Bekijk de volledige versie : Help: VPN trafic stays in router ???
Hi,
I installed latest firmware from oleg. I want to be able to use my Xp VPN server behind the router. It should support VPN passthrough but I haven't seen it working.
When I make a connection from my work to my router it seems that all traffic is stuck to 192.168.1.1
See log=>
kernel: ACCEPT IN=eth1 SRC=x.x.x.x DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=33751 DF PROTO=TCP SPT=46556 DPT=80 SEQ=1402055379 ACK=0 WINDOW=32120 RES=0x00 SYN URGP=0 OPT (020405640402080A380E7E070000000001030300)
kernel: ACCEPT IN=eth1 SRC=x.x.x.x DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=33945 DF PROTO=TCP SPT=46574 DPT=80 SEQ=911331504 ACK=0 WINDOW=32120 RES=0x00 SYN URGP=0 OPT (020405640402080A380E7E160000000001030300)
I have made an entry in the virtual server list: port 1723 to 192.168.1.2
What do I have to do more ??? :(
Have you tried disabling firewall?
Hi,
I installed latest firmware from oleg. I want to be able to use my Xp VPN server behind the router. It should support VPN passthrough but I haven't seen it working.
I have made an entry in the virtual server list: port 1723 to 192.168.1.2
As far as I know VPN passthrough is not necessary on the VPN server side. VPN passthrough is only needed by the PPTP client through NAT firewall.
Cheers
As far as I know VPN passthrough is not necessary on the VPN server side. VPN passthrough is only needed by the PPTP client through NAT firewall.
Cheers
Forgot to mention, however, custom firewall rules may need to be added to allow protocol 47 to be forwarded to the PPTP server. So it's more than just tcp port 1723 that's need forwarding.
Cheers
Forgot to mention, however, custom firewall rules may need to be added to allow protocol 47 to be forwarded to the PPTP server. So it's more than just tcp port 1723 that's need forwarding.
Cheers
According to ComputerTotaal magazine I need to unbind the IKE, GRE and ESP
in my st510i.
How would I have to do this for the wl500g ?
Or how would I add those extra firewall rules. With the iptables stuff ??? :confused:
According to ComputerTotaal magazine I need to unbind the IKE, GRE and ESP
in my st510i.
How would I have to do this for the wl500g ?
Or how would I add those extra firewall rules. With the iptables stuff ??? :confused:
Don't jump on me if I do it wrongly. I am still learning the wl500g platform specific things, nevertheless it is still Linux and iptables - the principles are the same.
I image you could do it this way quite easily :- Just add another virtual server, this time you specify protocol 'OTHER' and protocol number 47 and also fill up your local PPTP server IP address. Therefore you have two virtual servers, both same IP address, but one forwarding tcp port 1723
and another is protocol 47.
BTW, IKE and ESP are meant for IPSEC, which is something different from PPTP.
Cheers
kernel: ACCEPT IN=eth1 SRC=x.x.x.x DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=33751 DF PROTO=TCP SPT=46556 DPT=80 SEQ=1402055379 ACK=0 WINDOW=32120 RES=0x00 SYN URGP=0 OPT (020405640402080A380E7E070000000001030300)
kernel: ACCEPT IN=eth1 SRC=x.x.x.x DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=33945 DF PROTO=TCP SPT=46574 DPT=80 SEQ=911331504 ACK=0 WINDOW=32120 RES=0x00 SYN URGP=0 OPT (020405640402080A380E7E160000000001030300)
These seem to be connection to a web server. Also, eth1 is the WLAN (at least on my WL-500g ;) )
These seem to be connection to a web server. Also, eth1 is the WLAN (at least on my WL-500g ;) )
eth1 is WAN, eth2 is WLAN.
These seem to be connection to a web server. Also, eth1 is the WLAN (at least on my WL-500g ;) )
This is my interpretation of the result :- the client is sending the wrong thing to the server.
Because the VPN has not been established, when the client make a test connection via HTTP, by right it is supposed to encapsulate it using GRE protocol ( 47 ), instead it is sending it out as plain tcp at port 80.
When everything works correctly, you should not see anything sensible at the firewall side; you should only see some exchanges in tcp port 1723 for initiating the PPTP and the rest are in protocol 47. Nothing else should reveal that there is a HTTP connection.
Cheers
This is my interpretation of the result :- the client is sending the wrong thing to the server.
Cheers
Sounds plausible but I know it's not the answer.
The traffic on port 80 is there because I was at my work also looking in the log file from the wan side.
I think my companies firewall doesn't allow vpn clients.
Another question... The gre traffic...which direction is it going ?
from client to server or also from server to client ?
Should prot 47(GRE) be transparent in the router for input AND output ?
How to edit the iptables ?
kraai
I think my companies firewall doesn't allow vpn clients.
You are confusing me. You do not have administrative control over the firewall at the server side ? I thought you say you configured virtual server at the firewall for tcp port 1723 ?
If you do not have control over the firewall at the server side, you are doomed and case is closed. There is nothing else to talk about.
Another question... The gre traffic...which direction is it going ?
from client to server or also from server to client ?
It's by directional. But only one side need to be configured because by default the other direction is accepted.
Should prot 47(GRE) be transparent in the router for input AND output ?
Not sure what you mean by transparent here.
How to edit the iptables ?
kraai
It can be edited by editing post-firewall (?) or something but it's not necessary in my views.
Cheers.
You are confusing me. You do not have administrative control over the firewall at the server side ? I thought you say you configured virtual server at the firewall for tcp port 1723 ?
Yes I do ! The server side is at my home...
If you do not have control over the firewall at the server side, you are doomed and case is closed. There is nothing else to talk about.
But I do.
I do not have administrator rights for my companies firewall.
I just try to connect at work to my wl500g at home. At the VPN server is behind this router at home. So again. I am running a VPN server (XP) at home and want to connect to it from my work.....get the idea ???
It's by directional. But only one side need to be configured because by default the other direction is accepted.
this is in my IPtables:
Chain PREROUTING (policy ACCEPT 4804 packets, 304K bytes)
DNAT tcp -- * * 0.0.0.0/0 x.x.x.x tcp dpt:1723 to:192.168.1.2
DNAT 47 -- * * 0.0.0.0/0 x.x.x.x to:192.168.1.2
should be ok gre is forwarded and 1723. But still doesn't work
Not sure what you mean by transparent here.
I means should this port be open bidirectional ? Shouldn't it be in the POSTROUTING somewhere ?
It can be edited by editing post-firewall (?) or something but it's not necessary in my views..
No I mean WHAT should be IN the iptables ?
kraai
Yes I do ! The server side is at my home...
But I do.
I do not have administrator rights for my companies firewall.
This is the reverse of what I originally thought but the idea is the same.
But this is doomed as well. The firewall at the client side has to support PPTP passthrough.
this is in my IPtables:
Chain PREROUTING (policy ACCEPT 4804 packets, 304K bytes)
DNAT tcp -- * * 0.0.0.0/0 x.x.x.x tcp dpt:1723 to:192.168.1.2
DNAT 47 -- * * 0.0.0.0/0 x.x.x.x to:192.168.1.2
should be ok gre is forwarded and 1723. But still doesn't work
This is correct. But the client side firewall has to support VPN passthrough, and most likely it is not supporting. If it is a Linux, you have to somehow get it to load these modules or compiled into the kernel :-
ip_conntrack_pptp
ip_nat_pptp
ip_conntrack_gre
ip_nat_gre
Cheers
IIRC the Linux connection handler only work when the client is behind the NAT, not when a server is behind the NAT, that means the WL-500g can only handle "outgoing" VPN connections and not "incoming".
Let's assume your company firewall correctly handles these packets, then what you could do is try to make the WL-500g handle the VPN. If you require it to be PPTP, you might take a look at the PoPToP program.
