How to set up L2TP/IPsec VPN on Fedora 34


I’m tring to set up L2TP/IPsec VPN connection on Fedora 34 (it could be 33 as well), but fail to succeed. First, why is it not implemented in the network settings? Is there any license issues?
I followed these instructions but it didn’t want to connect. Then I found this post, deleted libreswan and installed strongswan, deleted VPN connection and set it up again. Now it connects to VPN, but I cannot open any web-pages.

Any idea where to start?

I managed to make it work. I had to check “Use this connection only for resources on its network”. I really don’t know why is this not checked by default :thinking:
I found the answer here.

That was a bit too fast reply from me. It still doesn’t work.

What is still not working … opening websites? Do you have a working DNS address.

1 Like

Wow, I have the very same issue starting with kernel 5.11.x, so I downgraded to 5.10.x to avoid this issue.

Disabling default route may not an option depending on your network infrastructure. So this is not a solution.


When I check “Use this connection only for resources on its network”, everything works, but ignores VPN. If I uncheck it, then it doesn’t open any webpages (the connection does not work).
@truster is there a way to test the disabling default route?

Check the output:

uname -a

5.11.10-300.fc34.x86_64 #1 SMP Thu Mar 25 14:03:32 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

1 Like

Try to downgrade and/or boot an older kernel version as suggested by @truster.

1 Like

I have issues with grub on this laptop. It shows for a second or two and then it goes to CLI (bash I gueass). And as it’s 34 version, it has only 5.11. kernel.
I tried it on Fedora 33 on my old computer, booted in the kernel 5.10.22-200, but the problem still persist. Not sure, but I think I made some kind of mistake. For the VPN setup I have IP, username, password and pre-shared key. All of them I wrote correctly and into correct places. :thinking:

1 Like

Check for SELinux warnings:

journalctl --no-pager -g avc
1 Like

Well, to be honest, I have no idea what to search for :slight_smile:
Could you give me a hint?

The given command literally includes the search term. :upside_down_face:
You can cut the output to the last few lines or post it to as-is.

There is really a lot of outputs. I cannot scroll to the start. This is the last line:

AVC avc: denied { getattr } for pid=1170 comm=“pool-geoclue” name=“/” dev=“cgroup2” ino=1 scontext=system_u:system_r:geoclue_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=filesystem permissive=0

That should be unrelated, filter it out:

journalctl --no-pager -g avc | grep -v -e pool-geoclue

Sorry for late reply. I didn’t have time to find a workaround, because I had to go back to the office where I don’t need VPN. I think I’ll wait until the final release of Fedora 34 and then try it again. I also have issues with keyboard backlight not working and USB ports also not working while on battery and with TLP installed. But of course with new treads.
Thanks for now

1 Like

After checking here, I found a solution for my (similar) problem (connect with L2TP IPsec and PSK on Fedora 34).


  • Install missing libraries (xl2tpd, NetworkManager-l2tp, NetworkManager-l2tp-gnome)
  • In Network manager vpn options (“L2TP IPsec Options” > “Advanced”):
    • Check “Disable PFS”;
    • Specify these “Phase2 Algorithms”: “aes256-sha1,aes128-sha1,3des-sha1”.