Issues with IKEv2 IPSec VPN on Rogers LTE/3G

[JP1204]

This is on an iPhone 7 connected to Rogers LTE or 3G wireless networks. 

I'm having an issue when using IKEv2 IPSec on NordVPN. The VPN connection gets established properly and connections through the VPN appear to work, speedtest works, many sites come up fine, etc. But some websites just never connect (e.g. https://us.opinio.net) through the VPN, others like https://www.reddit.com work 50% of the time. 

Using OpenVPN UDP port 1194 on the same NordVPN server instead of IPSec, there is no issue at all, so it's not a matter of the NordVPN server being blocked by the sites, or itself blocking requests. 

To rule out my phone or NordVPN, I switched the SIM card to TELUS LTE and both VPN modes work just fine, IPSec and OpenVPN. There is also no issues over WiFi.

There really seems to be an issue with Rogers and the connection through IPSec.

Do you guys have an idea what's going on? 

I found a thread where RogersDave suggest switching PDP Type to IPv4 instead of IPv6, but I see no options to do that on an iPhone 7. 

Thank you! 

[RogersCilio]

Hey @JP1204,

Welcome to the Rogers Community Forum!

I appreciate the time you took in researching this before bringing to the attention of our Community. 

You've definitely come to the right place! I'll tag in a few of our knowledgeable Resident Experts to assist you. @Gdkitty @Datalink @gp-se 

Cheers,

RogersCilio

[Datalink]

Nope, sorry.  This is a wireless issue not a modem/internet issue in the traditional sense of internet issues.  The reference to Dave's post was most likely for devices that connected thru the modem, trying to use IKE IPSEC.  That's almost broken as well, as:

"Non TCP/UDP/ICMP traffic (such as ESP/IPSec without NAT-T) is slowed down below 25 Mbps"

So, in a nutshell, looks like Rogers has an absolute problem with IKE IPSEC and now IKEv2 IPSEC.  This one should be sent to the engineering staff as no one in the community will be able to make it work.  This appears to be a modem (for internet) problem, and network problem for wireless devices.  

You would think that this would gain more attention with the growing use of IPV6.  For Xbox use a couple of references from an Xbox doc indicate:

1.   IPv6 firewalls that block inbound IPsec traffic can be problematic for P2P gaming

2.   CPE should follow RFC 6092 recommendations for IPsec traffic.
      Enable unsolicited, inbound IKE and ESP traffic to prevent blocking P2P IPsec

Its pretty hard to follow the second statement when IPV6 IKE might not even work on the Rogers network.   Fwiw .....
 

[JP1204]

Thank you for your answer. You mention "This one should be sent to the engineering staff", are they monitoring these forums? 

[Datalink]

@JP1204 the engineering staff don't monitor the forum postings.  @RogersCilio or one of the moderators at @CommunityHelps can forward this to the Wireless Engineering staff. 

[tjguy]

I am having the same problem on Rogers LTE. Using OpenVPN (port 1194), I successfully get a VPN connection however I will frequently be unable to visit most websites. Once I connect to a WiFi network, I experience no problems at all.

[JP1204]

I don’t know if it’s IPv6 fault but I find that when connected to LTE I often have to hit reload as webpages loading hangs a lot. It was fine a few weeks ago. Even in the middle of a Speedtest I get “network error” and it abruptly stops in the middle of it. That is with 5 bars of LTE in areas that used to be 100% reliable. Quite frankly this is getting very annoying and disappointing of Rogers.

[trunks33]

I have the same issue here. I have a Samsung S8. Nord VPN not working on LTE but is totally fine on wifi. Some webpages never load and commutation apps become very unstable, can't send or receive messages from time to time. One interesting thing is, Facebook first page will load, but when you click to view the comments, the comments won't display at all. The hope Rogers will fix this soon.

[Andrewvoid]

Hello,
I have the exact same issue on an iPhone 7, running iOS 11.3.

[Th1ef]

VPN (L2TP) not working over LTE?

Is anyone else having trouble connecting to VPN over LTE?

Has a issue a few days ago, then suddenly started working again. Today not working at all. I have been checking my routers and network etc. without success.

I am able to connect to my VPN server from Bell LTE and from WIFI networks and even internally within the same network but nothing over Rogers LTE?

I can see the packets hitting the router from Rogers LTE but the connection just won't establish.

Has something changed?

Anyone else having issues?

[Adrian91]

I am experiencing the same issues. I have a L2TP VPN server at work and one at home. I am able to connect to either of them as long as I am connected to a WiFi network. As soon as I disconnect from WiFi and remain connected to Rogers LTE only, I get this message:

"The L2TP-VPN server did not respond. Try reconnecting. If the problem continues, verify your settings and contact your Administrator."

I have tested it with an iPhone 7 Plus and an iPad Air 2, both running IOS 11.4.

Again, If I am connected to a WiFi network, I can connect to both VPN servers without a problem.

Rogers must be blocking/filtering one of these ports/protocols:

IP Protocol Type=UDP, UDP Port Number=500 <- Used by IKEv1 (IPSec control path)
IP Protocol Type=UDP, UDP Port Number=4500 <- Used by IKEv1 (IPSec control path)
IP Protocol Type=UDP, UDP Port Number=1701 <- Used by L2TP control/data path
IP Protocol Type=50 <- Used by data path (ESP)

I have similar issues connecting to a SIP server as well. As soon as I connect to a VPN server, the connection to the SIP server is made.

