Change:
Phew, a big title! Trying to write down as much as I can before I forget. First, the last part: If doesn't exist, will show failing like: fixes this problem. NixOS should probably create this file. I'm not sure if this file should be writable or not, when it exists, I have only ever seen it contain: I don't know what writes that there. Now for can't edit L2TP VPNs, but (GUI) can, even though nm-applet doesn't work under sway. If you see this in the system logs: try enabling "legacy proposals" in nm-connection-editor's IPSec Settings and try again. system: host os: multi-user?: sandbox: version: channels(root): channels(grahamc): nixpkgs:
Side note, how do I know for sure fixes it? I erased my dozens of times nailing it down, reproducing it to exactly this.
I think the strongswan module creates that file and the actual L2TP plugin appends that line to this file.
Nice find that the strongswan module does create that file! I don't have the strongswan module enabled, it seems something else in the stack would periodically create this file?
I'm not sure what does create it eventually, but it appears the plugin expects the file to exist so we should just do exactly that. It doesn't help that it expects it to be mutable, so maybe we can handle this within the NM module to add more secrets. Though it would probably duplicate what the strongswan module does.
^ does this make sense to you?
So I just remembered about this module I have: maybe instead we should have the networkmanager do when it detects the l2tp plugin but I am not sure how to do that. Maybe we would need to introduce a new option in networkmanager to add the nm-l2tp plugin and create the file. I tend to connect physically to the private network and only as a last resort rely to nm-l2tp since it tends to not work regularly and I am not sure if it's blocked by the network or some l2tp breakage.
We could add an option to networkmanager in the same way there's one for strongswan there
Was there ever any follow up on :
Hello, I'm a bot and I thank you in the name of the community for opening this issue. To help our human contributors focus on the most-relevant reports, I check up on old issues to see if they're still relevant. This issue has had no activity for 180 days, and so I marked it as stale, but you can rest assured it will never be closed by a non-human. The community would appreciate your effort in checking if the issue is still valid. If it isn't, please close it. If the issue persists, and you'd like to remove the stale label, you simply need to leave a comment. Your comment can be as simple as "still important to me". If you'd like it to get more attention, you can ask for help by searching for maintainers and people that previously touched related code and @ mention them in a comment. You can use or on the relevant files to find them. Lastly, you can always ask for help at or at .
i guess, it's still relevant, maybe not so urgent. this helped me big time:
I marked this as stale due to inactivity. &rarr;
I just ran into this on 21.05. Seeing a log like this: <details<summaryjournalctl log when starting vpn</summary<pre<codecharon[2059]: 00[CFG] loading ca certificates from '/nix/store/va01sq5aqg6p7yakvpg2zlnsdj4pm9dj-strongswan-5.8.1/etc/ipsec.d/cacerts' charon[2059]: 00[CFG] loading aa certificates from '/nix/store/va01sq5aqg6p7yakvpg2zlnsdj4pm9dj-strongswan-5.8.1/etc/ipsec.d/aacerts' charon[2059]: 00[CFG] loading ocsp signer certificates from '/nix/store/va01sq5aqg6p7yakvpg2zlnsdj4pm9dj-strongswan-5.8.1/etc/ipsec.d/ocspcerts' charon[2059]: 00[CFG] loading attribute certificates from '/nix/store/va01sq5aqg6p7yakvpg2zlnsdj4pm9dj-strongswan-5.8.1/etc/ipsec.d/acerts' charon[2059]: 00[CFG] loading crls from '/nix/store/va01sq5aqg6p7yakvpg2zlnsdj4pm9dj-strongswan-5.8.1/etc/ipsec.d/crls' charon[2059]: 00[CFG] loading