L.A.M.N.K » VPN

32bit Cisco VPN client on 64 bit linux systems

Lamnk — Wed, 23 Feb 2011 14:13:56 +0000

I’ve just encountered a strange problem with Cisco VPN Client:
# ll /opt/cisco-vpnclient/bin/ total 4224 ---x--x--x 1 root bin 1241184 Feb 23 12:35 cisco_cert_mgr* ---s--x--x 1 root bin 2181976 Feb 23 12:35 cvpnd* ---x--x--x 1 root bin 226700 Feb 23 12:35 ipseclog* ---x--x--x 1 root bin 666260 Feb 23 12:35 vpnclient* # /opt/cisco-vpnclient/bin/vpnclient zsh: no such file or directory: /opt/cisco-vpnclient/bin/vpnclient
My initial response was “wtf, how is this possible? The file is there, how dare zsh states the opposite?”

I scratched my head for a while, then tried this:
# ldd /opt/cisco-vpnclient/bin/vpnclient not a dynamic executable # ld /opt/cisco-vpnclient/bin/vpnclient ld: i386 architecture of input file `/opt/cisco-vpnclient/bin/vpnclient' is incompatible with i386:x86-64 output ld: error in /opt/cisco-vpnclient/bin/vpnclient(.eh_frame); no .eh_frame_hdr table will be created. ld: warning: cannot find entry symbol _start; defaulting to 000000000040a900
Ah, now that makes sense. Cisco has probably compiled vpnclient with gcc 32bit, so I turned the multilib repo on and installed lib32-gcc (named lib32gcc on ubuntu)
# pacman -S lib32-glibc lib32-gcc-libs # ldd /opt/cisco-vpnclient/bin/vpnclient linux-gate.so.1 => (0xf7793000) libvpnapi.so => /opt/cisco-vpnclient/lib/libvpnapi.so (0xf774a000) libm.so.6 => /usr/lib32/libm.so.6 (0xf7701000) libc.so.6 => /usr/lib32/libc.so.6 (0xf75b6000) /lib/ld-linux.so.2 (0xf7794000)
vpnclient works again

How to install Cisco VPN client on Ubuntu Jaunty Jackalope and Karmic Koala 64 bit

Lamnk — Mon, 26 Oct 2009 09:54:53 +0000

Update 2011-05-09: There is a new patch that works (I still recommend the vpnc client instead of Cisco client). I’ve mirrored the patch to my server: fixes-2.6.38.patch. Please note that you should apply the patch against a vanilla vpnclient setup directory (no other patch applied).

cd vpnclient/setup/directory/ wget http://www.lamnk.com/download/fixes-2.6.38.patch patch < ./fixes-2.6.38.patch sudo ./vpn_install

Again, from the awesome tuxx-home.at forum.
Update 2011-05-08: ~~Doesn't work for Natty Narwhal 11.04. There is currently no fix for this~~. You should use vpnc instead. It should be compatible with your VNP server, you just have to install vpnc using Synatics/apt-get and use pcf2vpnc convert your .pcf profile from Cisco client to vpnc .conf profile. Or install network-manager-vpnc-gnome package for a GUI client (doesn't have all capabilities of vpnc on command line).
Update 2010-10-31: Work for Maverick Meerkat 10.10 too
Update 2010-08-26: You can now install with this cisco vpn patch applied. It's all the old patches combined.

cd vpnclient/setup/directory/ wget http://www.lamnk.com/download/fixes.patch patch < ./fixes.patch sudo ./vpn_install

This patch is tested on Ubuntu Lucid Lynx 10.04 LTS on 32bit and 64bit.

Old post:
Cisco module again doesn't let us compile against the new kernel in Ubuntu 9.04 and 9.10 beta:

/home/lamnk/vpnclient/interceptor.c: In function ‘interceptor_init’: /home/lamnk/vpnclient/interceptor.c:132: error: ‘struct net_device’ has no member named ‘hard_start_xmit’ /home/lamnk/vpnclient/interceptor.c:133: error: ‘struct net_device’ has no member named ‘get_stats’ /home/lamnk/vpnclient/interceptor.c:134: error: ‘struct net_device’ has no member named ‘do_ioctl’ /home/lamnk/vpnclient/interceptor.c: In function ‘add_netdev’: /home/lamnk/vpnclient/interceptor.c:271: error: ‘struct net_device’ has no member named ‘hard_start_xmit’ /home/lamnk/vpnclient/interceptor.c:272: error: ‘struct net_device’ has no member named ‘hard_start_xmit’ /home/lamnk/vpnclient/interceptor.c: In function ‘remove_netdev’: /home/lamnk/vpnclient/interceptor.c:294: error: ‘struct net_device’ has no member named ‘hard_start_xmit’ make[2]: *** [/home/lamnk/vpnclient/interceptor.o] Error 1 make[1]: *** [_module_/home/lamnk/vpnclient] Error 2 make[1]: Leaving directory `/usr/src/linux-headers-2.6.31-1-generic' make: *** [default] Error 2 Failed to make module "cisco_ipsec.ko".

Before installtion I assume that you have the latest version 4.8.02.0030 and the required packages for compiling ie gcc, libstdc++6 ... The kernel version should be from 2.6.30 to 2.6.32

Download the client and extract it
Go to vpnclient folder:
cd vpnclient
Download patch file for 64 bit and apply it (users on 32bit systems can skip this step):
wget http://lamnk.com/download/vpnclient-linux-4.8.02-64bit.patch
patch < ./vpnclient-linux-4.8.02-64bit.patch
sed -i 's/^CFLAGS/EXTRA_CFLAGS/' Makefile
Download patch file for newer kernel (2.6.30+) and apply it:
wget http://lamnk.com/download/vpnclient-linux-2.6.31-final.diff
patch < ./vpnclient-linux-2.6.31-final.diff
Next we must edit a kernel source file
sudo sed -i 's/const\ struct\ net_device_ops\ \*netdev_ops;/struct\ net_device_ops\ \*netdev_ops;/' `find /usr/src -name netdevice.h`
Yes, it is a one liner, you should copy & paste that command instead of typing The command's translation into English: find the string const struct net_device_ops *netdev_ops; and change it to struct net_device_ops *netdev_ops; in the file locates at
find /usr/src -name netdevice.h
And finally, install Cisco VPN Client:
sudo ./vpn_install

The patch files are not from me. All credit goes to the people at tuxx-home.at forum

If you can't install or have a problem please leave a comment

How to fix error 27848 / 2738 at Cisco VPN installation

Lamnk — Thu, 27 Nov 2008 15:26:50 +0000

Sometimes (even with new machines) there are problems at the client’s installation, for example:

Error 27848: Deterministic Network Enhancer installation requires a reboot first, to free locked resources.

After that the installation process is rewinded back and canceled. To fix it, open the command prompt as administrator (Right click on cmd then choose Run as Administrator). Type those commands and press Enter:

cd %systemroot%system32
regsvr32 /u dneinobj.dll

If Vista complains about regsrv32, then maybe the program is not on the system path. You must use absolute path:

C:\Windows\system32\regsvr32 /u C:\Windows\system32\dneinobj.dll

For error 2738

Internal Error 2738

follow the same procedure as above, just replace the command regsvr32 /u dneinobj.dll with

C:\Windows\system32\regsvr32 C:\Windows\system32\vbscript.dll

Update: regsrv32 should be regsvr32, my mistake

How to install Cisco VPN client on Ubuntu Hardy Heron 8.04 64 bit

Lamnk — Sat, 17 May 2008 14:34:55 +0000

Nov 20 2010: New guide for Cisco vpnclient on Ubuntu linux Maverick Meerkat 10.10

UPDATE: A new client for linux (4.8.02.0030) is out. You no longer need the patch for 2.6.24+ kernel (vpnclient-linux-2.6.24-final.diff). However the patch for 64 bit systems is still required and the CFLAGS variable in Makefile still need to be changed to EXTRA_CFLAGS.

