Child Item

Site Totals

61246 Questions Answered 267 Categories

OpenDNS Umbrella VPN no longer working on Verizon Network

As of Wed 9/14/2016 I am no longer able to connect though my opendns VPN on my iOS device. I'm using OpenDNS's Umbrella IPSEC VPN tunnel for iOS. Their service works fine on any wi-fi I am connected to but does not work when I try and use it via LTE. I began using it in July 2016 and up until Wed it worked fine.

I initially contacted OpenDNS and they had me run several diagnostics and believe the issue is with Verison and a change that was made in routing IPSEC traffic.

If this is not the correct forum for technical support please kindly direct me to the correct location.

Comments

Ann154

The members John_Getzke and 7e18n1 are much more familiar with VPN issues then I am.

Verizon_Support

We want to make sure that you are able to use your phone the way you need to at all times, CuRooster. You mentioned this change came about on Wednesday the 14th. At that time, did you do any updates on your device? Software/application?

NicholeK_VZW

Follow us on Twitter @VZWSupport
If my response answered your question please click the �Correct Answer� button under my response. This ensures others can benefit from our conversation. Thanks in advance for your help with this!!

7e18n1

VzW changes things all the time and when they do they don't seem to be in any hurry to reverse such changes that may affect users. I think you'll fair better by calling Customer Service (800) 922-0204 to complain and go on record. Beyond that, try another VPN.

https://www.google.com/#q=vpn+reviews

See reddit.com
for user comments:

https://www.reddit.com/r/vpnreviews/

https://www.reddit.com/r/vpnreviews/comments/4ylflv/review_torguard_vs_nordvpn_vs_private_internet/

shfurey

Hi Nicole,

I work for OpenDNS\Cisco. We have had two reports of this when users hit our Seattle datacenter. It works fine if they are on WiFi so it points to an issue when they route via the VZW network.

Traceroutes do reach the datacenter but they are unable to establish an IPSEC connection.

Can we get this escalated to your network operations team?

I have already sent an email to [removed] as they are listed as the tech contact in ARIN.

All pertinent information is below. Don't hesitate to contact me directly if you need more information.

Thanks,

Shaun

Our Server addresses they would connect to would be m13.sea.opendns.com and m14.sea.opendns.com

Client source addresses at time of failure were 70.199.135.179 and 70.199.149.250

traceroute to vpn.umbrella.opendns.com (24.216.67.208)...

0 193.sub-66-174-27.myvzw.com (66.174.27.193) 25.72ms 17.87ms 55.38ms

1 100.sub-69-83-157.myvzw.com (69.83.157.100) 37.27ms 28.95ms 29.87ms

2 178.sub-69-83-157.myvzw.com (69.83.157.178) 25.72ms 26.93ms 39.97ms

3 194.sub-69-83-157.myvzw.com (69.83.157.194) 37.78ms 19.09ms 30.83ms

4 12.sub-69-83-144.myvzw.com (69.83.144.12) 26.73ms 25.59ms 31.88ms

5 141.sub-66-174-24.myvzw.com (66.174.24.141) 23.82ms 184.24ms 45.13ms

6 lag-101.ear2.seattle1.level3.net (4.16.146.137) 44.89ms 22.73ms 46.81ms

7 - * * *

8 open-dns-in.ear3.seattle1.level3.net (4.35.240.42) 109.2ms 40.59ms 37.47ms

9 m14.sea.opendns.com (208.67.216.24) 28.96ms 39.46ms 29.77ms

Here is a reverse trace our server to the clients address at time of failure (stops at hop 6)

[removed] ~] $ traceroute 70.199.135.179

traceroute to 70.199.135.179 (70.199.135.179), 30 hops max, 60 byte packets

1 rtr1.sea.opendns.com (208.67.216.1) 0.268 ms 0.262 ms 0.361 ms

2 7-1-16.ear3.Seattle1.Level3.net (4.35.240.41) 0.554 ms 0.524 ms 0.524 ms

3 * * *

4 VERIZON-WIR.ear2.Seattle1.Level3.net (4.16.146.138) 1.379 ms 1.361 ms 1.360 ms

5 140.sub-66-174-24.myvzw.com (66.174.24.140) 4.340 ms 142.sub-66-174-24.myvzw.com (66.174.24.142) 1.555 ms 4.759 ms

6 13.sub-69-83-144.myvzw.com (69.83.144.13) 1.418 ms 15.sub-69-83-144.myvzw.com (69.83.144.15) 1.408 ms 13.sub-69-83-144.myvzw.com (69.83.144.13) 1.378 ms

7 * * *

8 * * *

John_Getzke

Without a specific error message to help you research there isn't much the community can do for you on this one. VPNs should be compatible with VZWs network, but you may have to tweak them from time to time to get them to work. This is normally a task for the VPN administrator, someone who has access to the VPN server or can adjust how the VPN is connecting behind the scenes.

It might be better to check with OpenDNS on this one to see if any other users are experiencing the same problems and hop onboard that support train for a resolution. I can almost guarantee that VZW is not going to make a change to their network if they are responsible for the outage on their NAT Firewall. You will have to configure around VZW instead.

CuRooster

I did not do any updates to either my phone or the OpenDNS Umbrella VPN App.

Scott C.

CuRooster

The OpenDNS technical support engineer from OpenDNS I am working with had posted some trace logs to this thread to help Verizon Engineers figure out what is happening.

If if you haven't reached out to them yet please do so. I'm diligently working with them to get additional networking details to help trace down this issue.

Scott C.