secrets from '/nix/store/va01sq5aqg6p7yakvpg2zlnsdj4pm9dj-strongswan-5.8.1/etc/ipsec.secrets' charon[2059]: 00[CFG] expanding file expression '/etc/ipsec.secrets' failed charon[2059]: 00[CFG] opening triplet file /nix/store/va01sq5aqg6p7yakvpg2zlnsdj4pm9dj-strongswan- failed: No such file or directory charon[2059]: 00[CFG] loaded 0 RADIUS server configurations charon[2059]: 00[CFG] no script for ext-auth script defined, disabled charon[2059]: 00[LIB] loaded plugins: charon unbound pkcs11 aesni aes des rc2 sha2 sha1 md5 mgf1 rdrand random nonce x509 revocation constraints acert pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey dnscert pem openssl af-alg fips-prf gmp curve25519 chapoly xcbc cmac hmac curl attr kernel-netlink resolve socket-default connmark forecast farp stroke vici updown eap-identity eap-sim eap-sim-pcsc eap-aka eap-aka-3gpp2 eap-simaka-pseudonym eap-simaka-reauth eap-md5 eap-gtc eap-mschapv2 eap-radius xauth-generic xauth-eap xauth-pam dhcp counters charon[2059]: 00[JOB] spawning 16 worker threads ipsecstarter[2058]: charon (2059) started after 660 ms charon[2059]: 11[CFG] received stroke: add connection '-ebef-4658-8991-' charon[2059]: 11[CFG] configuration '-ebef-4658-8991-' charon[2059]: 13[CFG] rereading secrets charon[2059]: 13[CFG] loading secrets from '/nix/store/va01sq5aqg6p7yakvpg2zlnsdj4pm9dj-strongswan-5.8.1/etc/ipsec.secrets' charon[2059]: 13[CFG] expanding file expression '/etc/ipsec.secrets' failed charon[2059]: 14[CFG] received stroke: initiate '-ebef-4658-8991-' charon[2059]: 15[IKE] initiating Main Mode IKESA -ebef-4658-8991-[1] to 123.111.111.111 charon[2059]: 15[IKE] initiating Main Mode IKESA -ebef-4658-8991-[1] to 123.111.111.111 charon[2059]: 15[ENC] generating IDPROT request 0 [ SA V V V V V ] charon[2059]: 15[NET] sending packet: from 192.168.1.11[500] to 123.111.111.111[500] (304 bytes) charon[2059]: 03[NET] received packet: from 123.111.111.111[500] to 192.168.1.11[500] (204 bytes) charon[2059]: 03[ENC] parsed IDPROT response 0 [ SA V V V V V V ] charon[2059]: 03[IKE] received NAT-T (RFC 3947) vendor ID charon[2059]: 03[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID charon[2059]: 03[IKE] received draft-ietf-ipsec-nat-t-ike-02n vendor ID charon[2059]: 03[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID charon[2059]: 03[IKE] received draft-ietf-ipsec-nat-t-ike-00 vendor ID charon[2059]: 03[IKE] received DPD vendor ID charon[2059]: 03[CFG] selected proposal: IKE:AESCBC128/HMACSHA196/PRFHMACSHA1/MODP2048 charon[2059]: 03[ENC] generating IDPROT request 0 [ KE No NAT-D NAT-D ] charon[2059]: 03[NET] sending packet: from 192.168.1.11[500] to 123.111.111.111[500] (372 bytes) charon[2059]: 04[NET] received packet: from 123.111.111.111[500] to 192.168.1.11[500] (356 bytes) charon[2059]: 04[ENC] parsed IDPROT response 0 [ KE No NAT-D NAT-D ] charon[2059]: 04[IKE] no shared key found for 192.168.1.11 - 123.111.111.111 charon[2059]: 04[ENC] generating INFORMATIONALV1 request [ N(INVALKE) ] charon[2059]: 04[NET] sending packet: from 192.168.1.11[500] to 123.111.111.111[500] (56 bytes) NetworkManager[2277]: initiating Main Mode IKESA -ebef-4658-8991-[1] to 123.111.111.111 NetworkManager[2277]: generating IDPROT request 0 [ SA V V V V V ] NetworkManager[2277]: sending packet: from 192.168.1.11[500] to 123.111.111.111[500] (304 bytes) NetworkManager[2277]: received packet: from 123.111.111.111[500] to 192.168.1.11[500] (204 bytes) NetworkManager[2277]: parsed IDPROT response 0 [ SA V V V V V V ] NetworkManager[2277]: received NAT-T (RFC 3947) vendor ID NetworkManager[2277]: received draft-ietf-ipsec-nat-t-ike-03 vendor ID NetworkManager[2277]: received draft-ietf-ipsec-nat-t-ike-02n vendor ID NetworkManager[2277]: received draft-ietf-ipsec-nat-t-ike-02 vendor ID NetworkManager[2277]: received draft-ietf-ipsec-nat-t-ike-00 vendor ID NetworkManager[2277]: