Jump to content
vraiment

Mavericks Server, VPN is trashed

3 posts in this topic

Recommended Posts

I have a mac home server (real MacMini, no hackintosh). It had Mountain Lion and the Server app. I had correctly configured my router to forward the VPN ports to the server and everything worked well.

 

Then I updated to Mavericks and the new Server app and, surprise! the VPN server no longer works outside my network. Inside my network I can connect to the VPN if I use the local IP, but if I use my external IP it fails to connect.

 

Reading the Apple Discussion forums it seems I'm not the only one, so anyone has any ideas?

 

Thanks

Share this post


Link to post
Share on other sites
Advertisement

Not just you- I spent 4 hours on the phone with Apple Enterprise Support (kept getting transferred up the support person chain). At one point we created a new account for the support person and they tried the VPN, which worked. At that point he told me if must be my connections on the other devices I was trying and that was all support could do- he also told me that when pinging my server he was seeing a lot of packet loss. After this I requested that he guide me through completely uninstalling the server, since every time I do this it carries over settings (right down to the shared secret) when reinstalling. He wanted to verify that we were doing it correctly so he put me on hold- at this point I ran a web based ping and traceroute (to rule out my local network) coming from Europe NO packet loss. We did a complete uninstall of the server portion and reinstall and the shared secret came back- which he could not explain. I then showed him the ping/traceroute- which he insisted since he could connect (which we could see in the logs) that it was my local networks for the other machines I was testing on. For instance trying my iPhone on AT&T's LTE network and a work laptop- VPN into the work network THEN trying to come back to my VPN network. I informed him that I was going to completely nuke the machine and start over- he advised that I try the VPN from a Starbucks first, still insisting that it was my local cell/work networks being spotty. 

 

I erased the main drive, re-installed Mavericks, then re-installed server 3 annnnnnnnd I am back to the same place. Currently I am testing from another location and still cannot get past the IKE Phase 1 portion of racoon's auth via hostname HOWEVER if I use Logmein to get back to another machine on the same network and use the IP I can use the VPN. 

 

Here's the log:

 

Oct 23 08:22:10 hostname racoon[224]: Connecting.
Oct 23 08:22:10 hostname racoon[224]: IPSec Phase 1 started (Initiated by peer).
Oct 23 08:22:10 hostname racoon[224]: IKE Packet: receive success. (Responder, Main-Mode message 1).
Oct 23 08:22:10 hostname racoon[224]: >>>>> phase change status = Phase 1 started by us
Oct 23 08:22:10 hostname racoon[224]: IKE Packet: transmit success. (Responder, Main-Mode message 2).
Oct 23 08:22:10 hostname racoon[224]: IKE Packet: receive success. (Responder, Main-Mode message 3).
Oct 23 08:22:10 hostname racoon[224]: IKE Packet: transmit success. (Responder, Main-Mode message 4).
Oct 23 08:22:10 hostname racoon[224]: Connecting.
Oct 23 08:22:14 hostname racoon[224]: IKE Packet: transmit success. (Phase 1 Retransmit).
Oct 23 08:22:47 --- last message repeated 3 times ---
Oct 23 08:22:50 hostname racoon[224]: IKE Packet: transmit success. (Phase 1 Retransmit).
Oct 23 08:23:10 hostname racoon[224]: IKE Packet: transmit success. (Phase 1 Retransmit).
Oct 23 08:23:59 --- last message repeated 1 time ---
Oct 23 08:23:59 hostname racoon[224]: IKE Packet: transmit success. (Phase 1 Retransmit).
Oct 23 08:24:56 --- last message repeated 1 time ---
Oct 23 08:24:59 hostname racoon[224]: IKEv1 Phase 1: maximum retransmits. (Phase 1 Maximum Retransmits).
Oct 23 08:24:59 hostname racoon[224]: Phase 1 negotiation failed due to time up. 2194c11c97819d97:a29d73f04fe7e67f
 
The L2TP-VPN server did not respond. Try reconnecting. If the problem continues, verify your settings and contact your Administrator.
 
Here’s the network topology- Internet > Modem > Airport Extreme > Mac Mini via ethernet. 
 
For the hostname DNS we are using a dynamic DNS service, which I have verified is resolving to the machine through the router ect. 
 
I have tried deleting the Server App and /Library/Server as well as any pref files I could find, then rebooting, after downloading the Server App again I found all of my settings are back. Also I’ve tried removing the Server Setup Done file as well in conjunction as well as independently with no luck. 
 
I have tried killing raccoon via the activity monitor as well as via the command line.
 
I am able to reach the machine locally via ssh and screen share, and externally via logmein. 
 
I have tried an iPhone 5s locally and externally, and two MacBook Airs internally and externally as well. 
 
I have deleted the VPN port forwarding entry in the Airport, tried putting it back manually as well as via the Server App and the drop down menu in the Airport.
 
I am 99% sure the traffic is reaching the server as I can see the following when I try to authenticate to the VPN, please note this is always the same for each VPN client
 
So at this point I am stuck either rolling back to ML or getting on the phone again with Enterprise Support who is convinced that it's not on them. 

