Solved

Comcast SMC Modem blocking PPTP

Posted on 2008-06-19
7
7,118 Views
Last Modified: 2013-12-14
Hi,

We have a Comcast Business SMC Networks modem hardware version 1B and are having problems getting PPTP to pass through.  I have called Comcast and they say it should work.  The only options for port forwarding on this modem are for TCP and UDP.  We need the GRE packet forwarded to enable PPTP to reach the server.  If we enable DMZ to the server, we can VPN to the server.  However, this opens up all ports.  We have called in and asked if they can enable PPTP passthrough on their end and they say they cannot.  Is there a way to forward the GRE packet on this modem without using DMZ?  
0
Comment
Question by:OAC Technology
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
7 Comments
 
LVL 44

Expert Comment

by:Darr247
ID: 21831413
According to http://www.iana.org/assignments/port-numbers PPTP should use TCP or UDP port 1723.
Did you try forwarding port 1723 on both TCP and UDP?
0
 
LVL 2

Author Comment

by:OAC Technology
ID: 21833103
yes, it is already forwarded.
0
 
LVL 44

Expert Comment

by:Darr247
ID: 21834943
Does the comcast unit have port triggering, too?
0
Is your NGFW recommended by NSS Labs?

Ours is! NSS Labs Next Generation Firewall Test gives the WatchGuard Firebox M4600 a "Recommended" rating! Curious where your NGFW landed on the  Security Value Map? See the map and download the full report today!

 
LVL 2

Author Comment

by:OAC Technology
ID: 21838337
yes
0
 
LVL 44

Accepted Solution

by:
Darr247 earned 500 total points
ID: 21839452
With 1723 TCP/UDP entered in the port triggering can you initiate the connection going in the other direction?

Here is the technical description of PPTP connections:
http://www.ietf.org/rfc/rfc2637.txt?number=2637
Rather dry reading, though.

You don't mention what OS either end is using, but if they're microsoft, here are some troubleshooting tips:
http://support.microsoft.com/kb/241251
http://support.microsoft.com/kb/241252
http://support.microsoft.com/kb/164601

I also saw a couple articles that described a problem that occurs when both ends are using subnets that can appear in the subnets of the other end too (e.g. 10.10.10.0/24 and 10.10.0.0/18) ... but your description doesn't mention the other end employing a private subnet from behind a router.

Do you have another router to try forwarding port 1723 on so you can ask comcast to replace the SMC unit if that works?
Do you have to manually apply firmware updates to the SMC or are they pushed out automatically by comcast during low-traffic periods?
0
 

Expert Comment

by:SublimeComputerServices
ID: 34992959
This is an old post but Comcast has added the GRE protocol in the port forwarding tab of the firewall.

You have to create two rules:

You still have to have port 1723 forwarded to your server.  Then you add the GRE protocol to forward to your server as well.
0
 
LVL 44

Expert Comment

by:Darr247
ID: 36536051
Another update...
The Internet Assigned Numbers Authority (IANA) has changed the link to their list of well-known/assigned ports...

here are the new URLs:

XML version - http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml
Text version - http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt
0

Featured Post

How our DevOps Teams Maximize Uptime

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us. Read the use case whitepaper.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Sometimes you have to pull out old tricks to get a new firewall to work… While we were installing a new Sonicwall at a customers site we found that sites they were able to visit before were not working.  It seemed random and we could not understa…
There are two basic ways to configure a static route for Cisco IOS devices. I've written this article to highlight a case study comparing the configuration of a static route using the next-hop IP and the configuration of a static route using an outg…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question