I am using a Mac mini OS X Mountain Lion Server (10.8.5). My goal is to have the server's own VPN service running over L2TP only.

The Mac mini is behind an AirPort Extreme (4th generation)

AirPort Extreme has:

  • static IPv4 address

  • no connection sharing (bridged mode)

  • Back To My Mac disabled (as for all the Macs and AirPorts on the network)

  • Internet connection via Ethernet to my ISP's box

ISP's box:

  • has static public IP address

  • is the DHCP server with

    • IP addresses reservations configured for my AirPort Extreme & Mac mini and

    • private IP addresses from x.x.x.10 up-to x.x.x.50

  • has NAT/PAT rules for

    • UDP 500 - ISAKMP/IKE

    • UDP 4500 - IPsec NAT-Traversal

    • UDP 1701 - L2TP

    • ESP/IP 50

    • AH/IP 51

Mac mini Server:

  • has static IP address

  • is the DNS server for the network

  • is (of course) the VPN server with the configuration as follows:

    • setup for: L2TP only

    • VPN hostname: public IP address

    • Shared secret: dull-8caracter word

    • Addresses: 10 for L2TP x.x.x.200 up-to x.x.x.209

    • Name server:
      my MacMini private-static IP address + ISP'Box private IP address + google DNS

    • Routes:
      x.x.x.0 (my private network) private public

NB: My ISP is NOT blocking any ports.

I am aware of the "advanced" guide provided by Apple.

I have been able to access the server when inside my network (-_-)

Trying to connect from 3G network with iPhone 4 gives

"L2TP VPN server did not respond"

Trying to connect from 3G OR other ADSL network with Windows8 gives

"error 789 the L2TP connection attempt failed because the security layer encountered a processing error during initial negociations with the remote computer"

Is this real life?

  • 1
    are you able to configure the MacMini as the DMZ host on the ISP device (to rule out port forwarding issues)? Commented Oct 26, 2013 at 14:55
  • I am not. The MacMini that has to be added the VPN-server functionality cannot be placed in DMZ (due to network architecture choices). I have to point out that the ISP customer service (for technical information) along with its provided in-house device (advanced configuration hell) are holding me back. At this point I'm following two tracks: - Change for an earlier (& said more "docile") device OR a Cisco WR 3xxx series. - Maverick is free, so i might just restart from scratch with its install. so more on that soon. Commented Oct 27, 2013 at 8:55

2 Answers 2


According to Apple, L2TP is currently inoperative when the VPN server is NATed. Looks like we have to wait for a bug fix, or use PPTP in the mean time despite it's much lower security.

Remember, if you configure PPTP, you need to activate OpenDirectory, and configure users there. Local users CANNOT use PPTP.

References: http://support.apple.com/kb/TS5313 http://support.apple.com/kb/HT4748

  • Thanks on that clarification. Do you know if that is the case for OS X Server Mountain Lion ? Commented Nov 16, 2013 at 10:57
  • The iShop tech'guy said it needed to be straight after the ISP'sBOX inside my Ntw.. but was not confident enough to actually make an quote on that install ! maybe he came by here... I hope L2TP works now in Mavericks'Server! Commented Jan 28, 2014 at 7:13

Works with Yosemite (L2TP VPN Server behind a NAT gateway)

  • Welcome to the site. Be sure to completely answer the question in your answer. low quality submissions get down voted and deleted.
    – bmike
    Commented Apr 17, 2015 at 17:57
  • I understand that @bmike but it is still an interresting update Commented Apr 18, 2015 at 8:17
  • This is a useful answer, even though it's of low quality. Not sure why it's been downvoted into oblivion. Although the poster is gone, perhaps somebody could edit it with more details? Commented Dec 21, 2015 at 17:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .