VPN client to site connection simultaneously for multiple users/PC in the 1 subnet

[tuanhoangth1603]

ISSUE TYPE

• Other

COMPONENT NAME

VPN Client to site

CLOUDSTACK VERSION

4.17.2.0

OS / ENVIRONMENT

Ubuntu 20.04

SUMMARY

I created a VPC, where I enabled VPN Client to Site and created 2 users, vpn1 and vpn2. I used 2 PCs in the same subnet 172.16.10.0/24 to connect to the VPN.

PC 1: Successfully connected to the VPN and can ping the VM within the VPC.
PC 2: Unable to connect to the VPN if PC 1 is already connected to the VPN. If I disconnect the VPN on PC 1, then PC 2 can establish a VPN connection.

I am using the Draytek Smart VPN app for both PCs. Is there any issue to be aware of when using VPN Client to Site for 2 or more PCs in the same network subnet?

Thank you for any assistance!

EXPECTED RESULTS

Both PCs can establish a VPN connection simultaneously.

[tuanhoangth1603]

There is the log I got from the VR

Jan 25 04:22:22 r-443-VM charon[4019]: 15[NET] received packet: from 102.119.162.40[23171] to 102.119.162.26[4500] (444 bytes)
Jan 25 04:22:22 r-443-VM charon[4019]: 15[ENC] parsed QUICK_MODE request 3 [ HASH SA No ID ID NAT-OA NAT-OA ]
Jan 25 04:22:22 r-443-VM charon[4019]: 15[CFG] selected proposal: ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ
Jan 25 04:22:22 r-443-VM charon[4019]: 15[IKE] received 3600s lifetime, configured 0s
Jan 25 04:22:22 r-443-VM charon[4019]: 15[IKE] received 250000000 lifebytes, configured 0
Jan 25 04:22:22 r-443-VM charon[4019]: 15[IKE] detected rekeying of CHILD_SA L2TP-PSK{647}
Jan 25 04:22:22 r-443-VM charon[4019]: 15[ENC] generating QUICK_MODE response 3 [ HASH SA No ID ID NAT-OA NAT-OA ]
Jan 25 04:22:22 r-443-VM charon[4019]: 15[NET] sending packet: from 102.119.162.26[4500] to 102.119.162.40[23171] (204 bytes)
Jan 25 04:22:22 r-443-VM charon[4019]: 12[NET] received packet: from 102.119.162.40[23171] to 102.119.162.26[4500] (76 bytes)
Jan 25 04:22:22 r-443-VM charon[4019]: 12[ENC] parsed INFORMATIONAL_V1 request 3468119228 [ HASH D ]
Jan 25 04:22:22 r-443-VM charon[4019]: 12[IKE] received DELETE for ESP CHILD_SA with SPI 5af7e8ae
Jan 25 04:22:22 r-443-VM charon[4019]: 12[IKE] closing CHILD_SA L2TP-PSK{647} with SPIs c8f197ae_i (132 bytes) 5af7e8ae_o (100 bytes) and TS 102.119.162.26/32[udp/l2f] === 102.119.162.40/32[udp/l2f]
Jan 25 04:22:22 r-443-VM charon[4019]: 12[IKE] closing CHILD_SA L2TP-PSK{647} with SPIs c8f197ae_i (132 bytes) 5af7e8ae_o (100 bytes) and TS 102.119.162.26/32[udp/l2f] === 102.119.162.40/32[udp/l2f]
Jan 25 04:22:22 r-443-VM vpn[199474]: - 172.16.10.4 102.119.162.40 -- 102.119.162.26
Jan 25 04:22:22 r-443-VM charon[4019]: 14[NET] received packet: from 102.119.162.40[23171] to 102.119.162.26[4500] (60 bytes)
Jan 25 04:22:22 r-443-VM charon[4019]: 14[ENC] parsed QUICK_MODE request 3 [ HASH ]
Jan 25 04:22:22 r-443-VM charon[4019]: 14[IKE] CHILD_SA L2TP-PSK{649} established with SPIs c1c4921c_i 979b6bb8_o and TS 102.119.162.26/32[udp/l2f] === 102.119.162.40/32[udp/l2f]
Jan 25 04:22:22 r-443-VM charon[4019]: 14[IKE] CHILD_SA L2TP-PSK{649} established with SPIs c1c4921c_i 979b6bb8_o and TS 102.119.162.26/32[udp/l2f] === 102.119.162.40/32[udp/l2f]
Jan 25 04:22:22 r-443-VM vpn[199481]: + 172.16.10.4 102.119.162.40 -- 102.119.162.26
