Phase1 negotiation failed due to time up 11.2.168.1.15 In such situation previous rules can't help, but next records were appearing in Mikrotik's logs.ġ92.168.1.15 parsing packet failed, possible couse: wrong password L2tp+ipsec encription (valid), proposal (valid), IPSec Secret (invalid) and user+password combination (invalid). Now I changed configuration on Windows side and it’s become to such form: After I was banned it became impossible to connect to vpn at all. I was getting Error #691 on Windows every time when I tried to connect with invalid user+password. My test user+pass combination was user user )) In additional the record ' user user authentification failed.' was appearing in Mikrotik logs every time when I tried to connect. On Mikrotik side our counters (firewall rules) were working and after several attempts with various user+pass combs my IP was blocked.

Image yourself that cracker picked up proposal and IPSec Secret. You can using various port scanners for searching IP address, but for other items you have to use brutforce.įirst I've created new VPN connection on Windows 7 and used such parameters: l2tp+ipsec encryption (valid), proposal (valid), IPSec Secret ( valid) and invalid user+password combination. So you need such information: hostname or IP, proposal, IPSec Secret, user and password.

Server (Mikrotik) runs l2tp+ipsec server. I will try to reproduce attackers actions and connect to my L2TP network. I think that there is no need to explain them, but one thing I have to admit, that you will be forced to change interface name from ether1-WAN to your WAN interface. They are monitoring and blocking connections from blacklist and preventing password brutforce. The first third of the protection of L2TP is firewall rules.

I found couple posts which helped me to write first part of that instruction. I spent a lot of time in search of information about L2TP protection.

Mikrotik l2tp firewall