r/sysadmin•
pluush

L2TP rekeying issue?

I used this automatic script to install L2TP in my VPS: https://github.com/hwdsl2/setup-ipsec-vpn

I think I have a rekeying issue in my VPS server.

So far, there is no trouble when initiating a connection, but the deal after 1h: the VPN session ends. There is no trouble initiating a new connection after I'm disconnected. So, I looked at /etc/ipsec.conf and I changed the value of keylife=1h to 8h, 12h, anything. Including a few minutes or a few seconds. When I set it to one minute, VPN disconnects after a minute. But when I set it to more than one hour, from what I have read my iOS VPN client forces to ask for a rekey every hour, so disconnect still happens. Same happens on Windows. (keylife=8h)

I have tried making made these changes to ipsec.conf :

  • rekey=yes
  • keylife=1m
  • rekeymargin=30s

Here, why does the VPN still disconnect after 1min? Isn't the server supposed to negotiate a rekey after 30s? Why does the rekeying process fail, exactly? Is the autoconfiguration script I installed not configured for rekeying at all, and are there other configurations I need to make? Other than this lifetime and rekey stuff, everything seems to be working fine. I have searched here and there but unfortunately have not gotten any results yet... I'm lost.

CentOS 6.9 x64

P.S. Tried on a fresh, unmodified configuration and also drops after 1h. IPsec works on the setup AND connection survives for >1h but the problem is more or less the same:

  • Cannot connect two clients behind one same NAT
  • Connection drops when iOS devices enter Lock screen.

I also installed a OpenVPN script somewhere from GitHub (I downloaded it, I forgot the source) here http://plush.science/install.sh The connection drop on iOS Lock screen also happens in OpenVPN (tried just now), actually OpenVPN reinitiates the connection upon wakeup but usually the reinitiation of the connection fails. I'm lost.

I'll update the post if you need more info

Thanks before!

Posted Jun 3, 2017, 4:45 PM UTC · edited

53
Loading comments…