L2TP connection issues in Fedora 43

[nnedelko]

Hi! I'm having trouble connecting to an L2TP VPN, specifically I get [errno 113, origin ICMP type 3 code 10 (not authenticated)] (this same VPN works fine in a Windows set-up on the same wifi network!). Here's what I've already tried:

• a bunch of different IPSec Phase 1 and 2 algorithms
• Disabling PFS
• Enforcing UDP encapsulation
• Disabling SELinux
• Setting crypto policy to LEGACY
• Checking that IPSec is allowed by the firewall

Here's a typical output from pluto:

Apr 10 14:22:51 fedora pluto[11745]: /usr/libexec/ipsec/pluto: Symbol `ldns_error_str' has different size in shared object, consider re-linking
Apr 10 14:22:51 fedora pluto[11745]: Starting Pluto (Libreswan Version 5.3 IKEv2 IKEv1 XFRM XFRMI esp-hw-offload FORK PTHREAD_SETSCHEDPRIO GCC_EXCEPTIONS NSS (IPsec profile) (NSS-KDF) DNSSEC SYSTEMD_WATCHDOG LABELED_IPSEC (SELINUX) SECCOMP LIBCAP_NG LINUX_AUDIT AUTH_PAM CURL(non-NSS) LDAP(non-NSS) NFTABLES CAT NFLOG) pid:11745
Apr 10 14:22:51 fedora pluto[11745]: operating system: Linux 6.19.11 [Linux 6.19.11-200.fc43.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Apr  2 16:55:52 UTC 2026 x86_64]
Apr 10 14:22:51 fedora pluto[11745]: core dump dir: /run/pluto
Apr 10 14:22:51 fedora pluto[11745]: secrets file: /etc/ipsec.secrets
Apr 10 14:22:51 fedora pluto[11745]: Initializing NSS using read-only database "sql:/var/lib/ipsec/nss"
Apr 10 14:22:51 fedora pluto[11745]: FIPS Mode: OFF
Apr 10 14:22:51 fedora pluto[11745]: NSS crypto library initialized
Apr 10 14:22:51 fedora pluto[11745]: FIPS mode disabled for pluto daemon
Apr 10 14:22:51 fedora pluto[11745]: NSS: OCSP [disabled]
Apr 10 14:22:51 fedora pluto[11745]: FIPS HMAC integrity support [not required]
Apr 10 14:22:51 fedora pluto[11745]: libcap-ng support [enabled]
Apr 10 14:22:51 fedora pluto[11745]: Linux audit support [enabled]
Apr 10 14:22:51 fedora pluto[11745]: Linux audit support [enabled]
Apr 10 14:22:51 fedora pluto[11745]: leak-detective enabled
Apr 10 14:22:51 fedora pluto[11745]: NSS crypto [enabled]
Apr 10 14:22:51 fedora pluto[11745]: XAUTH PAM support [enabled]
Apr 10 14:22:51 fedora pluto[11745]: initializing libevent in pthreads mode: headers: 2.1.12-stable (2010c00); library: 2.1.12-stable (2010c00)
Apr 10 14:22:51 fedora pluto[11745]: NAT-Traversal: keep-alive period 20s
Apr 10 14:22:51 fedora pluto[11745]: IPsec Interface [managed]
Apr 10 14:22:51 fedora pluto[11745]: refreshed session resume keys, issuing key 1
Apr 10 14:22:51 fedora pluto[11745]: Encryption algorithms:
Apr 10 14:22:51 fedora pluto[11745]:   AES_CCM_16         {256,192,*128} IKEv1:     ESP     IKEv2:     ESP     FIPS              aes_ccm, aes_ccm_c
Apr 10 14:22:51 fedora pluto[11745]:   AES_CCM_12         {256,192,*128} IKEv1:     ESP     IKEv2:     ESP     FIPS              aes_ccm_b
Apr 10 14:22:51 fedora pluto[11745]:   AES_CCM_8          {256,192,*128} IKEv1:     ESP     IKEv2:     ESP     FIPS              aes_ccm_a
Apr 10 14:22:51 fedora pluto[11745]:   3DES_CBC           [*192]         IKEv1: IKE ESP     IKEv2: IKE ESP     FIPS NSS(CBC)     3des
Apr 10 14:22:51 fedora pluto[11745]:   CAMELLIA_CTR       {256,192,*128} IKEv1:     ESP     IKEv2:     ESP
Apr 10 14:22:51 fedora pluto[11745]:   CAMELLIA_CBC       {256,192,*128} IKEv1: IKE ESP     IKEv2: IKE ESP          NSS(CBC)     camellia
Apr 10 14:22:51 fedora pluto[11745]:   AES_GCM_16         {256,192,*128} IKEv1:     ESP     IKEv2: IKE ESP     FIPS NSS(AEAD)    aes_gcm, aes_gcm_c
