Shorewall & Windows VPN

Hi Experts,

I've setup Remote Windows 2003 VPN Server and my gateway (shorewall NAT/firewalled) is linux box. The problem is my internal LAN cannot initiate VPN connections to Win2003 VPN Server. I can dial but when I reached verifying username and password it stops, I think there are ports to be open in my firewall. Experts your answers are all welcome.

WinXP VPN Client  --> Linux BOX (shorewall NAT/firewalled) --> Win2003VPNServer


Thank you.
marvelsoftAsked:
Who is Participating?
 
BlazConnect With a Mentor Commented:
Clicked submit too soon...

#ACTION  SOURCE                         DEST                         PROTO
ACCEPT   loc                                  MS_VPN_firewall_IP    47
ACCEPT   MS_VPN_firewall_IP         loc                             47


MS_VPN_firewall_IP is the IP of the firewall you are connecting to.
0
 
BlazCommented:
For Microsoft VPN you need to open two things:
- tcp traffic to port 1723
- protocol 47 traffic

So in iptables the rules would be (the third should be already covered by ESTABLISHED):

-A FORWARD -d MS_VPN_firewall -p tcp --dport 1723 -j ACCEPT
-A FORWARD -d MS_VPN_firewall -p 47 -j ACCEPT
-A FORWARD -s MS_VPN_firewall -p tcp --sport 1723 -j ACCEPT
-A FORWARD -s MS_VPN_firewall -p 47 -j ACCEPT


My guess is you are letting through the tcp stuff (authentication, control) but are blocking the protocol 47 (data).
0
 
marvelsoftAuthor Commented:
HI Blaz,

I'm using shorewall firewall, what is the equivalent code of this in shorewall firewall?

0
 
marvelsoftAuthor Commented:
What is in MS_VPN_firewall?
0
 
BlazCommented:
I don't know exactly. Like I said you must allow protocol 47 through.

This might be set in rules configuration file:
#ACTION  SOURCE   DEST               PROTO
ACCEPT   net      MS_VPN_firewall 47
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.