我有一台运行 L2TP/IPSec VPN 服务器的 Mac OS X Server (10.9) 计算机。配置似乎没问题，服务器和 VPN 的主机名都设置为 DynDNS 主机名。服务器配置在具有端口转发功能的 AirPort Extreme 路由器后面，连接到 Arris 调制解调器/路由器，路由器已禁用（桥接）。服务器配置了静态内部 IP，路由器还通过 DHCP 绑定了其 MAC 地址，以确保内部地址一致。
如果我输入服务器的内部 IP 地址 (10.0.1.x) 并尝试从网络内部连接到 VPN 服务器，则一切正常。但是，如果我输入外部主机名 (DynDNS 名称) 并尝试再次从网络内部连接，则无法连接。同样，在网络外部（例如通过 LTE）也无法连接。
其他服务（SSH、远程桌面等）在网络内外均可正常连接。只有 VPN 受到影响。我可以确认服务器可通过 SSH 和远程桌面（端口 22/5900）访问。
我进一步确认，除了其他服务使用的其他端口外，路由器还转发端口 500（UDP）、1701（UDP）和 4500（UDP）。
当我尝试连接时，客户端的控制台上出现以下内容：
12/16/13 11:13:33.213 PM configd[28]: SCNC: start, triggered by (15822) com.apple.prefe, type L2TP, status 0, trafficClass 0
12/16/13 11:13:33.229 PM pppd[15967]: publish_entry SCDSet() failed: Success!
12/16/13 11:13:33.230 PM pppd[15967]: publish_entry SCDSet() failed: Success!
12/16/13 11:13:33.230 PM pppd[15967]: pppd 2.4.2 (Apple version 727.1.15) started by user, uid 501
12/16/13 11:13:33.231 PM pppd[15967]: L2TP connecting to server 'x.x.x.x' (x.x.x.x)...
12/16/13 11:13:33.232 PM pppd[15967]: IPSec connection started
12/16/13 11:13:33.244 PM racoon[15968]: accepted connection on vpn control socket.
12/16/13 11:13:33.244 PM racoon[15968]: Connecting.
12/16/13 11:13:33.244 PM racoon[15968]: IPSec Phase 1 started (Initiated by me).
12/16/13 11:13:33.245 PM racoon[15968]: IKE Packet: transmit success. (Initiator, Main-Mode message 1).
12/16/13 11:13:33.245 PM racoon[15968]: >>>>> phase change status = Phase 1 started by us
12/16/13 11:13:33.416 PM racoon[15968]: >>>>> phase change status = Phase 1 started by peer
12/16/13 11:13:33.416 PM racoon[15968]: IKE Packet: receive success. (Initiator, Main-Mode message 2).
12/16/13 11:13:33.420 PM racoon[15968]: IKE Packet: transmit success. (Initiator, Main-Mode message 3).
12/16/13 11:13:33.429 PM racoon[15968]: IKE Packet: receive success. (Initiator, Main-Mode message 4).
12/16/13 11:13:33.447 PM racoon[15968]: IKE Packet: transmit success. (Initiator, Main-Mode message 5).
12/16/13 11:13:36.715 PM racoon[15968]: !!! skipped retransmitting frags: frag_flags 1, r->sendbuf->l 112, max 1280
12/16/13 11:13:36.715 PM racoon[15968]: Received retransmitted packet from x.x.x.x[500].
12/16/13 11:13:36.715 PM racoon[15968]: the packet is retransmitted by x.x.x.x[500].
12/16/13 11:13:36.745 PM racoon[15968]: IKE Packet: transmit success. (Phase 1 Retransmit).
12/16/13 11:13:39.872 PM racoon[15968]: !!! skipped retransmitting frags: frag_flags 1, r->sendbuf->l 112, max 1280
12/16/13 11:13:39.872 PM racoon[15968]: Received retransmitted packet from x.x.x.x[500].
12/16/13 11:13:39.873 PM racoon[15968]: the packet is retransmitted by x.x.x.x[500].
12/16/13 11:13:40.043 PM racoon[15968]: IKE Packet: transmit success. (Phase 1 Retransmit).
12/16/13 11:13:43.170 PM racoon[15968]: !!! skipped retransmitting frags: frag_flags 1, r->sendbuf->l 112, max 1280
12/16/13 11:13:43.170 PM racoon[15968]: Received retransmitted packet from x.x.x.x[500].