Jan 25 04:22:31 r-443-VM CRON[199415]: pam_unix(cron:session): session closed for user root
Jan 25 04:22:32 r-443-VM xl2tpd[4033]: Maximum retries exceeded for tunnel 9071.  Closing.
Jan 25 04:22:32 r-443-VM xl2tpd[4033]: Terminating pppd: sending TERM signal to pid 197893
Jan 25 04:22:32 r-443-VM xl2tpd[4033]: Connection 5 closed to 102.119.162.40, port 1701 (Timeout)
Jan 25 04:22:32 r-443-VM pppd[197893]: Terminating on signal 15
Jan 25 04:22:32 r-443-VM pppd[197893]: Connect time 7.5 minutes.
Jan 25 04:22:32 r-443-VM pppd[197893]: Sent 0 bytes, received 2007 bytes.
Jan 25 04:22:32 r-443-VM charon[4019]: 09[KNL] interface ppp1 deactivated
Jan 25 04:22:32 r-443-VM charon[4019]: 07[KNL] 10.1.2.1 disappeared from ppp1
Jan 25 04:22:32 r-443-VM pppd[197893]: Script /etc/ppp/ip-down started (pid 199492)
Jan 25 04:22:32 r-443-VM pppd[197893]: Overriding mtu 1500 to 1410
Jan 25 04:22:32 r-443-VM pppd[197893]: PPPoL2TP options: lnsmode tid 9071 sid 35337 debugmask 0
Jan 25 04:22:32 r-443-VM pppd[197893]: Overriding mru 1500 to mtu value 1410
Jan 25 04:22:32 r-443-VM pppd[197893]: sent [LCP TermReq id=0x4 "User request"]
Jan 25 04:22:32 r-443-VM pppd[197893]: rcvd [LCP TermAck id=0x4 "User request"]
Jan 25 04:22:32 r-443-VM pppd[197893]: Connection terminated.
Jan 25 04:22:32 r-443-VM charon[4019]: 12[KNL] interface ppp1 deleted
Jan 25 04:22:32 r-443-VM pppd[197893]: Waiting for 1 child processes...
Jan 25 04:22:32 r-443-VM pppd[197893]:   script /etc/ppp/ip-down, pid 199492
Jan 25 04:22:32 r-443-VM pppd[197893]: Script /etc/ppp/ip-down finished (pid 199492), status = 0x0
Jan 25 04:22:32 r-443-VM pppd[197893]: Exit.
Jan 25 04:22:33 r-443-VM xl2tpd[4033]: get_call: can't find call 35337 in tunnel 9071
                                        (ref=0/0)
Jan 25 04:22:33 r-443-VM xl2tpd[4033]: control_finish: Connection closed to 102.119.162.40, port 1701 (), Local: 9071, Remote: 5
Jan 25 04:22:33 r-443-VM charon[4019]: 13[NET] received packet: from 102.119.162.40[23171] to 102.119.162.26[4500] (76 bytes)
Jan 25 04:22:33 r-443-VM ipsec[4019]: 15[NET] sending packet: from 102.119.162.26[4500] to 102.119.162.40[1242] (204 bytes)
Jan 25 04:22:33 r-443-VM ipsec[4019]: 16[NET] received packet: from 102.119.162.40[1242] to 102.119.162.26[4500] (60 bytes)
Jan 25 04:22:33 r-443-VM ipsec[4019]: 16[ENC] parsed QUICK_MODE request 1 [ HASH ]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 16[IKE] CHILD_SA L2TP-PSK{646} established with SPIs c1d4c52d_i b80e7c46_o and TS 102.119.162.26/32[udp/l2f] === 102.119.162.40/32[udp/l2f]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 11[NET] received packet: from 102.119.162.40[23171] to 102.119.162.26[4500] (444 bytes)
Jan 25 04:22:33 r-443-VM ipsec[4019]: 11[ENC] parsed QUICK_MODE request 2 [ HASH SA No ID ID NAT-OA NAT-OA ]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 11[CFG] selected proposal: ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ
Jan 25 04:22:33 r-443-VM ipsec[4019]: 11[IKE] received 3600s lifetime, configured 0s
Jan 25 04:22:33 r-443-VM ipsec[4019]: 11[IKE] received 250000000 lifebytes, configured 0
Jan 25 04:22:33 r-443-VM ipsec[4019]: 11[IKE] detected rekeying of CHILD_SA L2TP-PSK{645}