Apr 10 14:22:51 fedora pluto[11745]:   AES_GCM_12         {256,192,*128} IKEv1:     ESP     IKEv2: IKE ESP     FIPS NSS(AEAD)    aes_gcm_b
Apr 10 14:22:51 fedora pluto[11745]:   AES_GCM_8          {256,192,*128} IKEv1:     ESP     IKEv2: IKE ESP     FIPS NSS(AEAD)    aes_gcm_a
Apr 10 14:22:51 fedora pluto[11745]:   AES_CTR            {256,192,*128} IKEv1: IKE ESP     IKEv2: IKE ESP     FIPS NSS(CTR)     aesctr
Apr 10 14:22:51 fedora pluto[11745]:   AES_CBC            {256,192,*128} IKEv1: IKE ESP     IKEv2: IKE ESP     FIPS NSS(CBC)     aes
Apr 10 14:22:51 fedora pluto[11745]:   NULL_AUTH_AES_GMAC {256,192,*128} IKEv1:     ESP     IKEv2:     ESP     FIPS              aes_gmac
Apr 10 14:22:51 fedora pluto[11745]:   NULL               []             IKEv1:     ESP     IKEv2:     ESP          NULL
Apr 10 14:22:51 fedora pluto[11745]:   CHACHA20_POLY1305  [*256]         IKEv1:             IKEv2: IKE ESP          NSS(AEAD)    chacha20poly1305
Apr 10 14:22:51 fedora pluto[11745]: Hash algorithms:
Apr 10 14:22:51 fedora pluto[11745]:   MD5                               IKEv1: IKE         IKEv2:                  NSS
Apr 10 14:22:51 fedora pluto[11745]:   SHA1                              IKEv1: IKE         IKEv2: IKE         FIPS NSS          sha
Apr 10 14:22:51 fedora pluto[11745]:   SHA2_256                          IKEv1: IKE         IKEv2: IKE         FIPS NSS          sha2, sha256
Apr 10 14:22:51 fedora pluto[11745]:   SHA2_384                          IKEv1: IKE         IKEv2: IKE         FIPS NSS          sha384
Apr 10 14:22:51 fedora pluto[11745]:   SHA2_512                          IKEv1: IKE         IKEv2: IKE         FIPS NSS          sha512
Apr 10 14:22:51 fedora pluto[11745]:   IDENTITY                          IKEv1:             IKEv2:             FIPS
Apr 10 14:22:51 fedora pluto[11745]: PRF algorithms:
Apr 10 14:22:51 fedora pluto[11745]:   HMAC_MD5                          IKEv1: IKE         IKEv2: IKE              NSS          md5
Apr 10 14:22:51 fedora pluto[11745]:   HMAC_SHA1                         IKEv1: IKE         IKEv2: IKE         FIPS NSS          sha, sha1
Apr 10 14:22:51 fedora pluto[11745]:   HMAC_SHA2_256                     IKEv1: IKE         IKEv2: IKE         FIPS NSS          sha2, sha256, sha2_256
Apr 10 14:22:51 fedora pluto[11745]:   HMAC_SHA2_384                     IKEv1: IKE         IKEv2: IKE         FIPS NSS          sha384, sha2_384
Apr 10 14:22:51 fedora pluto[11745]:   HMAC_SHA2_512                     IKEv1: IKE         IKEv2: IKE         FIPS NSS          sha512, sha2_512
Apr 10 14:22:51 fedora pluto[11745]:   AES_XCBC                          IKEv1:             IKEv2: IKE              native(XCBC) aes128_xcbc
Apr 10 14:22:51 fedora pluto[11745]: Integrity algorithms:
Apr 10 14:22:51 fedora pluto[11745]:   HMAC_MD5_96                       IKEv1: IKE ESP AH  IKEv2: IKE ESP AH       NSS          md5, hmac_md5
Apr 10 14:22:51 fedora pluto[11745]:   HMAC_SHA1_96                      IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS NSS          sha, sha1, sha1_96, hmac_sha1
Apr 10 14:22:51 fedora pluto[11745]:   HMAC_SHA2_512_256                 IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS NSS          sha512, sha2_512, sha2_512_256, hmac_sha2_512
Apr 10 14:22:51 fedora pluto[11745]:   HMAC_SHA2_384_192                 IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS NSS          sha384, sha2_384, sha2_384_192, hmac_sha2_384
Apr 10 14:22:51 fedora pluto[11745]:   HMAC_SHA2_256_128                 IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS NSS          sha2, sha256, sha2_256, sha2_256_128, hmac_sha2_256
Apr 10 14:22:51 fedora pluto[11745]:   HMAC_SHA2_256_TRUNCBUG            IKEv1:     ESP AH  IKEv2:         AH
Apr 10 14:22:51 fedora pluto[11745]:   AES_XCBC_96                       IKEv1:     ESP AH  IKEv2: IKE ESP AH       native(XCBC) aes_xcbc, aes128_xcbc, aes128_xcbc_96
Apr 10 14:22:51 fedora pluto[11745]:   AES_CMAC_96                       IKEv1:     ESP AH  IKEv2:     ESP AH  FIPS              aes_cmac
Apr 10 14:22:51 fedora pluto[11745]:   NONE                              IKEv1:     ESP     IKEv2: IKE ESP     FIPS              null
Apr 10 14:22:51 fedora pluto[11745]: DH algorithms:
Apr 10 14:22:51 fedora pluto[11745]:   NONE                              IKEv1:             IKEv2: IKE ESP AH  FIPS NSS(MODP)    null, dh0
Apr 10 14:22:51 fedora pluto[11745]:   MODP1536                          IKEv1: IKE ESP AH  IKEv2: IKE ESP AH       NSS(MODP)    dh5
Apr 10 14:22:51 fedora pluto[11745]:   MODP2048                          IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS NSS(MODP)    dh14
Apr 10 14:22:51 fedora pluto[11745]:   MODP3072                          IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS NSS(MODP)    dh15
Apr 10 14:22:51 fedora pluto[11745]:   MODP4096                          IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS NSS(MODP)    dh16
Apr 10 14:22:51 fedora pluto[11745]:   MODP6144                          IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS NSS(MODP)    dh17
Apr 10 14:22:51 fedora pluto[11745]:   MODP8192                          IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS NSS(MODP)    dh18
Apr 10 14:22:51 fedora pluto[11745]:   DH19                              IKEv1: IKE         IKEv2: IKE ESP AH  FIPS NSS(ECP)     ecp_256, ecp256
Apr 10 14:22:51 fedora pluto[11745]:   DH20                              IKEv1: IKE         IKEv2: IKE ESP AH  FIPS NSS(ECP)     ecp_384, ecp384
Apr 10 14:22:51 fedora pluto[11745]:   DH21                              IKEv1: IKE         IKEv2: IKE ESP AH  FIPS NSS(ECP)     ecp_521, ecp521
Apr 10 14:22:51 fedora pluto[11745]:   DH31                              IKEv1: IKE         IKEv2: IKE ESP AH       NSS(ECP)     curve25519
Apr 10 14:22:51 fedora pluto[11745]: IPCOMP algorithms:
Apr 10 14:22:51 fedora pluto[11745]:   DEFLATE                           IKEv1:     ESP AH  IKEv2:     ESP AH  FIPS
Apr 10 14:22:51 fedora pluto[11745]:   LZS                               IKEv1:             IKEv2:     ESP AH  FIPS
Apr 10 14:22:51 fedora pluto[11745]:   LZJH                              IKEv1:             IKEv2:     ESP AH  FIPS
Apr 10 14:22:51 fedora pluto[11745]: testing CAMELLIA_CBC:
Apr 10 14:22:51 fedora pluto[11745]:   Camellia: 16 bytes with 128-bit key
Apr 10 14:22:51 fedora pluto[11745]:   Camellia: 16 bytes with 128-bit key
Apr 10 14:22:51 fedora pluto[11745]:   Camellia: 16 bytes with 256-bit key
Apr 10 14:22:51 fedora pluto[11745]:   Camellia: 16 bytes with 256-bit key
Apr 10 14:22:51 fedora pluto[11745]: testing AES_GCM_16:
Apr 10 14:22:51 fedora pluto[11745]:   empty string
Apr 10 14:22:51 fedora pluto[11745]:   one block
Apr 10 14:22:51 fedora pluto[11745]:   two blocks
Apr 10 14:22:51 fedora pluto[11745]:   two blocks with associated data
Apr 10 14:22:51 fedora pluto[11745]: testing AES_CTR:
