1

I use a VPN from my Mac (OS X El Capitan). It works fine everywhere... except for one particular guest Wifi network, where I simply cannot connect to the VPN: it shows "Connecting..." in the menubar for a few seconds, then fails. Verify the server address and try reconnecting.". The VPN configuration seems fine, as it works fine from every other network.

How do I debug the cause of this? Is this network blocking access to this VPN? How would I tell?

Here are the log messages in /var/log/system.log:

racoon[40908]: accepted connection on vpn control socket.
racoon[40908]: IPSec connecting to server X.X.X.X
racoon[40908]: Connecting.
racoon[40908]: IPSec Phase 1 started (Initiated by me).
racoon[40908]: IKE Packet: transmit success. (Initiator, Aggressive-Mode message 1).
racoon[40908]: >>>>> phase change status = Phase 1 started by us
racoon[40908]: IKE Packet: transmit success. (Phase 1 Retransmit).
--- last message repeated 2 times ---
racoon[40908]: IPSec connecting to server X.X.X.X
racoon[40908]: Connecting.
racoon[40908]: IPSec Phase 1 started (Initiated by me).
racoon[40908]: IKE Packet: transmit success. (Initiator, Aggressive-Mode message 1).
racoon[40908]: >>>>> phase change status = Phase 1 started by us
racoon[40908]: port 62465 expected, but 0
racoon[40908]: IKEv1 Phase 1 AUTH: success. (Initiator, Aggressive-Mode Message 2).
racoon[40908]: >>>>> phase change status = Phase 1 started by peer
racoon[40908]: IKE Packet: receive success. (Initiator, Aggressive-Mode message 2).
racoon[40908]: IKEv1 Phase 1 Initiator: success. (Initiator, Aggressive-Mode).
racoon[40908]: IKE Packet: transmit success. (Initiator, Aggressive-Mode message 3).
racoon[40908]: IPSec Phase 1 established (Initiated by me).
racoon[40908]: IPSec disconnecting from server X.X.X.X
racoon[40908]: IKE Packet: transmit success. (Information message).
racoon[40908]: IKEv1 Information-Notice: transmit success. (Delete ISAKMP-SA).
racoon[40908]: failed to send vpn_control message: Broken pipe
racoon[40908]: glob found no matches for path "/var/run/racoon/*.conf"
racoon[40908]: IPSec disconnecting from server X.X.X.X

There is a precisely 30-second gap between Phase 1 established and IPSec disconnecting. I have full network connectivity from this guest Wifi network as long as I don't enable the VPN. I am in the US, so it is unlikely this is government censorship, but it might be some kind of blocking by the maintainer of the guest network. I can successfully ping the server IP address (anonymized to X.X.X.X in the logs above). Anything else to check?

|improve this question
  • it's possible this network doesn't allow ports other than web (80 and 443). Are you able to telnet your VPN server on its port? – sebastienvg Aug 23 '16 at 18:39
  • @stresscool, I'm able to SSH to other servers. I don't use telnet (it's not secure). It could still be some more targeted port blocking, I suppose. – D.W. Aug 23 '16 at 18:40
  • telnet is only to check if your VPN port is reachable or if the network you are on blocks it. If you are able to telnet on this port then the problem is not with the network you are connected to. SSH working means port 22 is open which usually is. – sebastienvg Aug 23 '16 at 18:42
  • @stresscool, ahh, now I understand what you mean. How do I figure out what port number the VPN server is using? All I know is that it is using IPSec. There is no port number listed in the Network Settings panel nor in the VPN configuration information given to me by the VPN provider. – D.W. Aug 23 '16 at 18:48
  • Looking at the logs I'd say 62465 – sebastienvg Aug 23 '16 at 18:49
1

It seems that the network you are on is blocking the port 62465 which your VPN server is using.

|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .