L2TP VPN not accepting connections SOMETIMES

[nbirnbaum]

Hey folks,

Here’s an issue I’ve seen A LOT — probably on half of the Tiger Servers we’ve set up: PPTP works fine, L2TP doesn’t even allow connections to initiate.

It’s not a firewall or router issue; I’ve duplicated it on the local networks, with the server firewall off. The closest I’ve got to the problem is to determine that server port 1701 (L2TP) is simply not accepting connections; port 1723 (PPTP) has no such issue. See the following Terminal transcript, from a workstation on the LAN, no firewalling enabled:

[b]workstation:~ noam$[/b] telnet 10.0.5.3 1701
Trying 10.0.5.3…
telnet: connect to address 10.0.5.3: Connection refused
telnet: Unable to connect to remote host
[b]workstation:~ noam$[/b] telnet 10.0.5.3 1723
Trying 10.0.5.3…
Connected to medicalserver.medicaloffice.com.
Escape character is ‘^]’.

We’ve duplicated this exact situation on networks using all kinds of routers and switches. It doesn’t seem specific to any model, and as I’ve said it only happens on HALF the servers, all using the same configuration methodology.

The vpnd.log is annoyingly empty of clues:

#Start-Date: 2007-12-18 09:58:05 PST
#Fields: date time s-comment
2007-12-18 09:58:05 PST Loading plugin /System/Library/Extensions/L2TP.ppp
2007-12-18 09:58:05 PST Listening for connections…
#Start-Date: 2007-12-18 09:58:05 PST
#Fields: date time s-comment
2007-12-18 09:58:05 PST Loading plugin /System/Library/Extensions/PPTP.ppp
2007-12-18 09:58:05 PST Listening for connections…

I don’t know if this same issue occurs on Leopard Server.

Yurk! Any suggestions?

Thanks,
noam

[macrightinc]

I have had similar trouble when opening only 1701. I read something about Apple’s implementation of L2TP requiring a floating UDP port. I’m hoping that isn’t true as I’d like to limit ports NAT’d to my Mac OS X Server. I’m eager to hear people’s thoughts

[macrightinc]

I have had similar trouble when opening only 1701. I read something about Apple’s implementation of L2TP requiring a floating UDP port. I’m hoping that isn’t true as I’d like to limit ports NAT’d to my Mac OS X Server. I’m eager to hear people’s thoughts

[Author]

Posts