12/16/13 11:13:43.170 PM racoon[15968]: the packet is retransmitted by x.x.x.x[500].
12/16/13 11:13:43.335 PM racoon[15968]: IKE Packet: transmit success. (Phase 1 Retransmit).
12/16/13 11:13:55.912 PM racoon[15968]: IKE Packet: transmit success. (Phase 1 Retransmit).
12/16/13 11:13:56.367 PM racoon[15968]: !!! skipped retransmitting frags: frag_flags 1, r->sendbuf->l 112, max 1280
12/16/13 11:13:56.367 PM racoon[15968]: Received retransmitted packet from x.x.x.x[500].
12/16/13 11:13:56.367 PM racoon[15968]: the packet is retransmitted by x.x.x.x[500].
12/16/13 11:14:03.416 PM pppd[15967]: IPSec connection failed
12/16/13 11:14:03.416 PM racoon[15968]: IPSec disconnecting from server x.x.x.x
12/16/13 11:14:03.416 PM racoon[15968]: glob found no matches for path "/var/run/racoon/*.conf"
服务器控制台上的内容如下：
12/16/13 11:13:33.404 PM racoon[216]: IPSec Phase 1 started (Initiated by peer).
12/16/13 11:13:33.404 PM racoon[216]: IKE Packet: receive success. (Responder, Main-Mode message 1).
12/16/13 11:13:33.404 PM racoon[216]: >>>>> phase change status = Phase 1 started by us
12/16/13 11:13:33.404 PM racoon[216]: IKE Packet: transmit success. (Responder, Main-Mode message 2).
12/16/13 11:13:33.541 PM racoon[216]: IKE Packet: receive success. (Responder, Main-Mode message 3).
12/16/13 11:13:33.559 PM racoon[216]: IKE Packet: transmit success. (Responder, Main-Mode message 4).
12/16/13 11:13:33.566 PM racoon[216]: Connecting.
12/16/13 11:13:36.697 PM racoon[216]: IKE Packet: transmit success. (Phase 1 Retransmit).
12/16/13 11:13:36.697 PM racoon[216]: IKE Packet: transmit success. (Phase 1 Retransmit).
12/16/13 11:13:39.989 PM racoon[216]: IKE Packet: transmit success. (Phase 1 Retransmit).
12/16/13 11:13:43.286 PM racoon[216]: IKE Packet: transmit success. (Phase 1 Retransmit).
12/16/13 11:13:56.484 PM racoon[216]: IKE Packet: transmit success. (Phase 1 Retransmit).
12/16/13 11:14:06.392 PM racoon[216]: IKE Packet: transmit success. (Phase 1 Retransmit).
12/16/13 11:14:12.978 PM racoon[216]: IKE Packet: transmit success. (Phase 1 Retransmit).
12/16/13 11:14:32.767 PM racoon[216]: IKE Packet: transmit success. (Phase 1 Retransmit).
12/16/13 11:14:39.390 PM racoon[216]: IKEv1 Phase 1: maximum retransmits. (Phase 1 Maximum Retransmits).
12/16/13 11:14:39.390 PM racoon[216]: Phase 1 negotiation failed due to time up. 45b24df5cc9713e7:9b427f72231ccb59
我注意到的一件事是，客户端在 11:14:03 时失败，而服务器继续重新传输数据包 30 秒，直到超时。本例中的客户端是 Mac OS X，但 iOS 客户端的行为类似。
我应该在这里寻找哪些故障排除步骤？
答案1
好吧，原来这是最新版本的 Mac OS X Server 中的一个“错误”。据我所知，racoon如果源端口不是 UDP 4500，IKE 守护进程将不会接受连接。大多数通过 NAT 的连接都会随机化源端口，这意味着它不会连接。旧版本的守护进程没有这个限制。如果直接连接到服务器的 IP，来自网络内部的连接不会随机化端口，但环回和外部连接显然会，从而导致失败。
那么，快速的解决方案就是racoon使用 OS 10.8 的旧版本替换二进制文件，当然通过命名来备份旧的racoon.old（或者racoon.new更正确？:D）。
苹果似乎确实意识到了这个问题，希望他们能够发布修复程序；与此同时，恢复二进制文件是可行的。