Creating a PPTP Tunnel with two routers on network.

Joe
Joe used Ask the Experts™
on
I would like to create a PPTP tunnel to my computer at home.  However, at home I have Verizon FIOS.  They provide a router/firewall with IP address of 192.168.1.1.  While still using the one Verizon provided, I also have a Cisco WRVS4400N VPN router/firewall that I put behind the Verizon router.  To get this to work, I just assigned the Cisco router an IP address of 192.168.5.1 and have all my PC's assigned an IP of 192.168.5.2-100.  

I now want to create PPTP from my work computer to my computer at home.  I enabled port forwarding from the verizon router to the cisco router, and from the cisco router, I am doing port forwarding to my home PC, but am still not able to create the PPTP connection.  I receive error 720 from my work computer.  

If I remove the Cisco router and leave the verizon router, as well as change all the port forwarding to go just from the verizon router to the home PC, I can connect.  

Any ideas on how to get this to work with the cisco router in place?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
"Batchelor", Developer and EE Topic Advisor
Top Expert 2015
Commented:
Double-NAT is a PITA in conjunction with PPTP and the GRE protocoll - it is just not working in many cases.
VPNs in general work best if the "edge device" (managing the Internet connection) terminates them (acts as server). With another device behind the edge device everything gets more complex and more likely to fail. And adding another level of NAT/port forwarding will reduce your chances to get a working connection to some very low figure.

Alternatives:
Your Cisco is able to act as VPN gateway for QuickVPN, which uses L2TP/IPsec. That will work more reliable, and you can implement L2TP/IPsec conection based on a pre-shared key without using QuickVPN.
Try to put the Verizon into Bridge/Routing Mode, not performing any NAT. The Cisco should then perform any necessary NAT.
Use an IPSec VPN client, like the free ShrewSoft VPN client (www.shrew.net), to connect to the Cisco. Again, this is more reliable than PPTP (but still not guaranted to work flawlessly in your environment).
JoeTechnology

Author

Commented:
Ok...If i go with the alternative of "Try to put the Verizon into Bridge/Routing Mode, not performing any NAT. The Cisco should then perform any necessary NAT."  How do I do this?  I am weak in the networking area, so keep that in mind when explaining this.
L2TP with IPSec as Qlemo suggests above is, IMO, the best option for this type of VPN, pptp is hard to secure and very contrary. No answer here, just backing above recommendation.
Acronis in Gartner 2019 MQ for datacenter backup

It is an honor to be featured in Gartner 2019 Magic Quadrant for Datacenter Backup and Recovery Solutions. Gartner’s MQ sets a high standard and earning a place on their grid is a great affirmation that Acronis is delivering on our mission to protect all data, apps, and systems.

Qlemo"Batchelor", Developer and EE Topic Advisor
Top Expert 2015

Commented:
Bridging or Routing Mode is usually set up by just switching a setting in the router usually. But don't ask for details ;-). Your ISP should be able to provide you with the necessary procedure.
JoeTechnology

Author

Commented:
Would that be a Static NAT feature?
Qlemo"Batchelor", Developer and EE Topic Advisor
Top Expert 2015

Commented:
No, no NAT. The Verizon just relays the packets received on each side to the other one, not changing anything but the next router IP. So all traffic from the Web would be transferred to the Cisco with its public IP, and the Cisco then does the NAT and port forwarding to your local network.

Commented:
so you have two routers thats not going to work
Top Expert 2011

Commented:
Which Verizon supplied router do you have?   What model?  9100EM?
JoeTechnology

Author

Commented:
I have the Actiontec MI424WR
Top Expert 2011
Commented:
Basically, you want to change your Actiontec wireless router into an Actiontec switch.  This means you want to disable the DHCP server function of the Actiontec so it doesn't "act" like a router and performs no NAT (Network Address Translation) functions.  The idea is to let your Cisco do all the "routing" and NATing.

I personally don't see any advantage to changing your Actiontec into a switch unless you were going to have more than one router attached to it.

Settings are also going to depend on whether its coax or ethernet connected.

I've attached the users manual for your router.  In the WAN settings, leave what is working now.  Its the LAN side of settings you don't want any NAT happening.

Chapter 5 on page 41 (page 45 in your PDF reader) is entitled "Using Network Connections".  You should start reading here.  By PDF page 47, the page is entitled "Bridge".  Hopefully by reading through this and with the information previously posted here, you will be able to do what you want to do.

Too bad it wasn't the 9100EM,  I found that manual was much more straight forward in explaining what you needed to do to get your desired results.

 ActiontecMI1424WRUserManual.pdf
Qlemo"Batchelor", Developer and EE Topic Advisor
Top Expert 2015

Commented:
Since the accepted answer is based on my first comment, I would expect the latter to be an assist, with a share of maybe 100 points out of 500. Any reason why you did not?
JoeTechnology

Author

Commented:
You are right and I apologize.  I submitted a request to the moderator on splitting the points.  
JoeTechnology

Author

Commented:
Since Qlemo first suggested the solution that did work, I am awarding him with most of the points.  However, Jim-R did go into further detail on the solution that worked for me and awarded him with the remainder of the points.
Qlemo"Batchelor", Developer and EE Topic Advisor
Top Expert 2015

Commented:
Thank you, though I wanted to suggested it the other way round ... Let's leave it at that.
Top Expert 2011

Commented:
Qlemo:

I appreciate that you see it that way and have the courtesy to acknowledge it.  In other cases here, I have not been so fortunate, but lets leave it at that.

JoeTechnology

Author

Commented:
I did not mean to insult anyone...I hope you see that I was trying to be fair.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial