Hi i’m fairly new to Linux and have some difficulties setting up a VPN connection. I normally work with windows so please have some patience…
For some reason the authentication fails when I try to connect. I’m running SUSE Linux Enterprise Server 12 SP1 on an AWS EC2 C4XL instance.
I know the credentials are correct since they do work on my windows laptop.
The message when I try to connect:
[CODE] >pppd call wenvpn debug
using channel 7
Using interface ppp0
Connect: ppp0 <–> /dev/pts/1
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x10d31399> ]
rcvd [LCP ConfReq id=0x0 <magic 0x1>]
sent [LCP ConfAck id=0x0 <magic 0x1>]
rcvd [LCP ConfRej id=0x1 <asyncmap 0x0> ]
sent [LCP ConfReq id=0x2 <magic 0x10d31399>]
rcvd [LCP ConfAck id=0x2 <magic 0x10d31399>]
sent [LCP EchoReq id=0x0 magic=0x10d31399]
rcvd [CHAP Challenge id=0x1 <32974a249148a4532b170e8ac868b8e1>, name = “WENNEKER”]
added response cache entry 0
sent [CHAP Response id=0x1 , name = “UserName”]
rcvd [LCP EchoRep id=0x0 magic=0x1]
rcvd [CHAP Failure id=0x1 “E=691 R=1 C=32974A249148A4532B170E8AC868B8E1 V=0 M=Good luck!”]
MS-CHAP authentication failed: Good luck!
CHAP authentication failed
sent [LCP TermReq id=0x3 “Failed to authenticate ourselves to peer”]
rcvd [LCP TermReq id=0x1]
sent [LCP TermAck id=0x1]
rcvd [LCP TermAck id=0x3]
Connection terminated.
Waiting for 1 child processes…
script pptp XX.XX.XX.XX --nolaunchpppd, pid 20548
Script pptp XX.XX.XX.XX --nolaunchpppd finished (pid 20548), status = 0x0
[/CODE]
These are the settings in PPP/Peers/wenvpn:
>cat wenvpn
pty "pptp XX.XX.XX.XX --nolaunchpppd"
# Lock the port
lock
# We don't need the tunnel server to authenticate itself
noauth
# Turn off compression protocols we know won't be used
nobsdcomp
nodeflate
name UserName
remotename PPTP
ipparam wenvpn
require-mppe-128
#only allow MSChap-V2
refuse-eap
refuse-pap
refuse-chap
refuse-mschap
> cat chap-secrets
# Secrets for authentication using CHAP
# client server secret IP addresses
# OUTBOUND CONNECTIONS
# Here you should add your PPP Login and PPP password to connect to your
# provider via pap. The * means that the entry(login and passoword may be
# used for ANY host you connect to.
# Thus you do not have to worry about the foreign machine name. Just
# replace password with your password.
#hostname * password
# PREDIFINED CONNECTIONS
# These are user and password entries for publically accessible call-by-call
# Internet providers in Germany. If they confict with your config, remove them.
# READ_IN_CALLBYCALL_SECRETS
# INBOUND CONNECTIONS
#client hostname <password> 192.168.1.1
# added by pptpsetup for wenvpn
UserName PPTP "Password" *
do you see the connection attempt at the dial-in server side? Does the server log details on why it refused the CHAP response (E=691 is an authentication failure)? If this is a MS Windows server, then maybe you’re lacking the domain part of the user name, like “ourdomain\UserName”.
Thanks for your response. I’m trying to connect to a Draytek Vigor 2925 router. I don’t think it supports domains. When I try to connect form my laptop (Windows 8.1) I get a few lines in the routers system log.
When I try to connect from the linux instance nothing is logged.
The logging feature in the web interface doesn’t seem like it’s much use. When I deliberately enter an incorrect password on the laptop nothing is logged either.
Just downloaded a separate syslog program. Can’t make much sense from that log.
[QUOTE=wenneker_tv;31973]When I try to connect form my laptop (Windows 8.1) I get a few lines in the routers system log.
When I try to connect from the linux instance nothing is logged.[/QUOTE]
now that sounds a bit strange… I would have thought that failed accesses would at least get some form of logging message. Can you somehow confirm the request is reaching the router you’re looking at? If there’s some authentication back-end, maybe you can see some query there? OR try to increase the logging verbosity of the router?
The trace you posted does show proper responses from the PPTP server, and it shows E=691 - this typically points to a missing or wrong domain part or to a wrong password, possibly because special characters in the password needed to be quoted/escaped.