VPN on OS X Lion Server

Question

I'm trying to configure VPN on my Mac Mini Server running OS X Lion 10.7.1 with Server app.

I have a SKY D-Link ADSL router connected via ethernet is Apple AirPort Extreme and my other devices including my Mini connect to my AirPort Extreme via Wi-Fi.

I don't have a Static IP so I am using DynDNS. I have installed the DynDNS Mac application on my Mini.

I have set the hostname on my mini to the hostname provided by DynDNS and I have set my Mini a static LAN IP of 192.168.0.100.

I have turned the VPN service on the Mini's server app, set a secret key and set a range for VPN connections of 192.168.0.101 - 192.168.0.200

For testing purposes I have enabled and forwarded all ports for incoming services to 192.168.0.100 on my D-Link Sky router.

I have tried to connect my iPhone using my DynDNS host name authenticating with a network account I have created and my secret key. I get an error the L2TP-VPN server did not respond.

My internet connection is working correctly on both my network and my iPhones data plan I have checked with my ISP and they do not block VPN connections.

Answer 1

I was getting the same error. In my case it turned out to be a conflict with "Back to My Mac"—specifically within my Airport Extreme. Once I removed my iCloud user account from the Airport Extreme, OS X Server's VPN started responding.

If there are any Airport Extreme/Express devices on your network, definitely remove any iCloud/MobileMe accounts using Airport Utility.

You may also have Back to My Mac turned on in System Preferences—and it's conceivable that could cause a problem as well...

I recommend (at least temporarily) checking that no user accounts have Back to My Mac enabled in the iCloud pane of System Preferences; I would verify this on every user account on every Mac on your network.

Good luck!

Answer 2

I suspect that the problem is that your router is not forwarding the traffic to the server. You said you've forwarded all ports to the server, but that only applies to the TCP and UDP protocols; both VPN protocols Lion Server supports use TCP and UDP to negotiate the connection, but then switch to an alternate IP protocol (with no associated port number) for transferring the actual data. If you use the L2TP/IPSec type of VPN connection, it needs the ESP/IP protocol forwarded at the router; if you use PPTP, it needs GRE/IP forwarded.

If the router cannot be made to forward these protocols, you will not be able to access the VPN server from the outside. The D-Link router I have here (undoubtedly a different model, but still...) has options in Advanced -> Virtual Server to forward "IPSec" (which should include ESP, but I haven't tested it) and/or PPTP (which should include GRE). It also has an option in Adcanced -> Firewall Settings to enable the server as a DMZ host, which should forward almost everything to it. You may have to do a bit of experimentation to see what (if anything) works.

BTW, just to complicate things, both VPN protocols may be blocked by client-side routers that don't know how to cope with ESP and/or GRE. This makes testing difficult, since if you fail to connect you don't necessarily know if the problem is on the server or client side... If you have a way to try connecting from just outside the router, so you know there's nothing in the way on the client's end, you'll have a much better idea what's going on.

Answer 3

I'm having a similar issue, but I suppose the problem is with my ISP, who filters arbitrarily undesired traffic.

The first thing I would suggest is using an IP range less common than 192.168.0.x in your LAN, because usually a VPN connects two networks having different IP classes. The IP class you are using is too common, and in many cases the remote LAN from which you're trying to connect to your VPN uses the same class (see TA25227 for private network classes).

In addition, upgrade to Lion v. 10.7.2 and explicitly assign access rights to VPN service to all the users that will be allowed to log in (using Server Admin).