Jan 25 04:22:33 r-443-VM ipsec[4019]: 11[ENC] generating QUICK_MODE response 2 [ HASH SA No ID ID NAT-OA NAT-OA ]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 11[NET] sending packet: from 102.119.162.26[4500] to 102.119.162.40[23171] (204 bytes)
Jan 25 04:22:33 r-443-VM ipsec[4019]: 09[NET] received packet: from 102.119.162.40[23171] to 102.119.162.26[4500] (76 bytes)
Jan 25 04:22:33 r-443-VM ipsec[4019]: 09[ENC] parsed INFORMATIONAL_V1 request 2287742730 [ HASH D ]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 09[IKE] received DELETE for ESP CHILD_SA with SPI 45472b16
Jan 25 04:22:33 r-443-VM ipsec[4019]: 09[IKE] closing CHILD_SA L2TP-PSK{645} with SPIs cac9101c_i (3643 bytes) 45472b16_o (1203 bytes) and TS 102.119.162.26/32[udp/l2f] === 102.119.162.40/32[udp/l2f]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 10[NET] received packet: from 102.119.162.40[23171] to 102.119.162.26[4500] (60 bytes)
Jan 25 04:22:33 r-443-VM ipsec[4019]: 10[ENC] parsed QUICK_MODE request 2 [ HASH ]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 10[IKE] CHILD_SA L2TP-PSK{647} established with SPIs c8f197ae_i 5af7e8ae_o and TS 102.119.162.26/32[udp/l2f] === 102.119.162.40/32[udp/l2f]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 11[NET] received packet: from 102.119.162.40[1242] to 102.119.162.26[4500] (444 bytes)
Jan 25 04:22:33 r-443-VM ipsec[4019]: 11[ENC] parsed QUICK_MODE request 2 [ HASH SA No ID ID NAT-OA NAT-OA ]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 11[CFG] selected proposal: ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ
Jan 25 04:22:33 r-443-VM ipsec[4019]: 11[IKE] received 3600s lifetime, configured 0s
Jan 25 04:22:33 r-443-VM ipsec[4019]: 11[IKE] received 250000000 lifebytes, configured 0
Jan 25 04:22:33 r-443-VM ipsec[4019]: 11[IKE] detected rekeying of CHILD_SA L2TP-PSK{646}
Jan 25 04:22:33 r-443-VM ipsec[4019]: 11[ENC] generating QUICK_MODE response 2 [ HASH SA No ID ID NAT-OA NAT-OA ]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 11[NET] sending packet: from 102.119.162.26[4500] to 102.119.162.40[1242] (204 bytes)
Jan 25 04:22:33 r-443-VM ipsec[4019]: 07[NET] received packet: from 102.119.162.40[1242] to 102.119.162.26[4500] (60 bytes)
Jan 25 04:22:33 r-443-VM ipsec[4019]: 07[ENC] parsed QUICK_MODE request 2 [ HASH ]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 07[IKE] CHILD_SA L2TP-PSK{648} established with SPIs cbe14f75_i 2ea41a5a_o and TS 102.119.162.26/32[udp/l2f] === 102.119.162.40/32[udp/l2f]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 09[NET] received packet: from 102.119.162.40[1242] to 102.119.162.26[4500] (76 bytes)
Jan 25 04:22:33 r-443-VM ipsec[4019]: 09[ENC] parsed INFORMATIONAL_V1 request 535906467 [ HASH D ]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 09[IKE] received DELETE for ESP CHILD_SA with SPI b80e7c46
Jan 25 04:22:33 r-443-VM ipsec[4019]: 09[IKE] closing CHILD_SA L2TP-PSK{646} with SPIs c1d4c52d_i (288 bytes) b80e7c46_o (94 bytes) and TS 102.119.162.26/32[udp/l2f] === 102.119.162.40/32[udp/l2f]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 15[NET] received packet: from 102.119.162.40[23171] to 102.119.162.26[4500] (444 bytes)
Jan 25 04:22:33 r-443-VM ipsec[4019]: 15[ENC] parsed QUICK_MODE request 3 [ HASH SA No ID ID NAT-OA NAT-OA ]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 15[CFG] selected proposal: ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ
