Ok i was pretty sure that the result would be the same in 4G.
indeed ! The tunnel is not working in 4G LTE.
Let's recap (head scratching):
the tunnel is working with ADSL Wan and Iphone 4G tethering via the GL X3000
but it fails on the Cellular interface.
Just to be sure i have lowered the MTU to 1200 as L2TP tend to encapsulate a lot.
I did some tcpdump to get some insight and notice some communication from the LNS (VPN Server) isakmp-nat-keep-alive; 2 times before the timeout of the ipsec tunnel.
It seems that something cut the communication from the VPN Server on port 4500 on the cellular interface but it's not the case with the ethernet interface or tethering interface.
Not Working tcpdump taken on laptop when initiating the VPN CNX via the Cellular interface on GL X3000:
shupo:~ hugh$ cat cnx_trace_notworking
22:45:01.394661 IP 192.168.1.123.500 > 185.XXX.XXX.XXX.500: isakmp: phase 1 I ident
22:45:01.505930 IP 185.XXX.XXX.XXX.500 > 192.168.1.123.500: isakmp: phase 1 R ident
22:45:01.508387 IP 192.168.1.123.500 > 185.XXX.XXX.XXX.500: isakmp: phase 1 I ident
22:45:01.606746 IP 185.XXX.XXX.XXX.500 > 192.168.1.123.500: isakmp: phase 1 R ident
22:45:01.631179 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: NONESP-encap: isakmp: phase 1 I ident[E]
22:45:01.715804 IP 185.XXX.XXX.XXX.4500 > 192.168.1.123.4500: NONESP-encap: isakmp: phase 1 R ident[E]
22:45:02.451962 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: NONESP-encap: isakmp: phase 2/others I oakley-quick[E]
22:45:02.560936 IP 185.XXX.XXX.XXX.4500 > 192.168.1.123.4500: NONESP-encap: isakmp: phase 2/others R oakley-quick[E]
22:45:02.561593 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: NONESP-encap: isakmp: phase 2/others I oakley-quick[E]
22:45:02.562701 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: UDP-encap: ESP(spi=0x0393ca18,seq=0x1), length 116
22:45:03.098957 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: UDP-encap: ESP(spi=0x0393ca18,seq=0x2), length 116
22:45:05.102448 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: UDP-encap: ESP(spi=0x0393ca18,seq=0x3), length 116
22:45:06.210449 IP 185.XXX.XXX.XXX.4500 > 192.168.1.123.4500: isakmp-nat-keep-alive
22:45:09.110598 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: UDP-encap: ESP(spi=0x0393ca18,seq=0x4), length 116
22:45:13.118021 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: UDP-encap: ESP(spi=0x0393ca18,seq=0x5), length 116
22:45:17.126207 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: UDP-encap: ESP(spi=0x0393ca18,seq=0x6), length 116
22:45:21.134023 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: UDP-encap: ESP(spi=0x0393ca18,seq=0x7), length 116
22:45:22.360676 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: isakmp-nat-keep-alive
22:45:22.575494 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: NONESP-encap: isakmp: phase 2/others I inf[E]
22:45:22.575616 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: NONESP-encap: isakmp: phase 2/others I inf[E]
Working taken on laptop when initiating the VPN CNX via the ethernet ADSL interface on GL X3000
shupo:~ hugh$ cat cnx_trace_working_lan
23:08:42.789714 IP 192.168.1.123.500 > 185.XXX.XXX.XXX.500: isakmp: phase 1 I ident
23:08:42.846569 IP 185.XXX.XXX.XXX.500 > 192.168.1.123.500: isakmp: phase 1 R ident
23:08:42.849892 IP 192.168.1.123.500 > 185.XXX.XXX.XXX.500: isakmp: phase 1 I ident
23:08:42.926962 IP 185.XXX.XXX.XXX.500 > 192.168.1.123.500: isakmp: phase 1 R ident
23:08:42.952430 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: NONESP-encap: isakmp: phase 1 I ident[E]
23:08:43.004557 IP 185.XXX.XXX.XXX.4500 > 192.168.1.123.4500: NONESP-encap: isakmp: phase 1 R ident[E]
23:08:43.856467 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: NONESP-encap: isakmp: phase 2/others I oakley-quick[E]
23:08:43.914228 IP 185.XXX.XXX.XXX.4500 > 192.168.1.123.4500: NONESP-encap: isakmp: phase 2/others R oakley-quick[E]
23:08:43.914828 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: NONESP-encap: isakmp: phase 2/others I oakley-quick[E]
23:08:43.915734 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: UDP-encap: ESP(spi=0x04a6e7fc,seq=0x1), length 116
23:08:43.968425 IP 185.XXX.XXX.XXX.4500 > 192.168.1.123.4500: UDP-encap: ESP(spi=0x0797f2fc,seq=0x1), length 140
23:08:43.969201 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: UDP-encap: ESP(spi=0x04a6e7fc,seq=0x2), length 60
23:08:43.969336 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: UDP-encap: ESP(spi=0x04a6e7fc,seq=0x3), length 76
23:08:44.024388 IP 185.XXX.XXX.XXX.4500 > 192.168.1.123.4500: UDP-encap: ESP(spi=0x0797f2fc,seq=0x2), length 52
23:08:44.024391 IP 185.XXX.XXX.XXX.4500 > 192.168.1.123.4500: UDP-encap: ESP(spi=0x0797f2fc,seq=0x3), length 68
23:08:44.025022 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: UDP-encap: ESP(spi=0x04a6e7fc,seq=0x4), length 84
23:08:44.031808 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: UDP-encap: ESP(spi=0x04a6e7fc,seq=0x5), length 76
23:08:44.076677 IP 185.XXX.XXX.XXX.4500 > 192.168.1.123.4500: UDP-encap: ESP(spi=0x0797f2fc,seq=0x4), length 52
23:08:44.086115 IP 185.XXX.XXX.XXX.4500 > 192.168.1.123.4500: UDP-encap: ESP(spi=0x0797f2fc,seq=0x5), length 68
23:08:44.086118 IP 185.XXX.XXX.XXX.4500 > 192.168.1.123.4500: UDP-encap: ESP(spi=0x0797f2fc,seq=0x6), length 68
23:08:44.086886 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: UDP-encap: ESP(spi=0x04a6e7fc,seq=0x6), length 76
23:08:44.086892 IP 192.168.1.123.4500 > 185.XXX.XXX.XXX.4500: UDP-encap: ESP(spi=0x04a6e7fc,seq=0x7), length 60
23:08:44.138721 IP 185.XXX.XXX.XXX.4500 > 192.168.1.123.4500: UDP-encap: ESP(spi=0x0797f2fc,seq=0x7), length 60
23:08:44.138724 IP 185.XXX.XXX.XXX.4500 > 192.168.1.123.4500: UDP-encap: ESP(spi=0x0797f2fc,seq=0x8), length 84
It's seems we miss something somewhere in the luci interface configuration ?
hum...
Maybe i spot something on luci which maybe explain why the inbound for UDP 4500 did not apply to the cellular interface, but i'm not sure how to fix it effectively ?
The modem_0001_4 interface is not zone assigned
is this normal ?
I was expecting WAN there.
The inbound UDP 4500 rule is configured to accept cnx.
but on the cellular interface i never see
185.XXX.XXX.XXX.4500 > 192.168.1.123.4500: UDP-encap
traffic coming from the vpn server and wonder why ?
