Windows – Error 809 when trying to connect Windows 7 with IPsec

ipsecvpnwindows 7

Using IPFire 2.17 Core 89 as the IPsec-server, Windows 7 shows the error message "Error 809: The network connection between your computer and the VPN could not be established because the remote server is not responding.". when trying to connect.

From the logs:

charon: 15[NET] sending packet: from <ipsec-ip>[500] to <client-ip>[500] (337 bytes)
charon: 11[JOB] deleting half open IKE_SA after timeout

Best Answer

The firewall was missing a rule for incoming UDP packets on port 500. This should have been generated automatically but (sometimes) failed.

After adding that rule manually, the problem was solved. The IPfire project also created a patch that will probably fix the root cause.

Related Solutions

Windows VPN – Fixing Error 619 Connection Issues

I've finally found the holy grail:

http://www.jcsilva.com/2011/01/09/issues-with-dd-wrt-gre-forwarding-pptp/

This page says the following:

Issues With DD-WRT GRE Forwarding PPTP

A quick fix for DD-WRT not forwarding GRE PPTP packets.

Add the following commands to the startup commands (Administration->Commands):

/sbin/insmod xt_connmark
/sbin/insmod xt_mark
/sbin/insmod nf_conntrack_proto_gre
/sbin/insmod nf_conntrack_pptp
/sbin/insmod nf_nat_proto_gre
/sbin/insmod nf_nat_pptp

As a side note, I'm not sure why the Professional machine was able to connect correctly and at this point I don't really care now that I have a real solution that isn't enabling the DMZ.

Networking – IPSec with or without L2TP

Android since 4.0 supports plain IPsec out of the box. And there are several apps for 4.x that provide other VPN protocols on unrooted devices (e.g. IKEv2/IPsec with the strongSwan VPN Client).

Since Windows 7 you can use the built-in IKEv2/IPsec client. Granted racoon does not support IKEv2, but there are other open-source implementations that do (e.g. strongSwan or Libreswan).

Does anyone know why L2TP is still the standard way with IPSec?

I wouldn't say it's the standard way, as e.g. Windows 7 and newer first try IKEv2, but I agree that clients still offer it quite prominently.

One reason for its initial success was probably that it allowed reusing the PPP infrastructure that existed for dial-up connections (while being more secure and standardized than PPTP). And because L2TP installations have been around for a long time, and were deployed pretty widespread, about any client had (and still has) to support it. This makes it, of course, easier for VPN providers as they can reduce the number of offered VPN technologies. This, however, reduces the incentive to implement other protocols in clients.

There could also be licensing issues preventing other protocols from being used, for instance, the IKEv2 implementations mentioned above are GPL licensed, which Apple in iOS and Google in Android tend to avoid in favour of more permissively licensed software such as racoon (which they both use in their products).

Best Answer

Related Solutions

Windows VPN – Fixing Error 619 Connection Issues

Networking – IPSec with or without L2TP

Related Question