L2TP IPSec doesn't work from other city
I have a well working L2TP IPSec connection from any mobile or desktop client to my Mikrotik RB2011UiAS-2HnD-IN (RouterOS v6.30.2). It works when I connect through any mobile or stationary ISP within my city. The log of a successful connection looks approximately so:
ipsec, error key length mismatched, mine:128 peer:256.
ipsec, error authtype mismatched: my:hmac-sha1 peer:hmac-md5
l2tp, info first L2TP UDP packet received from X.X.X.X
l2tp, ppp, info, account MyUser logged in, 192.168.111.246
l2tp, ppp, info <l2tp-MyUser>: authenticated
l2tp, ppp, info <l2tp-MyUser>: connected
l2tp, ppp, info <l2tp-MyUser>: terminating... - peer is not responding
l2tp, ppp, info, account MyUser logged out, 165 157 168 26 15
l2tp, ppp, info <l2tp-MyUser>: disconnected
Some days ago I attempted to connect from other city: through one mobile and one stationary ISP. The connection didn't succeed, and log contained only one line:
l2tp, info first L2TP UDP packet received from Y.Y.Y.Y
or such lines:
ipsec, error key length mismatched, mine:128 peer:256.
ipsec, error authtype mismatched: my:hmac-sha1 peer:hmac-md5
l2tp, info first L2TP UDP packet received from Y.Y.Y.Y
l2tp, info first L2TP UDP packet received from Y.Y.Y.Y
l2tp, info first L2TP UDP packet received from Y.Y.Y.Y
What is wrong? Can ISP block or corrupt L2TP IPSec connection?
P.S. There is another interesting detail:
I used to connect to Romanian PPTP VPN to bypass my home provider's web censorship and it always worked in my home city, but when I connected to the same VPN from other city (where the L2TP IPsec failed), I discovered that the site of my interest is still censored. The only explanation that comes to my mind is that provider acts like a MITM. It seems that the provider uses following tactics: tap the line, when impossible, then prevent from connecting.
networking vpn mikrotik-routeros l2tp
edited Dec 14 '18 at 21:54
Duncan X Simpson
1,105823
asked Jan 8 '16 at 19:16
PaulPaul
3001924
add a comment |
I have a well working L2TP IPSec connection from any mobile or desktop client to my Mikrotik RB2011UiAS-2HnD-IN (RouterOS v6.30.2). It works when I connect through any mobile or stationary ISP within my city. The log of a successful connection looks approximately so:
ipsec, error key length mismatched, mine:128 peer:256.
ipsec, error authtype mismatched: my:hmac-sha1 peer:hmac-md5
l2tp, info first L2TP UDP packet received from X.X.X.X
l2tp, ppp, info, account MyUser logged in, 192.168.111.246
l2tp, ppp, info <l2tp-MyUser>: authenticated
l2tp, ppp, info <l2tp-MyUser>: connected
l2tp, ppp, info <l2tp-MyUser>: terminating... - peer is not responding
l2tp, ppp, info, account MyUser logged out, 165 157 168 26 15
l2tp, ppp, info <l2tp-MyUser>: disconnected
Some days ago I attempted to connect from other city: through one mobile and one stationary ISP. The connection didn't succeed, and log contained only one line:
l2tp, info first L2TP UDP packet received from Y.Y.Y.Y
or such lines:
ipsec, error key length mismatched, mine:128 peer:256.
ipsec, error authtype mismatched: my:hmac-sha1 peer:hmac-md5
l2tp, info first L2TP UDP packet received from Y.Y.Y.Y
l2tp, info first L2TP UDP packet received from Y.Y.Y.Y
l2tp, info first L2TP UDP packet received from Y.Y.Y.Y
What is wrong? Can ISP block or corrupt L2TP IPSec connection?