IP Protocol Type=UDP, UDP Port Number=5060 <- Used by SIP Server

PS: I have also tried to connect to various PIA (Private Internet Access) servers with the same results (failures). As soon as I switch from IPSEC to OpenVPN protocol, I have no problem.

Adrian

[Th1ef]

Hi,

This is exactly the same issue I am having.

I took my Rogers SIM out and put in an android that I tested earlier over Bell LTE and it worked instantly.

Soon as I put the rogers sim in and it failed, the same Android could no longer establish the VPN connection.

Something HAS changed within the last 24 hours. I called tech support, she was clueless.. Suggested I try on 3G only, did without success.

Once again, experiencing with 3 DIFFERENT Rogers SIM CARDS/NUMBERS to 3 DIFFERENT VPN Routers, with same issue. All 3 routers are on totally different carriers. Bell / START.CA and EASTLINK.

The only commonality is Rogers LTE.

I can see the connection ACK in the router so the tunnel starts to get connected and just drops.

It seems traffic is coming in one way to the router but cannot get from the VPN router back to Rogers.

VPN that works on BELL LTE  is not working on ROGERS LTE. Something is wrong.

I have ruled out, local ISPs, client hardware and the remote server hardware.

All that is left is ROGERS.

[Th1ef]

The level 1 techs are refusing to open tickets for this issue at tech support.

The first one told me "if you can browse websites then it *should* work"

The 2nd I just spoke to reset my phone connection and disconnected me!

Can we please get some help from Rogers staff here to escalate this to the right department?

[gysh]

Same issue here and level 1 is clueless about it

small situation here

1  Iphone 6S on Videotron (Works with L2TP VPN on LTE)

1 Iphone 7 on Rogers  Doesn't work with L2TP VPN on LTE

1  Android S7 ( i think) on Rogers  Works wiht L2TP VPN LTE

The Android and the Iphone 7 are on the same Rogers account.

Situation I did

1)  I inserted the Iphone 7 Sim (rogers) in my Iphone 6S (videotron) and VPN LTE doesn't work  (it worked with Videotron Sim)

2) I inserted the Iphone 7 SIM in the android (and VPN still works)  I inserted the android Sim (that works) in the Iphone 7  still doesn't work

Been with Rogers for 1h30 and they are clueless about this, all they saying is 'we don't support VPN'  This is bad because alot of people need to access our Cameras, and no way i'm opening the Cameras on the WAN for Rogers failure

[Th1ef]

Call and open a ticket.

Level 1 is only going to waste your time, it appears that the cause of this may be that Rogers switched to IPV6 ONLY without any IPV4 support.

I tested with Android S8 and was not able to get connected using a ROGERS SIM.

Also tested with a iPhone 6s and 2 iPhone Xs all with different SIMS no luck.

When tested with a Bell SIM everything is fine.

[JP1204]

Hello,

I'm the one who started this thread in March 2018. I just wanted to say the issue is still present with VPN connections (IPSEC / IKEv2) through Rogers LTE. It connects, but not all sites are accessible when connected through the VPN. I have confirmed with other cellular providers, Wi-Fi, etc. The only variable is Rogers LTE so I can only blame their service. 

Moreover, I have been having issues with the Rogers LTE Internet when no VPNs are involved. 

For example, browsing a website, you click a link and and it just sits there trying to load without success. Hit Reload and it works right away.

It seems about 30-40% of connections don't success and then reloading just works.

Same symptoms within mobile apps.

It makes for a very frustrating experience trying to use the Internet.

I have confirmed with a coworker who experiences that same issues and he thought it was his phone that was the problem.

Both of us are using iPhones in Ottawa.

Please look into this before we all switch providers... 

[Th1ef]

Have you tried changing your SIM card? It could be an antenna in your area?

Our issue is that we are physically blocked by connecting VPN at all -- as of yesterday.

[gysh]

For me, all our iphones doesn't work as of Friday i think

[RogersCilio]

Hey folks,

We appreciate everyone coming together and providing their feedback! Since VPN issues are something we don't generally suppport, I can't guarantee we'll be able to resolve this, but that definitely doesn't mean we can't look into it!

As stated by @Datalink, post #5 of this thread, please reach out to us in order to get the ball rolling, via @CommunityHelps.

Regards,

RogersCilio

[gysh]

We pay for your services, VPN is part of the services

If you don't fix it, i can guarantee we are gonna go somwhere else

[Adrian91]

Hey RogersCillio,

With all due respect, this is not about supporting VPN. Nobody's asking how to set it up. This is about blocking the ports without any warning. Please do not take this stance. It is not constructive.

Rogers must understand that paying customers (individuals as well as small business and enterprise) are relying on this paid service for business. The fact that all of a sudden our VPN connections back into our offices stopped working, creates a huge issues for us. Myself, for example, travel all over the world and run a whole IT department (people and systems) regardless where I find myself at any given time. Can you imagine what challenges this situation creates for me and my company?

The fact is that something changed on Rogers' network that blocks one or more of the following TCP ports: 500, 1701, 4500 as well as ESP protocol 50.

The more people are wasting their time testing and troubleshooting this situation and posting back, hopefully the more good information is gathered that will help Rogers NOC engineers understand what they've done and fix the issue.

And finally, I don't think that anyone is expecting Rogers techs to fix anything in this forum. 

My 2 cents,

Adrian