At the moment, I'm working on making CIPE work on the WL-500g, which might allow you to create a VPN. CIPE uses UDP for packet transport and works quite well over NAT (at least for me ;) ). Now, if your system at work is a Linux box and you have root access, you can make this work really easy. If it's a Windows box, you might want to try the Windows port, which claims to work, but I never tested it.
Besides of the fact, that you need DNAT you should also have FORWARD rule, which actually doing firewalling.
I've asked krai regarding firewall - but looks like he is ignoring the question...
Besides of the fact, that you need DNAT you should also have FORWARD rule, which actually doing firewalling.
I've asked krai regarding firewall - but looks like he is ignoring the question...
Oleg I am very sorry...It slipped my attention.
I switched my firewall (in wl500g) off...
These are my iptables however:
logaccept tcp -- * * 0.0.0.0/0 192.168.1.2 tcp dpt:1723
logaccept tcp -- * * 0.0.0.0/0 192.168.1.2 tcp dpt:22
logaccept 47 -- * * 0.0.0.0/0 192.168.1.2
Ehm what is the best way to test this setup. Since testing only once I am back at my office is not ideal.
I also test using vpn with a dialup modem and connecting to my router that way. I notice that whenever I use a dialup modem my internet browsing also goes via this modem. Since when I go to www.myip.com the IP of the connection with my dialupmodem is shown and not the one of my wl500g wan side ?
Does the fact that my provider has a gateway wich is not in the same address range of my ip-address influence the whole VPN thing ?
gatway:195.190.245.64
ip address 83.x.x.x
regards,
kraai
IIRC the Linux connection handler only work when the client is behind the NAT, not when a server is behind the NAT, that means the WL-500g can only handle "outgoing" VPN connections and not "incoming".
Are you telling me that this can NEVER work. A vpn Server at the lan side of the wl500g ?!? :confused:
At the moment, I'm working on making CIPE work on the WL-500g, which might allow you to create a VPN. CIPE uses UDP for packet transport and works quite well over NAT (at least for me ;) ). Now, if your system at work is a Linux box and you have root access, you can make this work really easy. If it's a Windows box, you might want to try the Windows port, which claims to work, but I never tested it.
So this way the vpn connection doesn't have to go through the modem ?
But is initiated BY the modem. OK I am interested...
gatway:195.190.245.64
ip address 83.x.x.x
That's not a problem, and actually happens a lot. This is because for dailup PPP is used, in where the link has only two ends. In the case of ethernet (your LAN), there can be multiple systems in 1 segment, and they share an IP-range, but with PPP this isn't necessary.
Are you telling me that this can NEVER work. A vpn Server at the lan side of the wl500g ?!? :confused:
When using PPTP, yes, that's what I'm telling. I'm not 100% sure by the way, but that is what I've read about those modules.
So this way the vpn connection doesn't have to go through the modem ?
But is initiated BY the modem. OK I am interested...
Not modem, but router ;)
And indeed, what happens is that the UDP packets that arrive from your work will be picked up by the router and the encapsulated IP-packet will be extracted and forwarded to the LAN.
IIRC the Linux connection handler only work when the client is behind the NAT, not when a server is behind the NAT, that means the WL-500g can only handle "outgoing" VPN connections and not "incoming".
Maybe there is something special in WL500g but I do not think it should be applicable to Linux in general. My views is this, PPTP VPN works behind Linux firewall, but the requirement as I have already mentioned is as follows :-
Firewall at PPTP server side:
DNAT and forward tcp port 1723 and protocol 47.
PPTP onnection tracking modules not necessary.
Firewall at PPTP client side:
No iptables rules needed.
PPTP/GRE connection tracking a must.
Cheers
OK apperantly it is possible to reach the XP webserver behind the router.
ACCEPT IN=eth1 OUT=br0 SRC=84.30.x.x DST=192.168.1.2 LEN=57 TOS=0x00 PREC=0x20 TTL=117 ID=440 PROTO=47
ACCEPT IN=eth1 OUT=br0 SRC=84.30.x.x DST=192.168.1.2 LEN=57 TOS=0x00 PREC=0x20 TTL=117 ID=441 PROTO=47
But at the client an error is received: error 628.
