You can set outside-nexthop which fixed this. Also I think we can calculate first ip for gw-ip-address if outside-nexthop is not defined by cli.

@Dmitry Thanks for pointing that out, I've looked on the wiki (https://wiki.vyos.net/) and searched for a description for outside-nexthop, and failed to find it, and the in-line help while configuring doesn't help much.

Thus based on your input I've looked in /usr/libexec/vyos/conf_mode/accel_l2tp.py, and indeed it seems to do as you've described, but it does so only for the [ip-pool] section, not also for the [chap-secrets] section:

{% if (client_ip_pool) or (client_ip_subnets) %}
[ip-pool]
{% if client_ip_pool %}
{{client_ip_pool}}
{% endif -%}
{% if client_ip_subnets %}
{% for sn in client_ip_subnets %}
{{sn}}
{% endfor -%}
{% endif %}
{% endif %}
{% if outside_nexthop %}
gw-ip-address={{outside_nexthop}}
{% endif %}

{% if authentication['mode'] == 'local' %}
[chap-secrets]
chap-secrets=/etc/accel-ppp/l2tp/chap-secrets
{% endif %}

I've patched my version to include:

{% if authentication['mode'] == 'local' %}
[chap-secrets]
chap-secrets=/etc/accel-ppp/l2tp/chap-secrets
{% if outside_nexthop %}
gw-ip-address={{outside_nexthop}}
{% endif %}
{% endif %}

And I've configured outside-nexthop accordingly, and now it seems it works correctly.

I would suggest making outside-nexthop mandatory (as it doesn't work without it), and also adding it to the [chap-secrets] section.

Thanks.

I think better calculate gw-ip-address automatically. outside-nexthop excluded from required for migration reasons.
Not necessary define gw-ip-address in [chap-secrets] section, it works without any issue if defined it in [ip-pool] only.

Unfortunately it doesn't work without gw-ip-address also in [chap-secrets]. In my early trials I've tried that, and the clients received IP's from the pool instead the static values.

Also I think it is a good idea to leave the outside-nexthop, because for example one can configure a pool which doesn't include statically configured values. (For example I've configured my router 1, the static clients 5 through 60, and left a pool from 67 to 93 for unassigned ones.)

(I know this is a point-to-point, and it will work, but for simplicity I think it's better to keep the "impression" of a normal LAN to the clients.)

Agree with you, thank you. We need fixed these moments.

This is not a backport candidate until 'T834: accel-ppp: l2tp implementation' has been backported.