refuse chap = no refuse pap = yes require authentication = yes name = L2TPVPN ppp debug = yes length bit = yes pppoptfile = /etc/ppp/options.xl2tpd
/etc/ppp/options.xl2tpd
ipcp-accept-local ipcp-accept-remote ms-dns 8.8.8.8 ms-dns 8.8.4.4 asyncmap 0 auth hide-password debug name l2tpd proxyarp lcp-echo-interval 30 lcp-echo-failure 4 mtu 1400 noccp connect-delay 5000 show-password mru 1400 netmask 255.255.255.0 noipx
最后几行不成功的连接日志
STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2 transport mode {ESP=>0x09fb51ad <0xd4ede420 xfrm=AES_256-HMAC_SHA2_256 NATOA=none NATD=none DPD=active} Dead Peer Detection (RFC 3706): enabled transition from state STATE_QUICK_R1 to state STATE_QUICK_R2 STATE_QUICK_R2: IPsec SA established transport mode {ESP=>0x09fb51ad <0xd4ede420 xfrm=AES_256-HMAC_SHA2_256 NATOA=none NATD=none DPD=active} sent [LCP EchoReq id=0x20 magic=0x784ce536] rcvd [LCP EchoRep id=0x20 magic=0xf05f7866]