@romo said in EdgeRouter L2TP VPN can't pass IKE phase 1: A DNAT rule was the culprit of everything, it was redirecting the traffic and not letting it reach WAN_LOCAL. FINALLY SOLVED!!!!!!!!!!!!!!!!!!!!!!!!! As reminder for anyone that could encounter a similar issue: DNAT rules are evaluated before firewall rules. Yes, this is a known function of VyOS/EdgeOS. But nothing was ever posted baout DNAT rules in use, so I assumed there were none. There are not by default.

@gjacobse said in Help troubleshooting L2TP over IPSEC VPN connections.: jeeze,.. that is a sad state to think that we have nbeen fighting this for that long,... @JaredBusch @scottalanmiller Can a cron be set to restart the ipsec every 24 hours? Yes.

@bbigford said in Does any one have a EdgeRouter 4 online and can test L2TP: Any insight on maybe why that worked? I've had issues with the default group on another manufacturer, but I wouldn't think 14 was default. It worked prior to changing to DH 14 on my iPhone. I had to add a proposal with DH 14 for Windows 10 to work.

@scottalanmiller posted here too https://mangolassi.it/topic/16567/dell-machines-unable-to-vpn-due-to-smartbyte-bloatware

Did you use the Libreswan or Strongswan setting in your previous post?

No problem!

@coliver said: Do VPN connections get created/torn down with every communication? Or are they persistent until the device disconnects? Normally neither. They are normally persistent until a certain amount of time, then they tear down when idle. Might be hours or days. That way they don't remain absolutely forever, but normally a very long time.

@gjacobse said: I was informed that he is about 20' from the router on Wireless, but that TWC is to be onsite today to setup / move the equipment and then he will be within 5' of it. Just hope it's not to close and overloads the wireless radio's.

We recently had to set up an L2TP tunnel for our apple devices, since the last iOS 10 update took PPTP out of the picture. It was a huge PITA too, because I didn't figure out for a while that the secondary tunnel wouldn't let me reuse existing user accounts in our Watchguard.... that was some fun trial and error. And the WG how-tos never specified anything about needing different user accounts. It sucks to do all the steps right and then get login errors... makes ya feel like an amateur.