我在运行 Ubuntu Server 12.04 和 openswan 2.6.37/xl2tpd 1.3.1 的 EC2 上设置了一个 IPSec/L2TP VPN 服务器。当我使用默认 IP（私有 IP：172.31.14.4，公有 IP：54.69.159.5）连接时，连接成功；但是当我使用第二个 IP（私有 IP：172.31.1.40，公有 IP：54.68.144.45）连接时，连接失败。
我想设置这个vpn服务器可以连接不同的IP，并使客户端IP显示为连接的VPN公共IP。
以下是错误连接时的日志：
/var/log/syslog
Jun 30 11:03:16 hostname xl2tpd[9964]: get_call: allocating new tunnel for host x.x.x.x, port 1701.
Jun 30 11:03:18 hostname xl2tpd[9964]: get_call: allocating new tunnel for host x.x.x.x, port 1701.
Jun 30 11:03:18 hostname xl2tpd[9964]: control_finish: Peer requested tunnel 2 twice, ignoring second one.
Jun 30 11:03:18 hostname xl2tpd[9964]: build_fdset: closing down tunnel 51911
Jun 30 11:03:19 hostname xl2tpd[9964]: get_call: allocating new tunnel for host x.x.x.x, port 1701.
Jun 30 11:03:19 hostname xl2tpd[9964]: control_finish: Peer requested tunnel 2 twice, ignoring second one.
Jun 30 11:03:19 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:19 hostname xl2tpd[9964]: build_fdset: closing down tunnel 32530
Jun 30 11:03:19 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:23 xl2tpd[9964]: last message repeated 3 times
Jun 30 11:03:23 hostname xl2tpd[9964]: get_call: allocating new tunnel for host x.x.x.x, port 1701.
Jun 30 11:03:23 hostname xl2tpd[9964]: control_finish: Peer requested tunnel 2 twice, ignoring second one.
Jun 30 11:03:23 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:23 hostname xl2tpd[9964]: build_fdset: closing down tunnel 44586
Jun 30 11:03:23 hostname xl2tpd[9964]: Maximum retries exceeded for tunnel 32176. Closing.
Jun 30 11:03:23 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:23 hostname xl2tpd[9964]: Connection 2 closed to x.x.x.x, port 1701 (Timeout)
Jun 30 11:03:24 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:28 xl2tpd[9964]: last message repeated 3 times
Jun 30 11:03:28 hostname xl2tpd[9964]: Unable to deliver closing message for tunnel 32176. Destroying anyway.
Jun 30 11:03:31 hostname xl2tpd[9964]: get_call: allocating new tunnel for host x.x.x.x, port 1701.
Jun 30 11:03:33 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:38 xl2tpd[9964]: last message repeated 4 times
Jun 30 11:03:38 hostname xl2tpd[9964]: Maximum retries exceeded for tunnel 55170. Closing.
Jun 30 11:03:38 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:38 hostname xl2tpd[9964]: Connection 2 closed to x.x.x.x, port 1701 (Timeout)
Jun 30 11:03:39 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:40 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:41 hostname xl2tpd[9964]: get_call: allocating new tunnel for host x.x.x.x, port 1701.
Jun 30 11:03:41 hostname xl2tpd[9964]: control_finish: Peer requested tunnel 2 twice, ignoring second one.
Jun 30 11:03:41 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:41 hostname xl2tpd[9964]: build_fdset: closing down tunnel 16380
Jun 30 11:03:41 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:42 hostname xl2tpd[9964]: udp_xmit failed to x.x.x.x:1701 with err=-1:Operation not permitted
Jun 30 11:03:43 hostname xl2tpd[9964]: Unable to deliver closing message for tunnel 55170. Destroying anyway.
这是我的配置：
/etc/ipsec.conf
config setup
dumpdir=/var/run/pluto/
nat_traversal=yes
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
oe=off
protostack=netkey
conn %default
forceencaps=yes
conn L2TP-PSK-NAT
rightsubnet=vhost:%priv
also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=172.31.14.4
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
conn L2TP-PSK-noNAT-2
authby=secret
pfs=no
auto=add
keyingtries=3
rekey=no
ikelifetime=8h
keylife=1h
type=transport
left=172.31.1.40
leftprotoport=17/1701
right=%any
rightprotoport=17/%any
/etc/xl2tpd/xl2tpd.conf
[global]
ipsec saref = yes
debug tunnel = yes
[lns default]
ip range = 10.1.2.2-10.1.2.20
local ip = 10.1.2.1
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
/etc/ppp/options.xl2tpd
require-mschap-v2
ms-dns 8.8.8.8
ms-dns 8.8.4.4
asyncmap 0
auth
crtscts
lock
hide-password
modem
debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4
答案1
不确定您是否仍需要答案，但我从未在 Google 上看到过类似问题的答案。我的 EC2 实例上有一对 IP，但日志中出现相同的错误：udp_xmit failed... Operation not permitted。配置中的此编辑对我有帮助：nat_traversal=no。