SBS 2011 VPN connectivity problem

Winfix1
Winfix1 used Ask the Experts™
on
Hi

Have just setup SBS 2011 and enabled the VPN functionality.

Here is my setup. The server currently sits behind a firewall (Vigor 2830) on my LAN. My LAN ip's 192.168.1.x with the interface to the firewall at 192.168.1.87. The SBS 2011 sits behind the firewall at 192.168.12.4 with its gateway being the firewall at 192.168.12.3. The SBS connects to the internet fine, RWW works fine etc, exchange works fine. Port 1723 is open on the firewall.

The VPN however will not connect. If I create a new VPN connection from my PC pointing at 192.168.1.87 with a username and password of a user on the SBS 2011, I get verifying username and password then Connecting to 192.168.1.87 using WAN Miniport SSTP, then its asks to Reenter the username and password again saying the orginal was not correct... but it was I have used several usernames and password and reset them... they are definitely correct. The users are enabled for VPN connection too. The SBS DHCP seems to be issuing an address as well.

How can I troubleshoot this? I Cant find any sensible logs? Is this because my PC is on 192.168.1.x subnet the same as the untrusted interface to the firewall?

Thanks
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Expert 2013

Commented:
You have a dual NAT situation where you have:
Internet <=> device <=> subnet 192.168.1.x <=> device <=> subnet 192.168.12.x
The VPN will not work in this way. The device closest to the Internet will need to be put in Bridge mode, effectivly  disabling its NAT feature and allowing the inter device to have a public IP.

Your exact hard war config is not clear to  mea s to what the two deevices are but usualy the outer is a combined modem/router , which needs to be bridged..

SBS must have only 1 NIC enabled as well.

Author

Commented:
Thanks

Now I have connected the SBS 2011 server directly to the internet (through a  firewall of course, Vigor 2830) so there is only one firewall/router. I then checked from a remote site that I could connect to RWW, Exchange etc. All is fine. Still when I create a VPN I get exactly the same problem as above.

The server does have 2 NICs but one is disabled and ports 1723 etc are open.

Any more ideas?
Top Expert 2013
Commented:
How did you configure the VPN?  Using the wizard under sbs console | network | connectivity?  If not this is how it should be done.

Is the user account a domain admin or a member of the "Windows SBS VPN users" group?

Can you connect to the VPN from the LAN using the LAN IP of the SBS?  If so the VPN is properly configured and it is a routing issue.

When the connection fails from the internet (must be tested from off-site) what error code do you eventually get 800, 691, 721?
Sounds like GRE is blocked.  Not sure on the Vigor how you enable, but it is not done by configuring port 47.  Is there an option to forward a service (PPTP) to the sbs rather than port 1723?
How to Generate Services Revenue the Easiest Way

This Tuesday! Learn key insights about modern cyber protection services & gain practical strategies to skyrocket business:

- What it takes to build a cloud service portfolio
- How to determine which services will help your unique business grow
- Various use-cases and examples

Author

Commented:
Thanks RobWill

I didnt think to try to setup a VPN connection on the server itself to itself. This worked fine.

Your comment about GRE being blocked led me to check whether the Vigor 2830 allows VPN passthrough... in default mode it does not! So I followed the instructions on http://www.draytek.co.uk/support/kb_vigor_passthrough.html and just unticked the Enable PPTP VPN Service. Saved the settings on the firewall and it all works fine.

Thanks again.

Author

Commented:
Excellent thanks RobWill.
Top Expert 2013

Commented:
Great, glad to hear.  Thanks Winfix1
Cheers!
--Rob

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial