Android IKEv2(MSCHAPv2)连接失败：日志返回“No vpn interface”

我正按照官方文档实现Android平台的IKEv2 VPN连接，采用MSCHAPv2认证方式，但运行以下代码时始终返回日志“No vpn interface”，无法成功建立VPN连接。

原代码： #

package com.mehrab.examplevpn;

import android.app.PendingIntent;
import android.content.Intent;
import android.net.VpnService;
import android.net.ipsec.ike.SaProposal;
import android.net.Ikev2VpnProfile;
import android.os.ParcelFileDescriptor;
import android.util.Log;
import android.widget.Toast;

import java.net.InetSocketAddress;
import java.nio.channels.DatagramChannel;

public class MyVpnService extends VpnService {
    private static final String VPN_SERVER_IP = "example.info";
    private static final String VPN_USERNAME = "example@gmail.com";
    private static final String VPN_PASSWORD = "secret";
    private static final String VPN_ROUTE = "0.0.0.0"; // Default route

    private ParcelFileDescriptor vpnInterface;

    @Override
    public int onStartCommand(Intent intent, int flags, int startId) {
        Toast.makeText(getApplicationContext(), "NonConn!", Toast.LENGTH_SHORT).show();
        Thread thread = new Thread(new Runnable() {
            @Override
            public void run() {
                try {
                    vpnInterface = establishVPN();
                    if (vpnInterface != null) {
                        // Connect to VPN server
                        InetSocketAddress serverAddress = new InetSocketAddress(VPN_SERVER_IP, 5000);
                        DatagramChannel tunnel = DatagramChannel.open();
                        tunnel.connect(serverAddress);
                        Log.d("mytag", "Connected");

                        // Close resources when done
                        tunnel.close();
                    } else {
                        Log.d("mytag", "No vpn interface");
                    }
                } catch (Exception e) {
                    Log.d("mytag", "Try Catch Error");
                    e.printStackTrace();
                }
            }
        });
        thread.start();
        return START_STICKY;
    }

    private ParcelFileDescriptor establishVPN() throws Exception {
        String identity = "yourIdentity";
        if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.R) {
            Ikev2VpnProfile profile = new Ikev2VpnProfile.Builder(VPN_SERVER_IP, identity)
                    .setAuthUsernamePassword(VPN_USERNAME, VPN_PASSWORD, null) // Replace null with the root CA if available
                    .setBypassable(false)
                    .setMaxMtu(1400)
                    .setMetered(false)
                    .build();
        }

        VpnService.Builder vpnBuilder = new VpnService.Builder();
        vpnBuilder.setSession("MyIKEv2VPN")
                .addAddress("192.168.0.2", 32) // Virtual IP address
                .addRoute(VPN_ROUTE, 0) // Default route
                .setConfigureIntent(PendingIntent.getActivity(this, 0, new Intent(this, MainActivity.class), PendingIntent.FLAG_IMMUTABLE));

        // Configure the VPN interface using the IKEv2 profile
        vpnInterface = vpnBuilder.establish();

        return vpnInterface;
    }

    @Override
    public void onDestroy() {
        super.onDestroy();
        try {
            if (vpnInterface != null) {
                vpnInterface.close();
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

问题分析与修复方案： #

1. IKEv2配置未关联到VpnService构建器

代码中创建了Ikev2VpnProfile但没有将其绑定到VpnService.Builder，导致系统无法应用IKEv2的认证和服务器配置。Android 11+（API 30）需要调用setIkev2VpnProfile方法将配置传入构建器。