Apr 10 14:22:51 fedora pluto[11745]:   Encrypting 16 octets using AES-CTR with 128-bit key
Apr 10 14:22:51 fedora pluto[11745]:   Encrypting 32 octets using AES-CTR with 128-bit key
Apr 10 14:22:51 fedora pluto[11745]:   Encrypting 36 octets using AES-CTR with 128-bit key
Apr 10 14:22:51 fedora pluto[11745]:   Encrypting 16 octets using AES-CTR with 192-bit key
Apr 10 14:22:51 fedora pluto[11745]:   Encrypting 32 octets using AES-CTR with 192-bit key
Apr 10 14:22:51 fedora pluto[11745]:   Encrypting 36 octets using AES-CTR with 192-bit key
Apr 10 14:22:51 fedora pluto[11745]:   Encrypting 16 octets using AES-CTR with 256-bit key
Apr 10 14:22:51 fedora pluto[11745]:   Encrypting 32 octets using AES-CTR with 256-bit key
Apr 10 14:22:51 fedora pluto[11745]:   Encrypting 36 octets using AES-CTR with 256-bit key
Apr 10 14:22:51 fedora pluto[11745]: testing AES_CBC:
Apr 10 14:22:51 fedora pluto[11745]:   Encrypting 16 bytes (1 block) using AES-CBC with 128-bit key
Apr 10 14:22:51 fedora pluto[11745]:   Encrypting 32 bytes (2 blocks) using AES-CBC with 128-bit key
Apr 10 14:22:51 fedora pluto[11745]:   Encrypting 48 bytes (3 blocks) using AES-CBC with 128-bit key
Apr 10 14:22:51 fedora pluto[11745]:   Encrypting 64 bytes (4 blocks) using AES-CBC with 128-bit key
Apr 10 14:22:51 fedora pluto[11745]: testing AES_XCBC:
Apr 10 14:22:51 fedora pluto[11745]:   RFC 3566 Test Case 1: AES-XCBC-MAC-96 with 0-byte input
Apr 10 14:22:51 fedora pluto[11745]:   RFC 3566 Test Case 2: AES-XCBC-MAC-96 with 3-byte input
Apr 10 14:22:51 fedora pluto[11745]:   RFC 3566 Test Case 3: AES-XCBC-MAC-96 with 16-byte input
Apr 10 14:22:51 fedora pluto[11745]:   RFC 3566 Test Case 4: AES-XCBC-MAC-96 with 20-byte input
Apr 10 14:22:51 fedora pluto[11745]:   RFC 3566 Test Case 5: AES-XCBC-MAC-96 with 32-byte input
Apr 10 14:22:51 fedora pluto[11745]:   RFC 3566 Test Case 6: AES-XCBC-MAC-96 with 34-byte input
Apr 10 14:22:51 fedora pluto[11745]:   RFC 3566 Test Case 7: AES-XCBC-MAC-96 with 1000-byte input
Apr 10 14:22:51 fedora pluto[11745]:   RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 16)
Apr 10 14:22:51 fedora pluto[11745]:   RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 10)
Apr 10 14:22:51 fedora pluto[11745]:   RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 18)
Apr 10 14:22:51 fedora pluto[11745]: testing HMAC_MD5:
Apr 10 14:22:51 fedora pluto[11745]:   RFC 2104: MD5_HMAC test 1
Apr 10 14:22:51 fedora pluto[11745]:   RFC 2104: MD5_HMAC test 2
Apr 10 14:22:51 fedora pluto[11745]:   RFC 2104: MD5_HMAC test 3
Apr 10 14:22:51 fedora pluto[11745]: testing HMAC_SHA1:
Apr 10 14:22:51 fedora pluto[11745]:   CAVP: IKEv2 key derivation with HMAC-SHA1
Apr 10 14:22:51 fedora pluto[11745]: 20 CPU cores online
Apr 10 14:22:51 fedora pluto[11745]: starting up 19 helper threads
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 0
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 1
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 2
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 3
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 4
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 5
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 6
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 7
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 8
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 9
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 10
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 11
