We help IT Professionals succeed at work.

Check out our new AWS podcast with Certified Expert, Phil Phillips! Listen to "How to Execute a Seamless AWS Migration" on EE or on your favorite podcast platform. Listen Now

x

Windows 2003 VPN through Netopia router & Firebox 1000

chawness
chawness asked
on
Medium Priority
422 Views
Last Modified: 2012-05-07
I am trying to setup a VPN for my users to connect to the office as they are doing more and more out of town work. I'm using the built in VPN stuff on my 2003 server and did the custom config during the routing and remote access setup because I'm using only 1 NIC. The Netopia router is a pass through to the Firebox III 1000. The Firebox is successfully forwarding (NATing) the PPTP request to my VPN server. I installed Wireshark (sniffer) on the VPN server and I can see the PPTP request being acknowledged by the server, but the connection is not made. The client errors out with 721.

I cant figure out what I'm missing...

Comment
Watch Question

CERTIFIED EXPERT
Top Expert 2007

Commented:
Are you using custom service or pre-defined PPTP service; please note other than TCP port 1723 we also need to allow IP protocol number 47 [GRE] [which is included in the predefined service].

If you are using PPTP predefined service with 1-1 NAT then things should work. Enable logging for the service and if you see allowed packets in system manager->Traffic monitor then the firewall is configured properly.

Can you check if you can make VPN tunnel to the server from the inside network; this would ensure that the server itself is accepting connections and the settings are correct.

Please check and update.

Thank you.

Author

Commented:
I have both the custom and pre defined services (PPTP and wg_PPTP). I can see in the traffic monitor that both are allowing the connection through. Isn't IP 47 allowed through with the PPTP service?

Even tried adding the any service opening a hole to the VPN server and it still did not work.

I can make a tunnel from inside the network.
CERTIFIED EXPERT
Top Expert 2007

Commented:
As you using 1-1 NAT, please make sure that you have added NAT exceptions; also, that you do not have the IP used for 1-1 NAT in the external alias.

From the server if you access website, http://www.whatismyip.com you should be able to see the 1-1 NAT IP and not the external IP of firewall.

If above are correct then this should work.

Please check and update.

Thank you.

Author

Commented:
Couple of questions. Where do I add NAT exceptions?

When you say external alias do you mean under network, configuration, interfaces tab - aliases?

whatismyip.com shows the external IP of the firewall.
CERTIFIED EXPERT
Top Expert 2007

Commented:
In Policy Manager, go to Setup->NAT->Advanced->1-1 NAT Setup [here you would have an entry like:
external, 1, x.x.x.x, y.y.y.y]; now click Dynamic NAT Exceptions tabl click Add; in the From type the internal IP of the server; in the To box from drop down select "external" keyword. Click Ok all the way back.

For alias, go to Network->Configuration->Interfaces->click Aliases, here ensure the public IP is not listed; if listed; please remove it, the firebox would reboot after you saved changes.

From the server you should not see 1-1 NAT IP.

The things should work now.

Thank you.

Author

Commented:
I made the changes you suggested. Now I can see the 1-1 NAT IP from the server. However I still cant make the connection from outside. Using Wireshark I can see the communication begin on the server when I try to connect from the outside. The server will send a PPTP ACK command to the client, then the client will send a call-clear-request?

Just FYI - The computer I am trying to connect with is a VISTA machine with a Sprint air card. I have also tried with a XP Pro machine and the air card, both produce the same results.
CERTIFIED EXPERT
Top Expert 2007

Commented:
Hmm if the traffic is going through fine then the firewall settings are correct; this brings us to the point that the problem is either with client or the server itself.
As you can establish the tunnel internally without problem this seems that the server settings are also correct.

As you have already tried two different machines this means that the machine is not the problem here.

Have you tried connecting from a different ISP. may be this ISP is blocking the PTPP traffic and causing the problem.

Please check and update.

Thank you.

Author

Commented:
OK I just called home and talked my 12 year old daughter through setting up a new VPN connection on our XP Pro machine. Its using a DSL connection.  When trying to connect she received error 721.

I noticed in Wireshark after the server sends the pptp ACK message, then it starts communicating with the DC via the TCP protocol. After the 2 servers are through communicating, the client sends a call-clear-request. The connection errors out just afterward...
CERTIFIED EXPERT
Top Expert 2007
Commented:
Unlock this solution with a free trial preview.
(No credit card required)
Get Preview

Author

Commented:
My friend I have but one word for you.... SUCCESS!!!!!!!!!!!!!!!!!!!

The Netopia was the culprit. I basically had to do everything you said plus the following in the Netopia:

Main Menu
System Configuration...
 Filter Sets...
 IP filter sets...

display change IP filter set

basic firewall

add input filter to filter set

source IP 0.0.0.0  Dest IP 0.0.0.0 Protocol ANY On=yes Forward=yes

And yes I fell out of my chair when it worked...

FYI for anyone reading this: Netopia R5300 T1 Router, Watchguard Firebox III 1000, Windows Server 2003 VPN.
CERTIFIED EXPERT
Top Expert 2007

Commented:
Thank you for the update and the points! :)
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a free trial preview!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.