SethS

Verizon Wireless,

I have exactly the same issue starting at the same time. I am sure this is a Verizon Wireless issue in the Seattle area. I have a second VPN provider besides OpenDSN Umbrella and it has the same problem - negotiation with VPN provider fails. The error is also on my second iPhone. VPN works fine over WiFi. It does not work over Verizon cellular.

I have tried contacting Verizon support but the people I talked with did not understand the issues and referred me to my VPN provider. I too have worked with OpenDNS and the problem definitely appears to be with Verizon. The OpenDNS support, based in Massachusetts, was able to establish VPN connection in his area over Verizon.

Who at Verizon can help? This is very frustrating.

I have both iPhone 6 and 5s. The problem is on iOS 9.3.5 and 10.0.1.

Thank you,

Seth

John_Getzke

Can you provide the VZW community with the error messages or error information you have received from OpenDNS so far? That will help us track and compare the problem with others who are reporting the issue in that area.

If this is a regional issue to Seattle that may help the case with getting traction with VZW support engineers. Especially if we can confirm that it works just outside of that service area, that this is something that VZW intends to work.

shfurey

Hi John,

Here is all the info I asked Seth to provide to VZW Support. Hope this helps.

Cheers!

Shaun

Error message: Negotiation with VPN server failed.
Also attempted to connect to our Los Angeles and New York Datacenter with the same results. Customer also gets the samee error with another companies VPN service as well. L2TP VPN traffic works fine so it appears only IPSEC is affected.
OpenDNS successfully connected to the VPN in our Seattle datacenter over Verizon in the Boston, MA area so it definitely appears to be limited to Seattle area Verizon customers.
Server addresses for the VPN servers we tested with are:

Seattle - [removed]
Los Angeles - [removed]
New York City - [removed]

Client source addresses at time of failure were [removed]

Below are traceroutes showing traffic to our Seattle DC as well as return traffic from our Seattle datacenter to the ip address you had with Verizon a couple of days ago. This should help their network engineers narrow down the problem device between client devices and our datacenter.

traceroute to vpn.umbrella.opendns.com (24.216.67.208)...

0 [removed] 25.72ms 17.87ms 55.38ms

1 [removed] 37.27ms 28.95ms 29.87ms

2 [removed] 25.72ms 26.93ms 39.97ms

3 [removed]) 37.78ms 19.09ms 30.83ms

4 [removed] 26.73ms 25.59ms 31.88ms

5 [removed] 23.82ms 184.24ms 45.13ms

6 [removed] 44.89ms 22.73ms 46.81ms

7 - * * *

8 [removed] 109.2ms 40.59ms 37.47ms

9 [removed] 28.96ms 39.46ms 29.77ms

Here is a reverse trace our server to the clients address at time of failure (stops at hop 6)

[removed]

traceroute to [removed], 30 hops max, 60 byte packets

1 [removed] 0.268 ms 0.262 ms 0.361 ms

2 [removed] 0.554 ms 0.524 ms 0.524 ms

3 * * *

4 [removed] 1.379 ms 1.361 ms 1.360 ms

5 [removed] 1.555 ms 4.759 ms

6 [removed] 1.418 ms [removed]1.408 ms [removed] 1.378 ms

7 * * *

8 * * *

Personal information removed as required by the Verizon Wireless Terms of Service

Message edited by Verizon Moderator

SethS

Hi John,

Since the reply I sent my email has not shown up here I am adding it for the community,

Here is the information on this problem that I have:

1. I discovered today that VPN over cellular works using L2PT protocol.

traceroute to us-seattle.privateinternetaccess.com ([removed])...

[removed] 53.95ms 28.19ms 39.94ms

[removed] 38.36ms 29.02ms 39.63ms

2. Information from troubleshooting with OpenDNS (uses iPSec protocol) provided by OpenDNS Technical Support Engineer.

• Error message: Negotiation with VPN server failed.

• You attempted to connect to our Los Angeles and New York Datacenter with the same results. You also saw the error with another companies VPN service as well.

• OpenDNS successfully connected to the VPN in our Seattle datacenter over Verizon in the Boston, MA area so it definitely appears to be limited to Seattle Verizon customers.

• Server addresses for the VPN servers we tested with are:

Seattle - [removed]

Los Angeles - [removed]

New York City - [removed]

• Client source addresses at time of failure were 70.199.135.179 and 70.199.149.250.

traceroute to vpn.umbrella.opendns.com ([removed])...

0 [removed]) 25.72ms 17.87ms 55.38ms

1 [removed] 37.27ms 28.95ms 29.87ms

2 [removed] 25.72ms 26.93ms 39.97ms

3 [removed] 37.78ms 19.09ms 30.83ms

4 [removed] 26.73ms 25.59ms 31.88ms

5 [removed] 23.82ms 184.24ms 45.13ms

6 l[removed] 44.89ms 22.73ms 46.81ms

7 - * * *

8 [removed]109.2ms 40.59ms 37.47ms

9 [removed] 28.96ms 39.46ms 29.77ms

Here is a reverse trace our server to the clients address at time of failure (stops at hop 6)

[support@m14.sea ~] $ traceroute 70.199.135.179

traceroute to [removed], 30 hops max, 60 byte packets

1 [removed] 0.268 ms 0.262 ms 0.361 ms

2 [removed] 0.554 ms 0.524 ms 0.524 ms

3 * * *

4 [removed] 1.379 ms 1.361 ms 1.360 ms

5 [removed] 1.555 ms 4.759 ms

6 [removed] 1.408 ms [removed] 1.378 ms

7 * * *

8 * * *

Please let me know if there is any other information I can provide.

Thank you

Personal information removed as required by the Verizon Wireless Terms of Service

Message edited by Verizon Moderator

Bigchris1

Not employe

Child Item