P.S. There is another interesting detail:
I used to connect to Romanian PPTP VPN to bypass my home provider's web censorship and it always worked in my home city, but when I connected to the same VPN from other city (where the L2TP IPsec failed), I discovered that the site of my interest is still censored. The only explanation that comes to my mind is that provider acts like a MITM. It seems that the provider uses following tactics: tap the line, when impossible, then prevent from connecting.
networking vpn mikrotik-routeros l2tp
edited Dec 14 '18 at 21:54
Duncan X Simpson
1,105823
asked Jan 8 '16 at 19:16
PaulPaul
3001924
1
ISPs can and will mess with your traffic. Maybe your own ISP has a policy of not allowing L2TP into his customer-facing network, but does not enforce this inside it.
– Eugen Rieck
Jan 8 '16 at 19:19
@Eugen Rieck: My local provider doesn't block L2TP because I am able to connect from cellular phone through HSDPA and 3G from within my city. Is there some way to mask L2TP traffic from ISP ?
– Paul
Jan 8 '16 at 19:55
add a comment |
I have a well working L2TP IPSec connection from any mobile or desktop client to my Mikrotik RB2011UiAS-2HnD-IN (RouterOS v6.30.2). It works when I connect through any mobile or stationary ISP within my city. The log of a successful connection looks approximately so:
ipsec, error key length mismatched, mine:128 peer:256.
ipsec, error authtype mismatched: my:hmac-sha1 peer:hmac-md5
l2tp, info first L2TP UDP packet received from X.X.X.X
l2tp, ppp, info, account MyUser logged in, 192.168.111.246
l2tp, ppp, info <l2tp-MyUser>: authenticated
l2tp, ppp, info <l2tp-MyUser>: connected
l2tp, ppp, info <l2tp-MyUser>: terminating... - peer is not responding
l2tp, ppp, info, account MyUser logged out, 165 157 168 26 15
l2tp, ppp, info <l2tp-MyUser>: disconnected
Some days ago I attempted to connect from other city: through one mobile and one stationary ISP. The connection didn't succeed, and log contained only one line:
l2tp, info first L2TP UDP packet received from Y.Y.Y.Y
or such lines:
ipsec, error key length mismatched, mine:128 peer:256.
ipsec, error authtype mismatched: my:hmac-sha1 peer:hmac-md5
l2tp, info first L2TP UDP packet received from Y.Y.Y.Y
l2tp, info first L2TP UDP packet received from Y.Y.Y.Y
l2tp, info first L2TP UDP packet received from Y.Y.Y.Y
What is wrong? Can ISP block or corrupt L2TP IPSec connection?
P.S. There is another interesting detail:
I used to connect to Romanian PPTP VPN to bypass my home provider's web censorship and it always worked in my home city, but when I connected to the same VPN from other city (where the L2TP IPsec failed), I discovered that the site of my interest is still censored. The only explanation that comes to my mind is that provider acts like a MITM. It seems that the provider uses following tactics: tap the line, when impossible, then prevent from connecting.
networking vpn mikrotik-routeros l2tp
edited Dec 14 '18 at 21:54
Duncan X Simpson
1,105823
asked Jan 8 '16 at 19:16
PaulPaul
3001924
I have a well working L2TP IPSec connection from any mobile or desktop client to my Mikrotik RB2011UiAS-2HnD-IN (RouterOS v6.30.2). It works when I connect through any mobile or stationary ISP within my city. The log of a successful connection looks approximately so:
ipsec, error key length mismatched, mine:128 peer:256.
ipsec, error authtype mismatched: my:hmac-sha1 peer:hmac-md5
l2tp, info first L2TP UDP packet received from X.X.X.X
l2tp, ppp, info, account MyUser logged in, 192.168.111.246
l2tp, ppp, info <l2tp-MyUser>: authenticated
l2tp, ppp, info <l2tp-MyUser>: connected
l2tp, ppp, info <l2tp-MyUser>: terminating... - peer is not responding
l2tp, ppp, info, account MyUser logged out, 165 157 168 26 15
l2tp, ppp, info <l2tp-MyUser>: disconnected
Some days ago I attempted to connect from other city: through one mobile and one stationary ISP. The connection didn't succeed, and log contained only one line:
l2tp, info first L2TP UDP packet received from Y.Y.Y.Y
or such lines:
ipsec, error key length mismatched, mine:128 peer:256.
ipsec, error authtype mismatched: my:hmac-sha1 peer:hmac-md5
l2tp, info first L2TP UDP packet received from Y.Y.Y.Y
l2tp, info first L2TP UDP packet received from Y.Y.Y.Y
l2tp, info first L2TP UDP packet received from Y.Y.Y.Y
What is wrong? Can ISP block or corrupt L2TP IPSec connection?