 

Share this post


Link to post
Share on other sites

Spoke to Apple Enterprise Support this morning and they are aware of the issue now. We spent about 2 hours troubleshooting and trying everything the tech could think of, in the end he gathered logs from my server. At this point they are leaning towards an issues with NAT and Mavericks Server. They're working on it, most likely be addressed in an update to the Server app. Just wanted to share. 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By jxa
      I was wondering if there was a way to get private internet access to work in high Sierra 10.13.3? Currently crashes the system on connect. Seems to be an issue with the vpn ip retrieval.
       
      Ryzen 5 2600
      msi tomahawk b450
       
       
    • By dannymozzer_
      Hi,
       
      I've been trying to install Mavericks 10.9, I know it's older now, but It's honestly the version I want to use, the specs of the PC are:
      Asus P8H61-MX USB3
      i3-3220
      8GB DDR3 Memory
      GTX 750 ti
      500GB HDD
       
      I've been following this guide: https://www.insanelymac.com/forum/topic/280756-guide-the-all-in-one-guide-to-vanilla-os-x-including-chameleon-dsdt-for-beginners-updated-for-yosemite/
      But, after booting, this is the error screen I get, any guidance on what Kexts, SMBios settings, etc. I need? I can tell I'm probably missing something here.

      Thanks,
      Dan
    • By MaLd0n
      Now have a Olarila app, just download app and clover folder for your Chipset! https://olarila.com/forum/viewtopic.php?f=81&t=6771   Install MacOS with Olarila Image, Step by Step, Install and Post Install
       
      https://olarila.com/forum/viewtopic.php?f=50&t=8685
        Create a bootable copy of macOS Sierra Check out the link http://www.insanelymac.com/forum/files/file/559-flash-drive-maker/   --Install Clover in USB stick UEFI mode https://sourceforge.net/projects/cloverefiboot/files/Installer/   --Replace Folder CLOVER INSTALLATION.zip   --Install System and boot with USB STICK! --Install Clover in UEFI mode and replace with my folder  Mavericks / Yosemite CLOVER Mavericks-Yosemite.zip El Capitan / Sierra CLOVER El Capitan-Sierra.zip   --Reboot and activate video!   Bingo!   Now you need a fine tune! I prefer DSDT way, apply all patches in one file, many people prefer many SSDTs or Clover patches! If you need DSDT edit... -Post your full Clover folder with original tables in Origin folder(Extract with F4 in Clover boot screen) -Post Ioreg, extract with Ioreg Explorer http://www.insanelymac.com/forum/index.php?app=core&module=attach&section=attach&attach_id=222606 -Run it, post files generate in your desktop http://www.insanelymac.com/forum/index.php?app=core&module=attach&section=attach&attach_id=222609    --DSDT My DSDT DSDT.Asus Z97M-PLUS.zip   Patches  -FIX ERRORS AND WARNINGS -HPET -SATA -SLPB -EHCx -DARWIN -LPC -XHCI -HDEF -RTC -IRQs -SBUS -BUS1 -MCHC -HDMI -ALS0 -SHUTDOWN -LAN -PNLF --SSDT Generate your SSDT Power Management, use ssdtPRGen Piker-Alpha https://github.com/Piker-Alpha run in terminal curl -o ~/ssdtPRGen.sh https://raw.githubusercontent.com/Piker-Alpha/ssdtPRGen.sh/Beta/ssdtPRGen.sh chmod +x ~/ssdtPRGen.sh sudo ~/ssdtPRGen.sh ssdtPRGen.command.zip
       
      --SSDT i74790K
      SSDT.i7 4790K.zip
       
      --IOREG
      iMac.ioreg.zip
       
      Clear NVRAM, Purge and Kextcache Olarila.command.zip   stock coolerand Rio 40º    --FakeSMC http://www.hwsensors.com/releases --Audio http://www.insanelymac.com/forum/topic/314406-voodoohda-289/ --USB https://bitbucket.org/RehabMan/os-x-usb-inject-all/downloads --LAN http://www.insanelymac.com/forum/topic/304235-intelmausiethernetkext-for-intel-onboard-lan/   Credits and thanks to the old and new people in the community who developed patches, kexts and bootloaders!
    • By zeg66
      Please help me with this 10.9.5 system. Motherboard: Gigabyte 965p-s3 rev3.3, gpu: Ati Radeon HD6450 (dvi/hdmi/vga). 
      Using any of the 3 ports on the 6450 (dvi, hdmi, vga), I see all the white letters on black background during boot but when they complete and it's time for the graphics to start I get a black screen and sometimes a restart after that. Using Clover 4411. Is there any way to get past this?
    • By zeg66
      Could you please help me enable the VGA port on the GT710 in 10.9.5 13F34 ? 
      It is currently booting fine through its HDMI port, web driver 334.0103f01 and config.plist arguments checked: Verbose (-v), npci=0x2000, dart=0, nvda_drv=1
      The nvidia GT710 works fine through its VGA port and web drivers on a friend's Mac Pro 3,1
      I must soon return this borrowed HDMI monitor, mine only has a VGA port so I'd appreciate your input.
×