ER605: Client-to-LAN L2TP VPN not working for Windows 10 client
I followed a post here (ER605: How to setup a Client to LAN IPSEC VPN to connect to via Windows 10 for example?) and this TP-Link FAQ article (How to establish an L2TP Server by Omada Gateway in Standalone mode), but my Windows 10 PC shows an error message, as shown below:
The network connection between your computer and the VPN server could not be established because the remote server is not responding. This could be because one of the network devices (e.g, firewalls, NAT, routers, etc) between your computer and the remote server is not configured to allow VPN connections. Please contact your Administrator or your service provider to determine which device may be causing the problem.
However, I can see on the ER605's syslog screen these messages:
1 2024-12-14 00:16:02 IPsec NOTICE WAN: Phase 2 of IKE negotiation succeeded. (Peers=10.1.10.2<->55.66.77.88)
2 2024-12-14 00:15:52 IPsec NOTICE WAN: Phase 2 of IKE negotiation succeeded. (Peers=10.1.10.2<->55.66.77.88)
3 2024-12-14 00:15:44 IPsec NOTICE WAN: Phase 2 of IKE negotiation succeeded. (Peers=10.1.10.2<->55.66.77.88)
4 2024-12-14 00:15:40 IPsec NOTICE WAN: Phase 2 of IKE negotiation succeeded. (Peers=10.1.10.2<->55.66.77.88)
5 2024-12-14 00:15:38 IPsec NOTICE WAN: Phase 2 of IKE negotiation succeeded. (Peers=10.1.10.2<->55.66.77.88)
6 2024-12-14 00:15:37 IPsec NOTICE WAN: Phase 2 of IKE negotiation succeeded. (Peers=10.1.10.2<->55.66.77.88)
7 2024-12-14 00:15:37 IPsec NOTICE WAN: Phase 1 of IKE negotiation succeeded. (Peers=10.1.10.2<->55.66.77.88)
8 2024-12-14 00:15:37 IPsec NOTICE WAN: IKE negotiation began in responder mode. (Mode=Main Mode, Peers=10.1.10.2<->55.66.77.88)
(Where 55.66.77.88 is my home router's IP address from the ISP.)
Some more details: The ER605 is connected to a WAN router from the ISP (Comcast). So its WAN IP (10.1.20.2) is not a public IP address. However, I did set up port forwarding of these 3 UDP ports to the device:1701, 500, and 4500.
Am I missing something? Thank you in advance for any/all help.
- Thank you for that reminder: 55.66.77.88 is not my real IP address.
- I do get public IP address from the ISP -- not sure what this question is about.
- By "your router" I assume you mean the ER605? No -- as I stated, it is behind the ISP router, so it has a private IP address and I set up port forwarding on the ISP router to allow L2RP VPN traffic.
- See below.
Screenshot:
Thanks again.
I understand what a public IP address is. As I have set up SSH into the office, I know the office has a public IP.
Here is the screenshot of the L2TP setup:
I am not sure what reason you have to question the firewall on my PC, as my initial post clearly shows that the VPN negotiation packets had reached the ER605 router in the office.
There seems to be an upgrade path from 2.1.x to 2.2.x? I first tried 2.2.6 and it failed.
So now I am running 2.2.3 Build 20231201 Rel.32918.
I did a Wireshark on my PC for the VPN negotiation traffic. Here is a screenshot:
That show the 2TP client on my PC is talking to the server in the remote office. But somehow that negotiation does not get to a successful completion.
As in my initial post, I set up UDP port forwarding of 1701, 500, and 4500 to the ER605. Have I missed anything?