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 12
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 13
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 14
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 15
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 16
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 17
Apr 10 14:22:51 fedora pluto[11745]: started thread for helper 18
Apr 10 14:22:51 fedora pluto[11745]: using Linux xfrm kernel support code on #1 SMP PREEMPT_DYNAMIC Thu Apr  2 16:55:52 UTC 2026
Apr 10 14:22:51 fedora pluto[11745]: setting expire-lifetime= to 30 from '/proc/sys/net/core/xfrm_acq_expires'
Apr 10 14:22:51 fedora pluto[11745]: CRL fetch support [disabled]
Apr 10 14:22:51 fedora pluto[11745]: selinux support is NOT enabled.
Apr 10 14:22:51 fedora pluto[11745]: systemd watchdog for ipsec service configured with timeout of 200000000 usecs
Apr 10 14:22:51 fedora pluto[11745]: watchdog: sending probes every 100 secs
Apr 10 14:22:51 fedora pluto[11745]: DNSSEC support [enabled]
Apr 10 14:22:51 fedora pluto[11745]: kernel: directional SA supported by kernel
Apr 10 14:22:51 fedora pluto[11745]: kernel: IPTFS ipsec SA error: requires option CONFIG_XFRM_IPTFS
Apr 10 14:22:51 fedora pluto[11745]: kernel: MIGRATE SA supported by kernel
Apr 10 14:22:51 fedora pluto[11745]: seccomp security is not enabled
Apr 10 14:22:51 fedora pluto[11745]: listening for IKE messages
Apr 10 14:22:51 fedora pluto[11745]: Kernel supports NIC esp-hw-offload
Apr 10 14:22:51 fedora pluto[11745]: adding interface wlp0s20f3 192.168.1.17:UDP/500
Apr 10 14:22:51 fedora pluto[11745]: adding interface wlp0s20f3 192.168.1.17:UDP/4500 (NAT)
Apr 10 14:22:51 fedora pluto[11745]: adding interface lo 127.0.0.1:UDP/500
Apr 10 14:22:51 fedora pluto[11745]: adding interface lo 127.0.0.1:UDP/4500 (NAT)
Apr 10 14:22:51 fedora pluto[11745]: adding interface lo [::1]:UDP/500
Apr 10 14:22:51 fedora pluto[11745]: adding interface lo [::1]:UDP/4500 (NAT)
Apr 10 14:22:51 fedora pluto[11745]: loading secrets from "/etc/ipsec.secrets"
Apr 10 14:22:51 fedora pluto[11745]: loading secrets from "/etc/ipsec.d/ipsec.nm-l2tp.secrets"
Apr 10 14:22:51 fedora pluto[11745]: addconn: listening for IKE messages
Apr 10 14:22:51 fedora pluto[11745]: addconn: Kernel supports NIC esp-hw-offload
Apr 10 14:22:51 fedora pluto[11745]: addconn: adding interface wlp0s20f3 192.168.1.17:UDP/500
Apr 10 14:22:51 fedora pluto[11745]: addconn: adding interface wlp0s20f3 192.168.1.17:UDP/4500 (NAT)
Apr 10 14:22:51 fedora pluto[11745]: addconn: adding interface lo 127.0.0.1:UDP/500
Apr 10 14:22:51 fedora pluto[11745]: addconn: adding interface lo 127.0.0.1:UDP/4500 (NAT)
Apr 10 14:22:51 fedora pluto[11745]: addconn: adding interface lo [::1]:UDP/500
Apr 10 14:22:51 fedora pluto[11745]: addconn: adding interface lo [::1]:UDP/4500 (NAT)
Apr 10 14:22:51 fedora pluto[11745]: addconn: loading secrets from "/etc/ipsec.secrets"
Apr 10 14:22:51 fedora pluto[11745]: addconn: loading secrets from "/etc/ipsec.d/ipsec.nm-l2tp.secrets"
Apr 10 14:22:51 fedora pluto[11745]: addconn:
Apr 10 14:22:51 fedora pluto[11745]: "3e180507-8651-4e4f-9c48-1c35aba14189": added IKEv1 connection
Apr 10 14:22:51 fedora NetworkManager[11786]:   sending to pluto
Apr 10 14:22:51 fedora pluto[11745]: "3e180507-8651-4e4f-9c48-1c35aba14189" #1: initiating IKEv1 Main Mode connection
Apr 10 14:22:51 fedora pluto[11745]: "3e180507-8651-4e4f-9c48-1c35aba14189" #1: sent Main Mode request
Apr 10 14:22:52 fedora pluto[11745]: "3e180507-8651-4e4f-9c48-1c35aba14189" #1: ERROR: asynchronous network error report on wlp0s20f3 (192.168.1.17:500), complainant 159.93.36.100: No route to host [errno 113, origin ICMP type 3 code 10 (not authenticated)]
Apr 10 14:22:52 fedora pluto[11745]: "3e180507-8651-4e4f-9c48-1c35aba14189" #1: STATE_MAIN_I1: retransmission; will wait 0.5 seconds for response
Apr 10 14:22:52 fedora pluto[11745]: "3e180507-8651-4e4f-9c48-1c35aba14189" #1: ERROR: asynchronous network error report on wlp0s20f3 (192.168.1.17:500), complainant 159.93.36.100: No route to host [errno 113, origin ICMP type 3 code 10 (not authenticated)]
Apr 10 14:22:52 fedora pluto[11745]: "3e180507-8651-4e4f-9c48-1c35aba14189" #1: STATE_MAIN_I1: retransmission; will wait 1 seconds for response
Apr 10 14:22:52 fedora pluto[11745]: "3e180507-8651-4e4f-9c48-1c35aba14189" #1: ERROR: asynchronous network error report on wlp0s20f3 (192.168.1.17:500), complainant 159.93.36.100: No route to host [errno 113, origin ICMP type 3 code 10 (not authenticated)]
Apr 10 14:22:53 fedora pluto[11745]: "3e180507-8651-4e4f-9c48-1c35aba14189" #1: STATE_MAIN_I1: retransmission; will wait 2 seconds for response
Apr 10 14:22:54 fedora pluto[11745]: "3e180507-8651-4e4f-9c48-1c35aba14189" #1: ERROR: asynchronous network error report on wlp0s20f3 (192.168.1.17:500), complainant 159.93.36.100: No route to host [errno 113, origin ICMP type 3 code 10 (not authenticated)]
Apr 10 14:22:55 fedora pluto[11745]: "3e180507-8651-4e4f-9c48-1c35aba14189" #1: STATE_MAIN_I1: retransmission; will wait 4 seconds for response
Apr 10 14:22:55 fedora pluto[11745]: "3e180507-8651-4e4f-9c48-1c35aba14189" #1: ERROR: asynchronous network error report on wlp0s20f3 (192.168.1.17:500), complainant 159.93.36.100: No route to host [errno 113, origin ICMP type 3 code 10 (not authenticated)]
Apr 10 14:22:59 fedora pluto[11745]: "3e180507-8651-4e4f-9c48-1c35aba14189" #1: STATE_MAIN_I1: retransmission; will wait 8 seconds for response
Apr 10 14:22:59 fedora pluto[11745]: "3e180507-8651-4e4f-9c48-1c35aba14189" #1: ERROR: asynchronous network error report on wlp0s20f3 (192.168.1.17:500), complainant 159.93.36.100: No route to host [errno 113, origin ICMP type 3 code 10 (not authenticated)]
Apr 10 14:23:07 fedora pluto[11745]: "3e180507-8651-4e4f-9c48-1c35aba14189" #1: STATE_MAIN_I1: retransmission; will wait 16 seconds for response
Apr 10 14:23:07 fedora pluto[11745]: "3e180507-8651-4e4f-9c48-1c35aba14189" #1: ERROR: asynchronous network error report on wlp0s20f3 (192.168.1.17:500), complainant 159.93.36.100: No route to host [errno 113, origin ICMP type 3 code 10 (not authenticated)]

[dkosovic]

Sorry about the Copilot pull request response, I intended to assign myself to this issue, but accidently assigned Copilot.

A router or firewall is receiving the initial packet and seems to be rejecting it and returning an ICMP error.

You could use tcpdump to see where the ICMP packets are coming from, then you'll know which router or firewall needs to be sorted out.

Start tcpdump with the following to capture ICMP packets:

sudo tcpdump -ni wlp0s20f3 'icmp'

then issue the following:

echo "test" | nc -u -v 159.93.36.100 500

[dkosovic]

With the Windows built-in L2TP/IPsec client, you should change the default "Optional encryption (connect even if no encryption)" setting to "Require encryption (disconnect if server declines)" to ensure L2TP/IPsec is used as it may be falling back to L2TP only.