VPN connection failed because service stopped

[Paul Smith]

Dear All,

I was able to connect to a vpn server (PPTP) with no difficulties. But
now, I get always the following message:

"VPN connection failed because service stopped".

From a MS Windows machine, I can connect to the referred vpn server.

Could someone please help me?

Thanks in advance,

Paul

[Paul Smith]

On Tue, Sep 6, 2016 at 11:39 AM, Paul Smith  wrote:
> I was able to connect to a vpn server (PPTP) with no difficulties. But
> now, I get always the following message:
>
> "VPN connection failed because service stopped".
>
> From a MS Windows machine, I can connect to the referred vpn server.
>
> Could someone please help me?

The following log may help you:

----------------------
Sep 06 11:59:43 xhost NetworkManager[950]: <info>  [1473159583.3844]
keyfile: update /etc/NetworkManager/system-connections/VPN connection
1 (0e94b8ac-975a-4785-a149-51ad3ad34b87,"VPN connection 1")
Sep 06 11:59:43 xhost NetworkManager[950]: <info>  [1473159583.3852]
audit: op="connection-update"
uuid="0e94b8ac-975a-4785-a149-51ad3ad34b87" name="VPN connection 1"
pid=8058 uid=1000 result="success"
Sep 06 11:59:54 xhost NetworkManager[950]: <info>  [1473159594.4335]
audit: op="connection-activate"
uuid="0e94b8ac-975a-4785-a149-51ad3ad34b87" name="VPN connection 1"
pid=1506 uid=1000 result="success"
Sep 06 11:59:54 xhost NetworkManager[950]: <info>  [1473159594.4390]
vpn-connection[0x5597291e93e0,0e94b8ac-975a-4785-a149-51ad3ad34b87,"VPN
connection 1",0]: Started the VPN service, PID 8123
Sep 06 11:59:54 xhost NetworkManager[950]: <info>  [1473159594.4491]
vpn-connection[0x5597291e93e0,0e94b8ac-975a-4785-a149-51ad3ad34b87,"VPN
connection 1",0]: Saw the service appear; activating connection
Sep 06 11:59:54 xhost NetworkManager[950]: <info>  [1473159594.5561]
vpn-connection[0x5597291e93e0,0e94b8ac-975a-4785-a149-51ad3ad34b87,"VPN
connection 1",0]: VPN connection: (ConnectInteractive) reply received
Sep 06 11:59:54 xhost NetworkManager[950]: ** Message: pppd started
with pid 8135
Sep 06 11:59:54 xhost NetworkManager[950]: <info>  [1473159594.5806]
vpn-connection[0x5597291e93e0,0e94b8ac-975a-4785-a149-51ad3ad34b87,"VPN
connection 1",0]: VPN plugin: state changed: starting (3)
Sep 06 11:59:54 xhost NetworkManager[950]: <info>  [1473159594.6008]
manager: (ppp0): new Generic device
(/org/freedesktop/NetworkManager/Devices/12)
Sep 06 11:59:54 xhost NetworkManager[950]: Plugin
/usr/lib64/pppd/2.4.7/nm-pptp-pppd-plugin.so loaded.
Sep 06 11:59:54 xhost NetworkManager[950]: ** Message:
nm-pptp-ppp-plugin: (plugin_init): initializing
Sep 06 11:59:54 xhost NetworkManager[950]: ** Message:
nm-pptp-ppp-plugin: (nm_phasechange): status 3 / phase 'serial
connection'
Sep 06 11:59:54 xhost NetworkManager[950]: Using interface ppp0
Sep 06 11:59:54 xhost NetworkManager[950]: Connect: ppp0 <--> /dev/pts/4
Sep 06 11:59:54 xhost NetworkManager[950]: ** Message:
nm-pptp-ppp-plugin: (nm_phasechange): status 5 / phase 'establish'
Sep 06 11:59:54 xhost pppd[8135]: Plugin
/usr/lib64/pppd/2.4.7/nm-pptp-pppd-plugin.so loaded.
Sep 06 11:59:54 xhost pppd[8135]: pppd 2.4.7 started by root, uid 0
Sep 06 11:59:54 xhost pptp[8138]: nm-pptp-service-8123
log[main:pptp.c:333]: The synchronous pptp option is NOT activated
Sep 06 11:59:54 xhost pppd[8135]: Using interface ppp0
Sep 06 11:59:54 xhost pppd[8135]: Connect: ppp0 <--> /dev/pts/4
Sep 06 11:59:54 xhost pptp[8149]: nm-pptp-service-8123
log[ctrlp_rep:pptp_ctrl.c:258]: Sent control packet type is 1
'Start-Control-Connection-Request'
Sep 06 11:59:54 xhost pptp[8149]: nm-pptp-service-8123
log[ctrlp_disp:pptp_ctrl.c:758]: Received Start Control Connection
Reply
Sep 06 11:59:54 xhost pptp[8149]: nm-pptp-service-8123
log[ctrlp_disp:pptp_ctrl.c:792]: Client connection established.
Sep 06 11:59:55 xhost pptp[8149]: nm-pptp-service-8123
log[ctrlp_rep:pptp_ctrl.c:258]: Sent control packet type is 7
'Outgoing-Call-Request'
Sep 06 11:59:55 xhost pptp[8149]: nm-pptp-service-8123
log[ctrlp_disp:pptp_ctrl.c:877]: Received Outgoing Call Reply.
Sep 06 11:59:55 xhost pptp[8149]: nm-pptp-service-8123
log[ctrlp_disp:pptp_ctrl.c:916]: Outgoing call established (call ID 0,
peer's call ID 18073).
Sep 06 12:00:25 xhost pppd[8135]: LCP: timeout sending Config-Requests
Sep 06 12:00:25 xhost NetworkManager[950]: LCP: timeout sending Config-Requests
Sep 06 12:00:25 xhost NetworkManager[950]: ** Message:
nm-pptp-ppp-plugin: (nm_phasechange): status 11 / phase 'disconnect'
Sep 06 12:00:25 xhost NetworkManager[950]: Connection terminated.
Sep 06 12:00:25 xhost pppd[8135]: Connection terminated.
Sep 06 12:00:25 xhost NetworkManager[950]: <error> [1473159625.6347]
platform-linux: do-change-link[13]: failure changing link: failure 19
(No such device)
Sep 06 12:00:25 xhost NetworkManager[950]: ** Message: Terminated ppp
daemon with PID 8135.
Sep 06 12:00:25 xhost NetworkManager[950]: <warn>  [1473159625.6349]
device (ppp0): failed to disable userspace IPv6LL address handling
Sep 06 12:00:25 xhost NetworkManager[950]: ** Message:
nm-pptp-ppp-plugin: (nm_phasechange): status 1 / phase 'dead'
Sep 06 12:00:25 xhost NetworkManager[950]: Terminating on signal 15
Sep 06 12:00:25 xhost NetworkManager[950]: Modem hangup
Sep 06 12:00:25 xhost NetworkManager[950]: ** Message:
nm-pptp-ppp-plugin: (nm_exit_notify): cleaning up
Sep 06 12:00:25 xhost NetworkManager[950]: <info>  [1473159625.6413]
vpn-connection[0x5597291e93e0,0e94b8ac-975a-4785-a149-51ad3ad34b87,"VPN
connection 1",0]: VPN service disappeared
----------------------