Jan 25 04:22:33 r-443-VM ipsec[4019]: 15[IKE] received 3600s lifetime, configured 0s
Jan 25 04:22:33 r-443-VM ipsec[4019]: 15[IKE] received 250000000 lifebytes, configured 0
Jan 25 04:22:33 r-443-VM ipsec[4019]: 15[IKE] detected rekeying of CHILD_SA L2TP-PSK{647}
Jan 25 04:22:33 r-443-VM ipsec[4019]: 15[ENC] generating QUICK_MODE response 3 [ HASH SA No ID ID NAT-OA NAT-OA ]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 15[NET] sending packet: from 102.119.162.26[4500] to 102.119.162.40[23171] (204 bytes)
Jan 25 04:22:33 r-443-VM ipsec[4019]: 12[NET] received packet: from 102.119.162.40[23171] to 102.119.162.26[4500] (76 bytes)
Jan 25 04:22:33 r-443-VM ipsec[4019]: 12[ENC] parsed INFORMATIONAL_V1 request 3468119228 [ HASH D ]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 12[IKE] received DELETE for ESP CHILD_SA with SPI 5af7e8ae
Jan 25 04:22:33 r-443-VM ipsec[4019]: 12[IKE] closing CHILD_SA L2TP-PSK{647} with SPIs c8f197ae_i (132 bytes) 5af7e8ae_o (100 bytes) and TS 102.119.162.26/32[udp/l2f] === 102.119.162.40/32[udp/l2f]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 14[NET] received packet: from 102.119.162.40[23171] to 102.119.162.26[4500] (60 bytes)
Jan 25 04:22:33 r-443-VM ipsec[4019]: 14[ENC] parsed QUICK_MODE request 3 [ HASH ]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 14[IKE] CHILD_SA L2TP-PSK{649} established with SPIs c1c4921c_i 979b6bb8_o and TS 102.119.162.26/32[udp/l2f] === 102.119.162.40/32[udp/l2f]
Jan 25 04:22:33 r-443-VM ipsec[4019]: 09[KNL] interface ppp1 deactivated
Jan 25 04:22:33 r-443-VM ipsec[4019]: 07[KNL] 10.1.2.1 disappeared from ppp1
Jan 25 04:22:33 r-443-VM ipsec[4019]: 12[KNL] interface ppp1 deleted
Jan 25 04:22:33 r-443-VM ipsec[4019]: 13[NET] received packet: from 102.119.162.40[23171] to 102.119.162.26[4500] (76 bytes)
Jan 25 04:22:33 r-443-VM ipsec[4019]: 13[ENC] parsed INFORMATIONAL_V1 request 1154710835 [ HASH D ]
Jan 25 04:22:33 r-443-VM charon[4019]: 13[ENC] parsed INFORMATIONAL_V1 request 1154710835 [ HASH D ]
Jan 25 04:22:33 r-443-VM charon[4019]: 13[IKE] received DELETE for ESP CHILD_SA with SPI 979b6bb8
Jan 25 04:22:33 r-443-VM charon[4019]: 13[IKE] closing CHILD_SA L2TP-PSK{649} with SPIs c1c4921c_i (128 bytes) 979b6bb8_o (180 bytes) and TS 102.119.162.26/32[udp/l2f] === 102.119.162.40/32[udp/l2f]
Jan 25 04:22:33 r-443-VM charon[4019]: 13[IKE] closing CHILD_SA L2TP-PSK{649} with SPIs c1c4921c_i (128 bytes) 979b6bb8_o (180 bytes) and TS 102.119.162.26/32[udp/l2f] === 102.119.162.40/32[udp/l2f]
Jan 25 04:22:33 r-443-VM vpn[199507]: - 172.16.10.4 102.119.162.40 -- 102.119.162.26
Jan 25 04:22:33 r-443-VM charon[4019]: 05[NET] received packet: from 102.119.162.40[23171] to 102.119.162.26[4500] (92 bytes)
Jan 25 04:22:33 r-443-VM charon[4019]: 05[ENC] parsed INFORMATIONAL_V1 request 2884890289 [ HASH D ]
Jan 25 04:22:33 r-443-VM charon[4019]: 05[IKE] received DELETE for IKE_SA L2TP-PSK[371]
Jan 25 04:22:33 r-443-VM charon[4019]: 05[IKE] deleting IKE_SA L2TP-PSK[371] between 102.119.162.26[102.119.162.26]...102.119.162.40[172.16.10.4]
Jan 25 04:22:33 r-443-VM charon[4019]: 05[IKE] deleting IKE_SA L2TP-PSK[371] between 102.119.162.26[102.119.162.26]...102.119.162.40[172.16.10.4]

