Windows 2003 VPN through Netopia router & Firebox 1000

I am trying to setup a VPN for my users to connect to the office as they are doing more and more out of town work. I'm using the built in VPN stuff on my 2003 server and did the custom config during the routing and remote access setup because I'm using only 1 NIC. The Netopia router is a pass through to the Firebox III 1000. The Firebox is successfully forwarding (NATing) the PPTP request to my VPN server. I installed Wireshark (sniffer) on the VPN server and I can see the PPTP request being acknowledged by the server, but the connection is not made. The client errors out with 721.

I cant figure out what I'm missing...

LVL 1
chawnessAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

dpk_walCommented:
Are you using custom service or pre-defined PPTP service; please note other than TCP port 1723 we also need to allow IP protocol number 47 [GRE] [which is included in the predefined service].

If you are using PPTP predefined service with 1-1 NAT then things should work. Enable logging for the service and if you see allowed packets in system manager->Traffic monitor then the firewall is configured properly.

Can you check if you can make VPN tunnel to the server from the inside network; this would ensure that the server itself is accepting connections and the settings are correct.

Please check and update.

Thank you.
0
chawnessAuthor Commented:
I have both the custom and pre defined services (PPTP and wg_PPTP). I can see in the traffic monitor that both are allowing the connection through. Isn't IP 47 allowed through with the PPTP service?

Even tried adding the any service opening a hole to the VPN server and it still did not work.

I can make a tunnel from inside the network.
0
dpk_walCommented:
As you using 1-1 NAT, please make sure that you have added NAT exceptions; also, that you do not have the IP used for 1-1 NAT in the external alias.

From the server if you access website, http://www.whatismyip.com you should be able to see the 1-1 NAT IP and not the external IP of firewall.

If above are correct then this should work.

Please check and update.

Thank you.
0
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

chawnessAuthor Commented:
Couple of questions. Where do I add NAT exceptions?

When you say external alias do you mean under network, configuration, interfaces tab - aliases?

whatismyip.com shows the external IP of the firewall.
0
dpk_walCommented:
In Policy Manager, go to Setup->NAT->Advanced->1-1 NAT Setup [here you would have an entry like:
external, 1, x.x.x.x, y.y.y.y]; now click Dynamic NAT Exceptions tabl click Add; in the From type the internal IP of the server; in the To box from drop down select "external" keyword. Click Ok all the way back.

For alias, go to Network->Configuration->Interfaces->click Aliases, here ensure the public IP is not listed; if listed; please remove it, the firebox would reboot after you saved changes.

From the server you should not see 1-1 NAT IP.

The things should work now.

Thank you.
0
chawnessAuthor Commented:
I made the changes you suggested. Now I can see the 1-1 NAT IP from the server. However I still cant make the connection from outside. Using Wireshark I can see the communication begin on the server when I try to connect from the outside. The server will send a PPTP ACK command to the client, then the client will send a call-clear-request?

Just FYI - The computer I am trying to connect with is a VISTA machine with a Sprint air card. I have also tried with a XP Pro machine and the air card, both produce the same results.
0
dpk_walCommented:
Hmm if the traffic is going through fine then the firewall settings are correct; this brings us to the point that the problem is either with client or the server itself.
As you can establish the tunnel internally without problem this seems that the server settings are also correct.

As you have already tried two different machines this means that the machine is not the problem here.

Have you tried connecting from a different ISP. may be this ISP is blocking the PTPP traffic and causing the problem.

Please check and update.

Thank you.
0
chawnessAuthor Commented:
OK I just called home and talked my 12 year old daughter through setting up a new VPN connection on our XP Pro machine. Its using a DSL connection.  When trying to connect she received error 721.

I noticed in Wireshark after the server sends the pptp ACK message, then it starts communicating with the DC via the TCP protocol. After the 2 servers are through communicating, the client sends a call-clear-request. The connection errors out just afterward...
0
dpk_walCommented:
Sorry but as this is more to do with VPN server configuration/settings and not the firewall; I would not be best of help here.

May be some other expert would be able to assist you further with.

One more thing before I let go; can you check if the Netopia is blocking anything [if possible; put the server directly behind Netopia bypassing the WG, this would make few things clear].

Thank you.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
chawnessAuthor Commented:
My friend I have but one word for you.... SUCCESS!!!!!!!!!!!!!!!!!!!

The Netopia was the culprit. I basically had to do everything you said plus the following in the Netopia:

Main Menu
System Configuration...
 Filter Sets...
 IP filter sets...

display change IP filter set

basic firewall

add input filter to filter set

source IP 0.0.0.0  Dest IP 0.0.0.0 Protocol ANY On=yes Forward=yes

And yes I fell out of my chair when it worked...

FYI for anyone reading this: Netopia R5300 T1 Router, Watchguard Firebox III 1000, Windows Server 2003 VPN.
0
dpk_walCommented:
Thank you for the update and the points! :)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
VPN

From novice to tech pro — start learning today.