Paul

[Paul Smith]

On Tue, Sep 6, 2016 at 12:03 PM, Paul Smith  wrote:
> > I was able to connect to a vpn server (PPTP) with no difficulties. But
> > now, I get always the following message:
> >
> > "VPN connection failed because service stopped".
> >
> > From a MS Windows machine, I can connect to the referred vpn server.
> >
> > Could someone please help me?
>
> The following log may help you:

The problem was related to the firewall, although I had not changed
anything in the firewall.

The following (done as root) fixed the problem:

firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p gre -j ACCEPT
firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -p gre -j ACCEPT
firewall-cmd --reload

Paul

[Paul Smith]

On Tue, Sep 6, 2016 at 12:53 PM, Paul Smith  wrote:
> > > I was able to connect to a vpn server (PPTP) with no difficulties. But
> > > now, I get always the following message:
> > >
> > > "VPN connection failed because service stopped".
> > >
> > > From a MS Windows machine, I can connect to the referred vpn server.
> > >
> > > Could someone please help me?
> >
> > The following log may help you:
>
> The problem was related to the firewall, although I had not changed
> anything in the firewall.
>
> The following (done as root) fixed the problem:
>
> firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p gre -j ACCEPT
> firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -p gre -j ACCEPT
> firewall-cmd --reload

How to make permanent these changes on the firewall?

Paul

[Joe Zeff]

On 09/14/2016 11:28 AM, Paul Smith wrote:
> How to make permanent these changes on the firewall?

Here's a quote from the man page:

--runtime-to-permanent
Save active runtime configuration and overwrite permanent
configuration with it. The way this is supposed to work is that
when configuring firewalld you do runtime changes only and once
you're happy with the configuration and you tested that it works
the way you want, you save the configuration to disk.

[Mike Wright]

On 09/14/2016 11:28 AM, Paul Smith wrote:
> On Tue, Sep 6, 2016 at 12:53 PM, Paul Smith  wrote:
> > > > I was able to connect to a vpn server (PPTP) with no difficulties. But
> > > > now, I get always the following message:
> > > >
> > > > "VPN connection failed because service stopped".
> > > >
> > > > From a MS Windows machine, I can connect to the referred vpn server.
> > > >
> > > > Could someone please help me?
> > >
> > > The following log may help you:
> >
> > The problem was related to the firewall, although I had not changed
> > anything in the firewall.
> >
> > The following (done as root) fixed the problem:
> >
> > firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p gre -j ACCEPT
> > firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -p gre -j ACCEPT
> > firewall-cmd --reload
>
> How to make permanent these changes on the firewall?

firewall-cmd --runtime-to-permanent

[Paul Smith]

On Wed, Sep 14, 2016 at 8:01 PM, Mike Wright
 wrote:
> > > > > I was able to connect to a vpn server (PPTP) with no difficulties. But
> > > > > now, I get always the following message:
> > > > >
> > > > > "VPN connection failed because service stopped".
> > > > >
> > > > > From a MS Windows machine, I can connect to the referred vpn server.
> > > > >
> > > > > Could someone please help me?
> > > >
> > > > The following log may help you:
> > >
> > > The problem was related to the firewall, although I had not changed
> > > anything in the firewall.
> > >
> > > The following (done as root) fixed the problem:
> > >
> > > firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p gre -j ACCEPT
> > > firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -p gre -j ACCEPT
> > > firewall-cmd --reload
> >
> > How to make permanent these changes on the firewall?
>
> firewall-cmd --runtime-to-permanent

Thanks, Mike and Joe!

Paul

[Joe Zeff]

On 09/14/2016 12:09 PM, Paul Smith wrote:
> Thanks, Mike and Joe!

Glad to be able to help.  Remember, when in doubt, RTFM.

[Thomas Woerner]

Hello Paul,

On 09/06/2016 01:53 PM, Paul Smith wrote:
> On Tue, Sep 6, 2016 at 12:03 PM, Paul Smith  wrote:
> > > I was able to connect to a vpn server (PPTP) with no difficulties. But
> > > now, I get always the following message:
> > >
> > > "VPN connection failed because service stopped".
> > >
> > > From a MS Windows machine, I can connect to the referred vpn server.
> > >
> > > Could someone please help me?
> >
> > The following log may help you:
>
> The problem was related to the firewall, although I had not changed
> anything in the firewall.
>
> The following (done as root) fixed the problem:
>
> firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p gre -j ACCEPT
> firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -p gre -j ACCEPT
> firewall-cmd --reload

You can simply duplicate the lines with the additional --permanent option, then 
the change will be placed in the permanent environment.

With a firewalld version >= 0.4.1 you can also enable the gre protocol in a zone:

firewall-cmd --add-protocol=gre [--permanent] [--zone=<zone>]

This will then be added for IPv4 and IPv6. Without the --zone option, the 
default zone will be used.
> Paul
>
> users mailing list
> [e-mail]
> To unsubscribe or change subscription options:
> https://lists.fedoraproject.org/admin/lists/[e-mail]
> Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
> Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
> Have a question? Ask away: http://ask.fedoraproject.org

Regards,
Thomas

[Paul Smith]

On Thu, Sep 15, 2016 at 3:57 PM, Thomas Woerner  wrote:
> Hello Paul,
>
> On 09/06/2016 01:53 PM, Paul Smith wrote:
> > On Tue, Sep 6, 2016 at 12:03 PM, Paul Smith  wrote:
> > > > I was able to connect to a vpn server (PPTP) with no difficulties. But
> > > > now, I get always the following message:
> > > >
> > > > "VPN connection failed because service stopped".
> > > >
> > > > From a MS Windows machine, I can connect to the referred vpn server.
> > > >
> > > > Could someone please help me?
> > >
> > > The following log may help you:
> >
> > The problem was related to the firewall, although I had not changed
> > anything in the firewall.
> >
> > The following (done as root) fixed the problem:
> >
> > firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p gre -j ACCEPT
> > firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -p gre -j ACCEPT
> > firewall-cmd --reload
>
> You can simply duplicate the lines with the additional --permanent option,
> then the change will be placed in the permanent environment.
>
> With a firewalld version >= 0.4.1 you can also enable the gre protocol in a
> zone:
>
> firewall-cmd --add-protocol=gre [--permanent] [--zone=<zone>]
>
> This will then be added for IPv4 and IPv6. Without the --zone option, the
> default zone will be used.

Very neat, Thomas! Thanks!

Paul