June 26 2009: This post also applies to Ubuntu Jaunty Jackalope 9.04 (more than one year later and it’s still not fixed)

I assume that you have the latest version 4.8.01.0640 and the required packages for compiling.

If you install the original Cisco VPN client on Hardy you will receive the following error:

make -C /lib/modules/2.6.24-16-generic/build SUBDIRS=/home/lamnk/src/vpn/vpnclient modules
make[1]: Entering directory `/usr/src/linux-headers-2.6.24-16-generic’
scripts/Makefile.build:46: *** CFLAGS was changed in “/home/lamnk/src/vpn/vpnclient/Makefile”. Fix it to use EXTRA_CFLAGS. Stop.
make[1]: *** [_module_/home/lamnk/src/vpn/vpnclient] Error 2
make[1]: Leaving directory `/usr/src/linux-headers-2.6.24-16-generic’
make: *** [default] Error 2

As those lines point out, you need to edit the Makefile file in the vpnclient folder and change CFLAGS to EXTRA_CFLAGS: Change the following line in Makefile

CFLAGS += -mcmodel=kernel -mno-red-zone

EXTRA_CFLAGS += -mcmodel=kernel -mno-red-zone

then apply the 2 patches for kernel 2.6.24 and for 64 bit:

vpnclient_folder$ wget lamnk.com/download/vpnclient-linux-2.6.24-final.diff
vpnclient_folder$ wget lamnk.com/download/cisco_skbuff_offset.patch
vpnclient_folder$ patch < ./vpnclient-linux-2.6.24-final.diff
vpnclient_folder$ patch < ./cisco_skbuff_offset.patch
vpnclient_folder$ ./vpn_install

If your system is 32 bit then you only need to patch the vpnclient-linux-2.6.24-final.diff file.

The patch for 64 bit system is from Stephen Frost and the patch for kernel 2.6.24 is from Alexander Griesser. Seriously Cisco should pay those guys some money … If these patches help you then please consider donate them.

Error 56: The Cisco Systems, Inc. VPN Service has not been started

Lamnk — Wed, 19 Mar 2008 15:19:52 +0000

On some systems there is this problem with Cisco VPN service: cvpnd.exe must be excuted before you run the ipsecdialer.exe ( the GUI for the client ). But even if you start the service per hand in services.msc, it got killed in a few seconds after thus you can not run the client.

Update: thanks to Zhigang Wu we now only need to disable the Internet Connection Sharing service (also in services.msc), turn it from Automatically starting to Manual, and start the Cisco service. It will not be killed again. The registry method becomes obsolete and is only recommended as a last resort as it’s dangerous and may cause you problems.

To work around this problem: Uninstall Cisco VPN in Windows Control Panel, then go to regedit and remove all the entries have Cisco term in them. Be careful, back up the registry with built-in export function of regedit first and do not delete somethings like “Franscisco”, ok ? Some entries can not be deleted, it’s normal, just F3 until you reach the end of the registry.

With kernel 2.6.24 you will need a patch to install Cisco VPN Client

Lamnk — Sat, 08 Mar 2008 16:51:08 +0000

UPDATE: A new client for linux (4.8.02.0030) is out. You no longer need the patch for 2.6.24+ kernel on 32 bit systems. However a patch for 64 bit systems is still required. Please click on the link right below to see the howto for 64bit.

UPDATE: 64 bit systems are a bit more complicated, please see how to install Cisco VPN on Hardy Heron 8.04 64 bit

UPDATE: with 2.6.25 kernel this patch is still required (luckily)

OK it’s not breaking news anymore, but in case you confront these errrors:

make -C /lib/modules/2.6.24-ARCH/build SUBDIRS=/usr/src/vpnclient modules
make[1]: Entering directory `/usr/src/linux-2.6.24-ARCH’
CC [M] /usr/src/vpnclient/linuxcniapi.o
In file included from /usr/src/vpnclient/Cniapi.h:15,
from /usr/src/vpnclient/linuxcniapi.c:31:
/usr/src/vpnclient/GenDefs.h:113: error: conflicting types for ‘uintptr_t’
include/linux/types.h:40: error: previous declaration of ‘uintptr_t’ was here
make[2]: *** [/usr/src/vpnclient/linuxcniapi.o] Error 1
make[1]: *** [_module_/usr/src/vpnclient] Error 2
make[1]: Leaving directory `/usr/src/linux-2.6.24-ARCH’
make: *** [default] Error 2

