Deron Meranda - 2004-11-24

Logged In: YES

First, I think some clarification of terminology is needed.
The situation you describe is where each host has multiple
IP addresses on a single interface. From the perspective of
the L2TP protocol, each address will look like a separate
peer (LAC or LNS).

So what you want is to establish multiple control
connections (using different endpoint addresses), each of
which has one tunnel carrying one session. You may know
this, but just to make it clear, you are not trying to
create two tunnels within the same control connection (peer

The problem you describe is inherent to how this L2TP
implementation is designed, and is actually quite common
among UDP applications that are not specifically coded to
handle secondary interface addresses. Many implementations
of the RPC portmapper for example also have this same
problem. Unless the code says otherwise, by default all
outbound UDP packets will have their source address set to
the *primary* address of the interface. TCP applications
don't have these issues since the kernel can associate the
incoming and outgoing packets as part of the same flow.

Without code modifications I can think of two ways to solve

1. Run separate instances of the l2tpd daemon, each bound to
a specific listening address (the "listen-addr" parameter in
the global section). --- (I think this may work, but I'm not
totally sure)

2. If you're on Linux, take advantage of the capability of
iptables to do NAT (SNAT and DNAT). Basically you tell the
kernel to correct the source address on outbound UDP packets
based upon the destination address. In your example, you'd
need to create a rule something like,

On host 1 (
iptables -t nat -A POSTROUTING \ -p udp --dport 1701 \ -d \ -j SNAT --to-source

On host 2 (
iptables -t nat -A POSTROUTING \ -p udp --dport 1701 \ -d \ -j SNAT --to-source

Hope that works... Deron Meranda