2. 缺少用户授权检查

使用VpnService前必须先调用prepare方法获取用户授权，否则establish会直接返回null。

3. 虚拟IP地址不匹配

硬编码的192.168.0.2必须是VPN服务器分配给客户端的有效虚拟IP，否则会导致接口创建失败，建议由服务器动态分配或确认服务器端配置。

4. CA证书缺失（若服务器使用自签名证书）

setAuthUsernamePassword的第三个参数是服务器CA证书，若服务器使用自签名证书，必须传入对应的证书文件，否则SSL验证失败，无法建立连接。

修正后的代码： #

package com.mehrab.examplevpn;

import android.app.PendingIntent;
import android.content.Intent;
import android.net.VpnService;
import android.net.Ikev2VpnProfile;
import android.os.ParcelFileDescriptor;
import android.util.Log;
import android.widget.Toast;

import java.io.InputStream;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.net.InetSocketAddress;
import java.nio.channels.DatagramChannel;

public class MyVpnService extends VpnService {
    private static final String VPN_SERVER_IP = "example.info";
    private static final String VPN_USERNAME = "example@gmail.com";
    private static final String VPN_PASSWORD = "secret";
    private static final String VPN_ROUTE = "0.0.0.0"; // Default route

    private ParcelFileDescriptor vpnInterface;

    @Override
    public int onStartCommand(Intent intent, int flags, int startId) {
        // 先检查用户授权
        Intent prepareIntent = prepare(this);
        if (prepareIntent != null) {
            // 跳转到授权页面
            startActivity(prepareIntent);
            return START_STICKY;
        }

        Toast.makeText(getApplicationContext(), "开始连接VPN...", Toast.LENGTH_SHORT).show();
        new Thread(() -> {
            try {
                vpnInterface = establishVPN();
                if (vpnInterface != null) {
                    Log.d("mytag", "VPN接口创建成功");
                    // IKEv2会自动处理隧道连接，无需手动创建DatagramChannel
                    // 保持服务运行即可
                } else {
                    Log.d("mytag", "No vpn interface");
                }
            } catch (Exception e) {
                Log.d("mytag", "连接出错");
                e.printStackTrace();
            }
        }).start();
        return START_STICKY;
    }

    private ParcelFileDescriptor establishVPN() throws Exception {
        String identity = "yourIdentity";
        VpnService.Builder vpnBuilder = new VpnService.Builder();
        
        if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.R) {
            // 加载CA证书（假设证书放在res/raw/ca_cert.pem）
            X509Certificate caCert = null;
            try (InputStream is = getResources().openRawResource(R.raw.ca_cert)) {
                CertificateFactory cf = CertificateFactory.getInstance("X.509");
                caCert = (X509Certificate) cf.generateCertificate(is);
            }
            
            Ikev2VpnProfile profile = new Ikev2VpnProfile.Builder(VPN_SERVER_IP, identity)
                    .setAuthUsernamePassword(VPN_USERNAME, VPN_PASSWORD, caCert)
                    .setBypassable(false)
                    .setMaxMtu(1400)
                    .setMetered(false)
                    .build();
            
            // 将IKEv2配置绑定到构建器
            vpnBuilder.setIkev2VpnProfile(profile);
        }

        vpnBuilder.setSession("MyIKEv2VPN")
                .addAddress("192.168.0.2", 32) // 确保此IP是服务器分配的有效虚拟IP
                .addRoute(VPN_ROUTE, 0)
                .setConfigureIntent(PendingIntent.getActivity(this, 0, new Intent(this, MainActivity.class), PendingIntent.FLAG_IMMUTABLE));

        return vpnBuilder.establish();
    }

    @Override
    public void onDestroy() {
        super.onDestroy();
        try {
            if (vpnInterface != null) {
                vpnInterface.close();
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

额外注意事项： #

• 确保在AndroidManifest.xml中声明VpnService权限：

<uses-permission android:name="android.permission.BIND_VPN_SERVICE" />
<service android:name=".MyVpnService"
         android:permission="android.permission.BIND_VPN_SERVICE">
    <intent-filter>
        <action android:name="android.net.VpnService" />
    </intent-filter>
</service>

• 若服务器使用标准IKEv2端口（500/4500），无需手动指定端口，系统会自动处理。
• 虚拟IP和路由配置需与VPN服务器端保持一致，否则会导致网络无法正常转发。

内容的提问来源于stack exchange，提问作者Konky