This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

NAT pptp and Win2k vpn server

I'm having some strange thigs going here . I have a Win2k box in the local network with a vpn server (RAS) . On ASL 4 I have 2 nat rules : all going to ASL on tcp 1723 and all on GRE DNAT to the Win2k box. The win 2k box is masqueraded on the external network on ASL. The rules are anyany to the win2k box. When I want to connect to the vpn server the client blockes at "verifying username and password" . If I connect localy , it works . The RAS server doesn't receive an authetication request. Can U tell me if there is a problem with ASL on routing the tcp 1723 and GRE packets, or if my configuration is wrong ? Thank you.

This thread was automatically locked due to age.

0 Roland Gaspar over 22 years ago

Have you enabled RoadWarrior Access on ASL? (if you have, maybe disabling it will help)...

Maybe.
Cancel
Vote Up 0 Vote Down

Cancel
0 Radu_01 over 22 years ago in reply to Roland Gaspar

it is not enabled . anyway ... to put in another way the question : I have ASL connected directly to Internet . The second net card is for the local network . Which are the steps for creating a mworking VPN server on a Windows Server located in local network ?
Cancel
Vote Up 0 Vote Down

Cancel
0 Zayoud over 22 years ago in reply to Radu_01

check the "filter live log" in the packet filter section while you're attemting to authenticate, and open up the blocked ports !
Cancel
Vote Up 0 Vote Down

Cancel
0 Joe_Halleck over 22 years ago in reply to Zayoud

There is a bug that I have worked with astaro to try to fix.It looks to be ASL is not forwarding the gre traffic...nothing will show in the logs...It just doesn't work.

I understand they are working on a fix.

Regards.
Cancel
Vote Up 0 Vote Down

Cancel
0 lviper over 22 years ago

You may have to create 2 packet filter rules to allow the GRE and 1723. I have noticed that the from any to any packet filter rules sometimes does not include high ports.
Cancel
Vote Up 0 Vote Down

Cancel
0 lviper over 22 years ago in reply to Radu_01

Also, I assume you are trying to make a vpn connection from the outside to the Win box located inside behind the ASL box. If this is the case, you will also need to DNAT the packets in.
Cancel
Vote Up 0 Vote Down

Cancel