Bdtyktl

I'm trying to set an L2TP/IPsec VPN. I have installed openswan from the repository on Ubuntu 13.04

Section: universe/net

Architecture: amd64

Version: 1:2.6.38-1

and configured it following the community docs.

# cat /etc/ipsec.conf 

config setup

    nat_traversal=yes

    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.168.23.0/24

    oe=off

    protostack=netkey



conn L2TP-PSK-NAT

    rightsubnet=vhost:%priv

    also=L2TP-PSK-noNAT



conn L2TP-PSK-noNAT

    authby=secret

    pfs=no

    auto=add

    keyingtries=3

    rekey=no

    # Apple iOS doesn't send delete notify so we need dead peer detection

    # to detect vanishing clients

    dpddelay=30

    dpdtimeout=120

    dpdaction=clear

    # Set ikelifetime and keylife to same defaults windows has

    ikelifetime=8h

    keylife=1h

    type=transport

    # Replace IP address with your local IP (private, behind NAT IP is okay as well)

    left=my.ip

    # For updated Windows 2000/XP clients,

    # to support old clients as well, use leftprotoport=17/%any

    leftprotoport=17/1701

    right=%any

    rightprotoport=17/%any

    #force all to be nat'ed. because of iOS

    forceencaps=yes

It starts fine but fails the verification

# ipsec verify

Checking your system to see if IPsec got installed and started correctly:

Version check and ipsec on-path                                 [OK]

Linux Openswan U2.6.38/K3.8.0-29-generic (netkey)

Checking for IPsec support in kernel                            [OK]

 SAref kernel support                                           [N/A]

 NETKEY:  Testing XFRM related proc values                      [OK]

[OK]

[OK]

Checking that pluto is running                                  [OK]

 Pluto listening for IKE on udp 500                             [OK]

 Pluto listening for NAT-T on udp 4500                          [OK]

Two or more interfaces found, checking IP forwarding            [FAILED]

Checking NAT and MASQUERADEing                                  [OK]

Checking for 'ip' command                                       [OK]

Checking /bin/sh is not /bin/dash                               [OK]

Checking for 'iptables' command                                 [OK]

Opportunistic Encryption Support                                [DISABLED]

even though forwarding seems to be enabled

# cat /proc/sys/net/ipv4/ip_forward

1

What's wrong and how do I fix it?

Stumbled over this while looking up the error :

I think this is the answer :

https://lists.openswan.org/pipermail/users/2009-September/017423.html

I have just upgraded to 2.6.23 and run ipsec verify and I get an
unexpected error:
Two or more interfaces found, checking IP forwarding [FAILED]

cat /proc/sys/net/ipv4/ip_forward gives 1 so I am confused.

If it helps eth0 is my WAN, eth1 is my normal LAN, eth1:0 is a virtual
IP on eth1 to get round a problem I have been having with running
Openswan on a combined gateway/file server, and eth2 is a second, unused
LAN adaptor.

Then you can ignore it. It's a warning when running a subnet-subnet or
subnet-host tunnel on the subnet side, where you need forwarding to go
from the public side (internet) to the lan.