Then you probably need a patch:

cd /path/to/the/vpnclient/folder
wget http://projects.tuxx-home.at/ciscovpn/patches/vpnclient-linux-2.6.24-final.diff
patch < ./vpnclient-linux-2.6.24-final.diff

This is due to a change in 2.6.4 kernel that the “init_net” symbol is now again exported using EXPORT_SYMBOL() instead of EXPORT_SYMBOL_GPL()

Strange error when compile vpnc

Lamnk — Sat, 08 Mar 2008 00:29:47 +0000

I was playing around with Arch linux recently. It’s a minimalistic distro which lets you configure your system the way you want. Advatanges are booting time ( man it’s fast ), rolling release system so it doesn’t require you to install new release every 6 months like other distros, good package management tool alongside with the ports-like ABS to build things from source. Disadavantges are the time consuming configuration and you really need some linux knowledge, otherwise you will go back to Ubuntu someday :p

Back on topic, i rarely have any trouble compiling vpnc before, but this time it’s quite strange:

gcc -O3 -g -W -Wall -Wmissing-declarations -Wwrite-strings -DVERSION=\”0.5.1\” -c -o sysdep.o sysdep.c
In file included from config.h:27,
from sysdep.h:31,
from sysdep.c:71:
vpnc-debug.h:1: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘:’ token
vpnc-debug.h:16: warning: ‘struct debug_strings’ declared inside parameter list
vpnc-debug.h:16: warning: its scope is only this definition or declaration, which is probably not what you want
vpnc-debug.h:18: error: array type has incomplete element type
vpnc-debug.h:19: error: array type has incomplete element type
….
vpnc-debug.h:20: error: array type has incomplete element type

Turn out that you just need to define the locale with “sudo locale-gen” after editing the /etc/locale ( the location may differ with other distros )

Never ending headache … disconnect problem again

Lamnk — Wed, 27 Feb 2008 17:26:11 +0000

The VPN connection on Vista drops after every 5-10 minutes idle times ( means no surfing or other net related activities ). Why ? Fuck me if i know. It doesn’t matter over wireless or LAN, wired connection breaks all the time too.

And the employees in uni are reporting disconnecting problem on XP with their home DSL … How could i fix it, given that i’ve never ever used a dsl line before ? Otherwise reproducing disconnecting problems is very time consuming and boring.

Cisco VPN now runs on linux 64 bit systems

Lamnk — Fri, 18 Jan 2008 17:19:19 +0000

Errm … with a patch. Cisco hasn’t released a new version for Linux yet.

Quick guide: ( I assume you knew all the requirements to install the Cisco client )

Go to the extracted vpn directory
wget http://tuxx-home.at/projects/cisco-vpnclient/cisco_skbuff_offset.patch
patch < cisco_skbuff_offset.patch
sudo ./vpn_install

That’s it.

Cisco VPN Client: Reason 412 – The remote peer is no longer responding

Lamnk — Wed, 16 Jan 2008 15:38:17 +0000

The error: "Secure VPN connection terminated locally by the Client. Reason 412: The remote peer is no longer responding" means the software VPN Client detected that the VPN server is not responding anymore and deleted the connection. This is caused by several different reasons, for example:

The user is behind a firewall that is blocking ports UDP 4500/500 and/or ESP.
The VPN client is using connecting on TCP and the default TCP port 10000 for NATT is blocked.
The internet connection is not stable and some packets are not reaching the VPN concentrator/server or the replies from the server/concentrator aren’t getting to the client, hence the client thinks the server is no longer available.
The VPN client is behind a NAT device and the VPN Server doesn’t have NAT-T enabled. In this case the user will not be able to send or receive traffic at all. It will be able to connect but that’s all. After some time the software client deletes the VPN tunnel.