Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 1 subscriber
  • Views 857 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Setup help with Win2k VPN behind Astaro

JVG
We are trying to use Win2K VPN services on a VPN host that is behind the Astaro firewall (3.219).  We are trying to setup VPN to use L2TP/IPSec.  

Here are the configuration details:
 Code:
      
RemoteClient  Internet  Router 
                                  |
                                  |
                              AstaroFW
                                  |
                     |------------|
                     |            |
                     |     VPNServer(Multihomed)
                     |            |
                     |            |
                     |            |
                     |____________|____________
                                  |
                                  |
                               Intranet 
 

-  Astaro Firewal has 2 NICs, one with external IP and one with Internal IP.
-  VPN Server has 2 NICs, one with external IP and one with internal IP.  The VPN server also runs DHCP so that the VPN clients will get internal IP addresses.

Please note that the Intranet hosts *and* VPN's external (and internal) NIC are both on the same "wire" (hub).

Internal IPs are 192.168.26.0/24

-  On Astaro, I have packet filters saying:

From AnyClient ALLOW udp/50 (ESP) to VPNExternIP
From AnyClient ALLOW udp/500 (ISAKMP) to VPNExternIP
From AnyClient ALLOW udp/1701 (L2TP) to VPNExternIP
From AnyClient ALLOW udp/4500 (NAT-T) to VPNExternIP

From VPN_ExternIP ALLOW AnyTraffic to AnyClient

-  I have a static routing entry in the AstaroFW that says:

All traffic for VPNExternIP put it on the InternalInterface.

-  The Astaro has a default masquerading entry:
Code:

Default Masquerading   Intern_Network__ -> All / All   MASQ__External   None 


-  The VPN Server network configuration:

a) VPNExternalNIC:
ExternalIP address
Default gateway is the external IP of Astaro

b) VPNInternalNIC:
InternalIP Address
Default gateway is the internal IP of astaro

-  All intranet hosts has the AstaroFW as their default gateway.

Now, if I tried to establish VPN connection from a host on the intranet with the intranet address of the VPN, it works just fine.  

I can ping the VPNExternalIP just fine.  However, if I try to establish VPN connection from a host on the intranet/internet with the extenral IP of the VPN, it DOES NOT work.
 
What else needs to be done to get this configuration to work?  Do I need to allow udp/51 (AH) packets? 

Any help would be very much appreciated.

Thanks
Prasad    


This thread was automatically locked due to age.
Parents
  • 0
    Also in the filter rules, open PPTP service.  Windows RRAS server and client both use either PPTP or L2TP.

    George  
  • 0 in reply to orlov
    Hello George,

    Thanks for your suggestions.

    I tried opening the GRE service, still does not work.

    I would like to use L2TP not PPTP.

    Using a network sniffer, I noticed is that, some of the ISAKMP and ESP packets that are received by the client during the connection establishment/negotiation have the VPNInternalIP as the source address instead of the VPNExternalIP.  I believe that should not be the case.  That may be the cause of the problem?

    Prasad  
Reply
  • 0 in reply to orlov
    Hello George,

    Thanks for your suggestions.

    I tried opening the GRE service, still does not work.

    I would like to use L2TP not PPTP.

    Using a network sniffer, I noticed is that, some of the ISAKMP and ESP packets that are received by the client during the connection establishment/negotiation have the VPNInternalIP as the source address instead of the VPNExternalIP.  I believe that should not be the case.  That may be the cause of the problem?

    Prasad  
Children
No Data
Cookie Information Banner