For work I needed to connect to a private network over L2TP/IPsec. The VPN client built into Windows 10 refused to connect at all, and it gave me nothing to debug with: no log of the key exchange, no hint about which step failed. I went looking for another program that could do the job and found nothing suitable
This became the reason for creating AURA — a VPN client that speaks the whole protocol itself, so when something goes wrong you can see exactly where
🔐 What is it?
AURA is a Windows 10 L2TP/IPsec VPN client with its own IKEv1, ESP, L2TP and PPP stack, written in pure Python with PyQt5. The traffic goes through a Wintun virtual adapter, the driver from the WireGuard project. Nothing of Windows' built-in VPN client is used: no RAS connection, no rasdial, no Windows VPN service. The program needs administrator rights at launch, because the adapter, routes and DNS are system changes, and asks for them once through UAC
⚙️ How does it work?
You enter a server, a username, a password and, when the server wants one, a pre-shared key, then press CONNECT. AURA offers the server 18 IKE proposals (AES/3DES, SHA-256/SHA-1, DH 14/5/2) and uses whichever it picks, opens one L2TP tunnel and session, authenticates with MS-CHAPv2, CHAP or PAP, whatever the server asks for, and gets its address and DNS over IPCP. The status bar and the log panel walk through every stage
The most interesting part was a bug I could not see. After a successful key exchange the server's replies were reaching the network card, but my socket received nothing. Windows hands ESP packets that arrive on UDP port 4500 to its own IPsec driver, and a user-mode socket bound to that port sees only the IKE messages. The fix was to send from an ephemeral local port: the server answers whatever port it observes
Because the program changes routes and DNS, every change is recorded before it is made, and the next launch removes whatever a crash left behind. Your credentials stay on your machine: a password and a pre-shared key are written to disk only when you tick Remember, as a DPAPI blob that opens for your Windows account alone, and they never reach the log
✨ Key Features:
🔐 Own IKEv1/IPsec Stack
Main and quick mode with a pre-shared key, NAT traversal and dead peer detection. Offers 18 proposals (AES/3DES, SHA-256/SHA-1, DH 14/5/2) and uses whichever the server picks🧵 L2TP + PPP
One tunnel and session with keepalive, then MS-CHAPv2 / CHAP / PAP (whatever the server asks for), IPCP for the address and DNS, and MPPE where a server demands it🛡️ Wintun Virtual Adapter
Traffic goes through a real Wintun adapter named AURA. Route all sends everything through the tunnel, or list your own networks inextraRoutes🗂️ Connection Profiles
Several saved servers in a combo box. Password and pre-shared key are kept only on request, protected with DPAPI🧹 Crash Recovery Sweep
Every route, DNS entry and the adapter are recorded before they change, and the next launch removes whatever a crash left behind
🗺️ Roadmap:
In-place IPsec Rekey — Renew the security association before it expires. Today the session ends when the server drops it
IKEv2 — A second protocol next to IKEv1
Certificates — Authentication beyond the pre-shared key
IPv6 — Addresses and routes inside the tunnel
Tray Icon — Live in the notification area
Automatic Reconnect — Come back after a lost link
Kill Switch — No traffic outside the tunnel while it is meant to be up
L2TP Tunnel Secret — Servers that authenticate the tunnel itself with a shared secret are refused today
Top comments (0)