P.S. There is another interesting detail:
I used to connect to Romanian PPTP VPN to bypass my home provider's web censorship and it always worked in my home city, but when I connected to the same VPN from other city (where the L2TP IPsec failed), I discovered that the site of my interest is still censored. The only explanation that comes to my mind is that provider acts like a MITM. It seems that the provider uses following tactics: tap the line, when impossible, then prevent from connecting.
networking vpn mikrotik-routeros l2tp
networking vpn mikrotik-routeros l2tp
edited Dec 14 '18 at 21:54
Duncan X Simpson
1,105823
asked Jan 8 '16 at 19:16
PaulPaul
3001924
edited Dec 14 '18 at 21:54
Duncan X Simpson
1,105823
asked Jan 8 '16 at 19:16
PaulPaul
3001924
edited Dec 14 '18 at 21:54
Duncan X Simpson
1,105823
edited Dec 14 '18 at 21:54
Duncan X Simpson
1,105823
edited Dec 14 '18 at 21:54
Duncan X Simpson
1,105823
1,105823
asked Jan 8 '16 at 19:16
PaulPaul
3001924
asked Jan 8 '16 at 19:16
PaulPaul
3001924
asked Jan 8 '16 at 19:16
PaulPaul
3001924
3001924
1
ISPs can and will mess with your traffic. Maybe your own ISP has a policy of not allowing L2TP into his customer-facing network, but does not enforce this inside it.
– Eugen Rieck
Jan 8 '16 at 19:19
@Eugen Rieck: My local provider doesn't block L2TP because I am able to connect from cellular phone through HSDPA and 3G from within my city. Is there some way to mask L2TP traffic from ISP ?
– Paul
Jan 8 '16 at 19:55
add a comment |
1
ISPs can and will mess with your traffic. Maybe your own ISP has a policy of not allowing L2TP into his customer-facing network, but does not enforce this inside it.
– Eugen Rieck
Jan 8 '16 at 19:19
@Eugen Rieck: My local provider doesn't block L2TP because I am able to connect from cellular phone through HSDPA and 3G from within my city. Is there some way to mask L2TP traffic from ISP ?
– Paul
Jan 8 '16 at 19:55
1
1
ISPs can and will mess with your traffic. Maybe your own ISP has a policy of not allowing L2TP into his customer-facing network, but does not enforce this inside it.
– Eugen Rieck
Jan 8 '16 at 19:19
ISPs can and will mess with your traffic. Maybe your own ISP has a policy of not allowing L2TP into his customer-facing network, but does not enforce this inside it.
– Eugen Rieck
Jan 8 '16 at 19:19
@Eugen Rieck: My local provider doesn't block L2TP because I am able to connect from cellular phone through HSDPA and 3G from within my city. Is there some way to mask L2TP traffic from ISP ?
– Paul
Jan 8 '16 at 19:55
@Eugen Rieck: My local provider doesn't block L2TP because I am able to connect from cellular phone through HSDPA and 3G from within my city. Is there some way to mask L2TP traffic from ISP ?
– Paul
Jan 8 '16 at 19:55
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1023664%2fl2tp-ipsec-doesnt-work-from-other-city%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1023664%2fl2tp-ipsec-doesnt-work-from-other-city%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
ISPs can and will mess with your traffic. Maybe your own ISP has a policy of not allowing L2TP into his customer-facing network, but does not enforce this inside it.
– Eugen Rieck
Jan 8 '16 at 19:19
@Eugen Rieck: My local provider doesn't block L2TP because I am able to connect from cellular phone through HSDPA and 3G from within my city. Is there some way to mask L2TP traffic from ISP ?
– Paul
Jan 8 '16 at 19:55