[tuanhoangth1603]

I think the issue is not due to both PCs being in the same subnet but rather because they share the same public IP. Even when I tried using two PCs in different subnets but with the same public IP for internet access, I encountered a similar error.
And I found an issue of strongswan related to "The problem is that two clients behind the same NAT that both use transport mode can't be distinguished in many situations."
https://wiki.strongswan.org/issues/365

[DaanHoogland]

@tuanhoangth1603 will this work when you acquire an extra IP address and configure one of the two VPN on that address?

[tuanhoangth1603]

Sorry @DaanHoogland, I don't understand what you mean. Please provide more detail.
Thanks!

[DaanHoogland]

@tuanhoangth1603 I don't think I understand your problem either. You have a VPN to one address in your VPC and want to connect to two VMs inside it, am I correct?
And then you get a connection with one outside computer but not with a second.

[rajujith]

I think the issue is not due to both PCs being in the same subnet but rather because they share the same public IP. Even when I tried using two PCs in different subnets but with the same public IP for internet access, I encountered a similar error. And I found an issue of strongswan related to "The problem is that two clients behind the same NAT that both use transport mode can't be distinguished in many situations." https://wiki.strongswan.org/issues/365

@tuanhoangth1603 the strongswan issue has this log snippet "the same policy for reqid 1 exists" but the logs you pasted here do not have it. Is it the right log snippet?

[weizhouapache]

@tuanhoangth1603 I don't think I understand your problem either. You have a VPN to one address in your VPC and want to connect to two VMs inside it, am I correct? And then you get a connection with one outside computer but not with a second.

@DaanHoogland
As I understand the issue is, the two clients (user side) behind same SNAT, cannot connect to the remote access VPN at the same time.

@tuanhoangth1603
I recall the issue many years ago (openswan was used in VR at that time).
I have no idea how to fix it.

[tuanhoangth1603]

@weizhouapache you're right, that is exactly my problem.
If so, we cannot allow 2 clients (user side) connect to the remote VPN at the same time now, right?

[weizhouapache]

@weizhouapache you're right, that is exactly my problem. If so, we cannot allow 2 clients (user side) connect to the remote VPN at the same time now, right?

@tuanhoangth1603
I found these in my bookmarks:
https://wiki.strongswan.org/issues/365
https://www.mail-archive.com/users@lists.strongswan.org/msg08057.html
https://docs.strongswan.org/docs/5.9/plugins/connmark.html#_windows_l2tp

the issue seems to be fixable , but requires some code changes (and probably new packages as well).

[tuanhoangth1603]

@weizhouapache Thanks for your infor.
Looking forward to the new package soon.