?
Solved

problem with routing/NAT in a LAN-LAN PPTP setup in Windows Server 2003

Posted on 2010-01-11
10
Medium Priority
?
417 Views
Last Modified: 2012-05-08
I am trying to make a setup for LAN-to-LAN over PPTP.  My pptp client is on Windows Server 2003, and connects to the remote network through a PIX515.  Connections to the remote network are fine, and I am able to connect to multiple machines on the remote network from the client just fine.

For other machines on the LAN, they are able to get TO the client machine, but no further.  The traceroute shows it getting to the client, and then nothing.  At first I was thinking that this was a routing issue, but after running WireShark on the pptp client, I can see packets coming into it and trying to get to the remote systems, but then no response.  So now I am thinking that the problem is related to translation, since the remote system would have no way of knowing how to get packets back to the originating machines.

I have Routing and Remote Access setup, and it connects to the pptp system via this (rather than manually selecting a new network connection).
0
Comment
Question by:Darkpaw
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
10 Comments
 
LVL 39

Expert Comment

by:ChiefIT
ID: 26290927
What types of packets are  you having problems with.

Are they netbios packets? If so, those stop at the router because they are held to the broadcast domain.

Any broadcast packet will be stopped at the router.
0
 

Author Comment

by:Darkpaw
ID: 26291967
It's not broadcast, it's all tcp traffic.  For example, telnet.  I need machines on the LAN to be able to telnet through the PPTP client onto the remote network.  SSH/SSL, as well.
0
 
LVL 70

Accepted Solution

by:
Qlemo earned 2000 total points
ID: 26292432
You need to define NAT on the dial-in interface in RRAS. That will substitute the PPTP Client IP  and a random port as source address.

In RRAS console, go to IP Routing => NAT / Firewall => New => Public Interface, NAT.

That will not allow communication initiated by the remote site, as there will be no corresponding NAT entry. As far as I understood you did not want to allow for such traffic.
0
Veeam Disaster Recovery in Microsoft Azure

Veeam PN for Microsoft Azure is a FREE solution designed to simplify and automate the setup of a DR site in Microsoft Azure using lightweight software-defined networking. It reduces the complexity of VPN deployments and is designed for businesses of ALL sizes.

 

Author Comment

by:Darkpaw
ID: 26292474
There is no option for NAT/Firewall under IP Routing.  The only shown settings are General and Static Routes.  Right-clicking on it only allows me to change view and export list.
0
 
LVL 70

Expert Comment

by:Qlemo
ID: 26292543
Strange. You should have General, Static Routes, DHCP Relay, IGMP and NAT/Firewall there.

Please check settings of the RRAS service by opening the Property Page of the server entry in RRAS console.
In General tab, it should be set up as Router, LAN and Demand-Dial Routing.
In IP tab, the two topmost check marks should be checked.
You might have to restart RRAS after changes.
0
 

Author Comment

by:Darkpaw
ID: 26292626
Strange.  They are all already set as that.  Should I also enable to act as a remote access server (in the General tab)?
0
 
LVL 70

Expert Comment

by:Qlemo
ID: 26292723
No need to enable "RAS Server", it's for incoming connections only.
I assume you do not use that RRAS as Internet router (with ICS).
Try to add a Routing Protocol (IP Routing => General => (Ctxt Menu) New Routing Protocol). Is IGMP and NAT listed there? If so, you need to add NAT.
0
 

Author Comment

by:Darkpaw
ID: 26292853
OK, that allowed me to add it.  The connection to the LAN side is on "Local Area Connection".  I added this interface to NAT setting, with Private Interface on a Private Network, and no filters added (it appears to default to allow all).  

The stats for it (inbound/outbound packets, etc) all show 0, with no translations.  Traceroute from the other machine on the LAN that I'm using for testing still stops at the PPTP client and hangs.  I tried adding a mapping to a single static IP in the range of the remote machine, and added a static route.  Still nothing.  I think I'm getting closer, but am definitely stuck at the point of getting the inbound packets translated to something that would be usable to the remote network (or if it's not translating at all).
0
 
LVL 70

Assisted Solution

by:Qlemo
Qlemo earned 2000 total points
ID: 26292918
LAN on private/private is correct.
You need to add the Dial-Out interface used as public / NAT / no firewall,
and create a static route for that interface (no gateway, it is put in automatically while connected).
0
 

Author Comment

by:Darkpaw
ID: 26293602
That works perfectly now.

Thanks a lot.
0

Featured Post

Plug and play, no additional software required!

The ATEN UE3310 USB3.1 Gen1 Extender Cable allows users to extend the distance between the computer and USB devices up to 10 m (33 ft). The UE3310 is a high-quality, cost-effective solution for professional environments such as hospitals, factories and business facilities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Juniper VPN devices are a popular alternative to using Cisco products. Last year I needed to set up an international site-to-site VPN over the Internet, but the client had high security requirements -- FIPS 140. What and Why of FIPS 140 Federa…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

801 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question