IPSec/L2TP VPN server with multiple IP: connect with different ip fail

vpn

I have set up a IPSec/L2TP VPN server on EC2 running Ubuntu Server 12.04 with openswan 2.6.37/xl2tpd 1.3.1. It's successful When I connect with default IP(private IP :172.31.14.4, public IP: 54.69.159.5) ,but it is fail if I connect width second IP(private IP :172.31.1.40, pubic IP: 54.68.144.45).

I want to set this vpn server can connect with different IP and make the client IP show as the connecting VPN public IP.

Here is the log when error connection:

/var/log/syslog

Jun 30 11:03:16 hostname xl2tpd[9964]: get_call: allocating new tunnel for host x.x.x.x, port 1701.
Jun 30 11:03:18 hostname xl2tpd[9964]: get_call: allocating new tunnel for host x.x.x.x, port 1701.
Jun 30 11:03:18 hostname xl2tpd[9964]: control_finish: Peer requested tunnel 2 twice, ignoring second one.
Jun 30 11:03:18 hostname xl2tpd[9964]: build_fdset: closing down tunnel 51911
Jun 30 11:03:19 hostname xl2tpd[9964]: get_call: allocating new tunnel for host x.x.x.x, port 1701.
Jun 30 11:03:19 hostname xl2tpd[9964]: control_finish: Peer requested tunnel 2 twice, ignoring second one.
Jun 30 11:03:19 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:19 hostname xl2tpd[9964]: build_fdset: closing down tunnel 32530
Jun 30 11:03:19 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:23  xl2tpd[9964]: last message repeated 3 times
Jun 30 11:03:23 hostname xl2tpd[9964]: get_call: allocating new tunnel for host x.x.x.x, port 1701.
Jun 30 11:03:23 hostname xl2tpd[9964]: control_finish: Peer requested tunnel 2 twice, ignoring second one.
Jun 30 11:03:23 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:23 hostname xl2tpd[9964]: build_fdset: closing down tunnel 44586
Jun 30 11:03:23 hostname xl2tpd[9964]: Maximum retries exceeded for tunnel 32176.  Closing.
Jun 30 11:03:23 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:23 hostname xl2tpd[9964]: Connection 2 closed to x.x.x.x, port 1701 (Timeout)
Jun 30 11:03:24 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:28  xl2tpd[9964]: last message repeated 3 times
Jun 30 11:03:28 hostname xl2tpd[9964]: Unable to deliver closing message for tunnel 32176. Destroying anyway.
Jun 30 11:03:31 hostname xl2tpd[9964]: get_call: allocating new tunnel for host x.x.x.x, port 1701.
Jun 30 11:03:33 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:38  xl2tpd[9964]: last message repeated 4 times
Jun 30 11:03:38 hostname xl2tpd[9964]: Maximum retries exceeded for tunnel 55170.  Closing.
Jun 30 11:03:38 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:38 hostname xl2tpd[9964]: Connection 2 closed to x.x.x.x, port 1701 (Timeout)
Jun 30 11:03:39 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:40 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:41 hostname xl2tpd[9964]: get_call: allocating new tunnel for host x.x.x.x, port 1701.
Jun 30 11:03:41 hostname xl2tpd[9964]: control_finish: Peer requested tunnel 2 twice, ignoring second one.
Jun 30 11:03:41 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:41 hostname xl2tpd[9964]: build_fdset: closing down tunnel 16380
Jun 30 11:03:41 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:42 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:43 hostname xl2tpd[9964]: Unable to deliver closing message for tunnel 55170. Destroying anyway.

Here is my configuration:

/etc/ipsec.conf

config setup
    dumpdir=/var/run/pluto/
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
    oe=off
    protostack=netkey

conn %default
    forceencaps=yes

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=172.31.14.4
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any

conn L2TP-PSK-noNAT-2
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=172.31.1.40
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any

/etc/xl2tpd/xl2tpd.conf

[global]
ipsec saref = yes
debug tunnel = yes

[lns default]
ip range = 10.1.2.2-10.1.2.20
local ip = 10.1.2.1
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

/etc/ppp/options.xl2tpd

require-mschap-v2
ms-dns 8.8.8.8
ms-dns 8.8.4.4
asyncmap 0
auth
crtscts
lock
hide-password
modem
debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4

Best Answer

Not sure you still need the answer but I never seen an answer in Google for similar issues. I have single pair of IPs on my EC2 instance but the same error in log: udp_xmit failed... Operation not permitted. This edit in the config helped me: nat_traversal=no.