Set up vpn on mac osx server

Question

What is the most common reason that I can connect to the newly created vpn locally but not remotely (over the wan)?

Answer 1

I have had the same problem with setting up L2TP on Mavericks after upgrade.  After several failed attempts I have the following recepie.
To test this you need to have two separate networks to connect you VPN client to.  One should be the same as where the server is running and the other needs to be different so that the incoming traffic to your router is coming from the outside.
I'm assuming a setup with a router and behind it a local network with an OS X server running the VPN service (vpnd daemon)
On the server
Note the local ip-adress of your server.  This should preferably be static.
Install the VPN fix from apple: http://support.apple.com/kb/DL1716
In the OS X Server VPN Service create a VPN profile where VPN Host Name is local ip-adress of the VPN server.
Restart the VPN service and save the configuration file.
On the router
Open ports 500, 1701 and 4500 to pass UDP traffic to the server.  Make sure to activate them in the router interface.
Make a note of your routers public IP address. This should be static.
If this keeps changing you can set up a dynamic domain name (http://dyndns.org)
Optional: verify that the ports are actually open using nmap:
sudo nmap -Pn -sU XX.XX.XX.XX -p500,1701,4500
Password:
Starting Nmap 6.40 ( http://nmap.org ) at 2014-02-14 14:21 CET
Nmap scan report for ... (XX.XX.XX.XX)
Host is up (0.012s latency).
PORT     STATE         SERVICE
500/udp  open          isakmp
1701/udp open|filtered L2TP
4500/udp open|filtered nat-t-ike
Nmap done: 1 IP address (1 host up) scanned in 1.29 seconds
XX.XX.XX.XX is the public IP-adress of the router.  You can also try the same on the local IP-address of the server.
On the client
Copy the configuration file and install it by double klicking on the file.
Connect the client to the same local network as the vpn-server and activate the VPN connection. 
Verify that the VPN connection comes up.
Up to this point, smooth sailing. 
Now change the Server address to the IP-address of the router and turn on extra logging found under Advanced. Save the new configuration.
Bring up the VPN connection again.  Should work.  Right?
I did not for me.  The error complains about the L2TP-VPN-server not responding.
Digging deeper using the system logger I found the error
2014-02-14 14:43:31,039 racoon[60284]: IKE Packet: receive failed. (Malformed or unexpected cookie).
2014-02-14 14:43:31,039 racoon[60284]: Malformed cookie received or the initiator's cookies collide.
2014-02-14 14:43:31,172 pppd[60283]: IPSec connection failed
2014-02-14 14:43:31,172 racoon[60284]: vpn_control socket closed by peer.
2014-02-14 14:43:31,173 racoon[60284]: received disconnect all command
So it sort of works, but complains about some bad cookie.
The simple change of the IP-address apparentely generates this error.
Now change the network of the client so that it is not on the same networks as the server.
Bring up the VPN again.  Now it just works.
So apparently, when the traffic is coming in from the outside the VPN connection just works.
If you change back to the local network of the server and the keep the router IP-address the error is back.
Conclusion
The conclusion is that the client used for connecting to the VPN network must be on an outside network.
In retrospect, this makes sense since we should test using an environment that reproduces the actual use case. The crux is to ensure that the client traffic is coming in from the outside.
Hope this helps.