Connecting to an old modp1024 L2TP Ipsec VPN on Ubuntu 21.04
A client of Kensio Software is using an L2TP VPN with Ipsec that’s using an obsolete DH2 (modp1024) algorithm. This algorithm was considered insecure as far back as 2001, and has now been deprecated in encryption libraries such as libreswan.
Most of the permanent engineers at the client are on MacOS, which still supports DH2 / modp1024 algorithm out of the box. I was able to get the VPN connected on a Macbook, but still wanted to try and get it working on Ubuntu as that’s my main working OS.
This required manually compiling libreswan and network-manager-l2tp in order to enable the deprecated DH2 / modp1024 algorithm in them.
Remove repo-installed versions
If you’ve been trying to get a similar VPN working you’ve most likely tried installing libreswan and network-manager-l2tp from the repos. As we’re going to manually compile and install them, these will need removing first:
sudo apt-get remove libreswan network-manager-l2tp
Manually install libreswan with USE_DH2=true
Manually compile and install libreswan with the USE_DH2=true env flag to
enable the deprecated DH2 / modp1024 algorithm.
sudo apt-get install libnss3-dev libnspr4-dev pkg-config libpam-dev \
libcap-ng-dev libcap-ng-utils libselinux-dev \
libcurl3-nss-dev flex bison gcc make libldns-dev \
libunbound-dev libnss3-tools libevent-dev xmlto \
libsystemd-dev
git clone git@github.com:libreswan/libreswan.git
cd libreswan
export USE_DH2=true
USE_DH2=true make programs
USE_DH2=true sudo make install
Manually install network-manager-l2tp
Manually compile and install network-manager-l2tp with the
--enable-libreswan-dh2 option to enable use of the DH2 algorithm in libreswan
that we enabled above.
https://github.com/nm-l2tp/NetworkManager-l2tp/wiki/Building
sudo apt install \
build-essential \
git \
intltool \
libtool \
network-manager-dev \
libnm-dev \
libnma-dev \
ppp-dev \
libdbus-glib-1-dev \
libsecret-1-dev \
libgtk-3-dev \
libglib2.0-dev \
libssl-dev \
libnss3-dev \
libxml2-utils \
xl2tpd
git clone git@github.com:nm-l2tp/NetworkManager-l2tp.git
cd NetworkManager-l2tp
./autogen.sh
./configure \
--disable-static --prefix=/usr \
--sysconfdir=/etc --libdir=/usr/lib/x86_64-linux-gnu \
--libexecdir=/usr/lib/NetworkManager \
--localstatedir=/var \
--with-pppd-plugin-dir=/usr/lib/pppd/2.4.7
--enable-libreswan-dh2
make
sudo make install
Now reboot your OS:
sudo reboot
Configure the VPN
Now there’s some clicking around in the Network Manager UI, which is written up as notes here:
Settings -> VPN -> +
Gateway: [VPN gateway IP]
Type: Password
User name: [username]
Password: [password]
IPsec Settings...
[✔] Enable IPsec tunnel to L2TP host
Type: Pre-shared key (PSK)
Pre-shared key: [psk]
Advanced
Remote ID: [VPN gateway IP]
Phase1 Algorithms: [blank]
Phase2 Algorithms: [blank]
[✔] Enforce UDP encapsulation
[✔] Disable PFS
Now you can try connecting, and if you’re lucky the VPN will connect. If it still fails, don’t panic, as there are a couple more things to try below.
Potentially disable xl2tpd.service
sudo systemctl stop xl2tpd.service
If that does allow you to connect to the VPN, then make it permanent with:
sudo systemctl disable xl2tpd.service
Potentially unmask ipsec.service
The last thing that might be blocking the VPN connection is that the ipsec service is masked. If so you can unmask it with:
systemctl unmask ipsec.service
Good luck!