diff --git a/libreswan.spec b/libreswan.spec
index d5245d9..01ba6ee 100644
--- a/libreswan.spec
+++ b/libreswan.spec
@@ -37,7 +37,7 @@ Name: libreswan
 Summary: IKE implementation for IPsec with IKEv1 and IKEv2 support
 # version is generated in the release script
 Version: 4.1
-Release: %{?prever:0.}2%{?prever:.%{prever}}%{?dist}
+Release: %{?prever:0.}3%{?prever:.%{prever}}%{?dist}
 License: GPLv2
 Url: https://libreswan.org/
 Source0: https://download.libreswan.org/%{?prever:with_development/}%{name}-%{version}%{?prever}.tar.gz
@@ -109,6 +109,8 @@ sed -i "s/-lfreebl //" mk/config.mk
 # enable crypto-policies support
 sed -i "s:#[ ]*include \(.*\)\(/crypto-policies/back-ends/libreswan.config\)$:include \1\2:" configs/ipsec.conf.in
 
+# Restore -DALLOW_MICROSOFT_BAD_PROPOSAL for L2TP/IPsec
+sed -i "s/-pthread$/-DALLOW_MICROSOFT_BAD_PROPOSAL -pthread/" mk/config.mk
 
 %build
 # link flags disable hardening because it fails on arm with what looks like gcc bugs in -Werror=lto-type-mismatch
@@ -205,6 +207,9 @@ certutil -N -d sql:$tmpdir --empty-password
 %attr(0644,root,root) %doc %{_mandir}/*/*
 
 %changelog
+* Mon Nov 23 11:50:41 EST 2020 Paul Wouters <pwouters@redhat.com> - 4.1-3
+- Resolves: rhbz#1894381 Libreswan 4.1-2 breaks l2tp connection to Windows VPN server
+
 * Mon Oct 26 10:21:57 EDT 2020 Paul Wouters <pwouters@redhat.com> - 4.1-2
 - Resolves: rhbz#1889538 libreswan's /var/lib/ipsec/nss missing