received DPD vendor ID NetworkManager[2277]: selected proposal: IKE:AESCBC128/HMACSHA196/PRFHMACSHA1/MODP2048 NetworkManager[2277]: generating IDPROT request 0 [ KE No NAT-D NAT-D ] NetworkManager[2277]: sending packet: from 192.168.1.11[500] to 123.111.111.111[500] (372 bytes) NetworkManager[2277]: received packet: from 123.111.111.111[500] to 192.168.1.11[500] (356 bytes) NetworkManager[2277]: parsed IDPROT response 0 [ KE No NAT-D NAT-D ] NetworkManager[2277]: no shared key found for 192.168.1.11 - 123.111.111.111 NetworkManager[2277]: generating INFORMATIONALV1 request [ N(INVALKE) ] NetworkManager[2277]: sending packet: from 192.168.1.11[500] to 123.111.111.111[500] (56 bytes) NetworkManager[2277]: establishing connection '-ebef-4658-8991-' failed NetworkManager[2283]: Stopping strongSwan IPsec... charon[2059]: 00[DMN] signal of type SIGINT received. Shutting down ipsecstarter[2058]: child 2059 (charon) has quit (exit code 0) ipsecstarter[2058]: ipsecstarter[2058]: charon stopped after 200 ms ipsecstarter[2058]: ipsec starter stopped nm-l2tp-service[2039]: gdbusmethodinvocationtake_error: assertion 'error != NULL' failed NetworkManager[954]: <warn[.6803] vpn-connection[0x24c60a0,-ebef-4658-8991-,"my-l2tp-vpn",0]: VPN connection: failed to connect: 'Message recipient disconnected from message bus without replying' .nm-applet-wrap[1470]: Failed to show notification: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.Notifications was not provided by any .service files </pre</code</detailsRunning the following command fixed my error and allowed me to connect: The networking part of my only has .
This still appears relevant in 21.11. Adding this (as mentioned above) to my config appears to get an L2TP and IPSec VPN working with NetworkManager:
Still relevant in 22.05. I am confirming that with a clean install, trying to set up L2TP/IPsec VPNs fail with the following indicator: fixed the issue for me straight away as well.
Fix in

Discussion:
environment.etc = { "NetworkManager/NetworkManager.conf".source = configFile; <ins> # The networkmanager-l2tp plugin expects /etc/ipsec.secrets to include /etc/ipsec.d/ipsec.nm-l2tp.secrets; # see https://github.com/NixOS/nixpkgs/issues/64965 "ipsec.secrets".text = '' include ipsec.d/ipsec.nm-l2tp.secrets ''; </ins> } // builtins.listToAttrs (map (pkg: nameValuePair "NetworkManager/${pkg.networkManagerPlugin}" {

let inherit (builtins) toFile; <del> inherit (lib) concatMapStringsSep concatStringsSep mapAttrsToList </del> <ins> inherit (lib) concatMapStrings concatStringsSep mapAttrsToList </ins> mkIf mkEnableOption mkOption types literalExpression optionalString; cfg = config.services.strongswan; <del> ipsecSecrets = secrets: toFile "ipsec.secrets" ( concatMapStringsSep "n" (f: "include ${f}") secrets ); </del> <ins> ipsecSecrets = secrets: concatMapStrings (f: "include ${f}n") secrets; </ins> ipsecConf = {setup, connections, ca}: let

}; <del> config = with cfg; let secretsFile = ipsecSecrets cfg.secrets; in mkIf enable </del> <ins> config = with cfg; mkIf enable </ins> { # here we should use the default strongswan ipsec.secrets and # append to it (default one is empty so not a pb for now) <del> environment.etc."ipsec.secrets".source = secretsFile; </del> <ins> environment.etc."ipsec.secrets".text = ipsecSecrets cfg.secrets; </ins> systemd.services.strongswan = { description = "strongSwan IPSec Service";

wants = [ "network-online.target" ]; after = [ "network-online.target" ]; environment = { <del> STRONGSWAN_CONF = strongswanConf { inherit setup connections ca secretsFile managePlugins enabledPlugins; }; </del> <ins> STRONGSWAN_CONF = strongswanConf { inherit setup connections ca managePlugins enabledPlugins; secretsFile = "/etc/ipsec.secrets"; }; </ins> }; serviceConfig = { ExecStart  = "${pkgs.strongswan}/sbin/ipsec start --nofork";