Error 628 - The connection was terminated by the remote computer before it
could be completed.
so what else do I need....firewall is off. 1723 is forwarded. 47 also (as one can see in the log)
by the way:
eth0 = wan ; eth1 = LAN ; br0= WIFI ???
what is br0 ?
by the way:
eth0 = wan ; eth1 = LAN ; br0= WIFI ???
what is br0 ?
Talking about the 500g:
in my case eth0 is wired LAN, eth1 is the WAN, and eth2 is wireless
br0 is a bridge between eth0 and eth2
iptables -t nat -I PREROUTING -p 47 -i eth1 -j DNAT --to-destination 192.168.1.2
iptables -t nat -I PREROUTING -p tcp -i eth1 --dport 1723 -j DNAT --to-destination 192.168.1.2:1723
iptables -t filter -I FORWARD -p 47 -d 192.168.1.2 -j logaccept
iptables -t filter -I FORWARD -p tcp -d 192.168.1.2 --dport 1723 -j logaccept
iptables -t nat -I POSTROUTING -p 47 -d 192.168.1.2 -j MASQUERADE
iptables -t nat -I POSTROUTING -p tcp -d 192.168.1.2 --dport 1723 -j MASQUERADE
hope it will help...
iptables -t nat -I PREROUTING -p tcp -i eth1 --dport 47 -j DNAT --to-destination 192.168.1.2:47
iptables -t nat -I PREROUTING -p tcp -i eth1 --dport 1723 -j DNAT --to-destination 192.168.1.2:1723
iptables -t filter -I FORWARD -p tcp -d 192.168.1.2 --dport 47 -j logaccept
iptables -t filter -I FORWARD -p tcp -d 192.168.1.2 --dport 1723 -j logaccept
iptables -t nat -I POSTROUTING -p tcp -d 192.168.1.2 --dport 47 -j MASQUERADE
iptables -t nat -I POSTROUTING -p tcp -d 192.168.1.2 --dport 1723 -j MASQUERADE
hope it will help...
Shouldn't the --dport 47 be -p tcp 47 since GRE is tcp protocol 47 nog port 47 ?
sorry, was just an overview...did't read is fully
will edit it!
Shouldn't the --dport 47 be -p tcp 47 since GRE is tcp protocol 47 nog port 47 ?
Well as a matter of fact, I just did a **ACTUAL** testing using WL500gx that I have, I got the PPTP VPN working ( WL500 as PPTP server firewall ) WITHOUT editing any custom firewall rules. I just use the web interface, configured to virtual servers as I have explained earlier.
Edit of filter FORWARD chain is quite unnecessary for WL500, because the default policy is to accept.
Edit of nat POSTROUTING chain is also unnecessary because that's only needed if you do a 'loopback'.
The only useful edit is the nat PREROUTING chain, which is what the web interface is providing.
The only thing which might be different is that I am using Linux pptp client and Linux poptop server ( vs Microsoft ).
Hope this helps.
Cheers.
Well as a matter of fact, I just did a **ACTUAL** testing using WL500gx that I have, I got the PPTP VPN working ( WL500 as PPTP server firewall ) WITHOUT editing any custom firewall rules. I just use the web interface, configured to virtual servers as I have explained earlier.
Edit of filter FORWARD chain is quite unnecessary for WL500, because the default policy is to accept..
hmm that is what a did in the beginning. That didn't work for me...
Since than I started digging. Maybe it is something else on my which is holding things back.
How do I go back to the initial state ?? iptables -F ??
I think I will use a clean laptop to connect to the router this evening and configure it to be the server... Then I will try to connect to it.
The problem is that I have to go somewhere else to connect to it and that takes time. Or could I just plugin a pc to the WAN port and pretend I am my ISP ?
kraai
Or could I just plugin a pc to the WAN port and pretend I am my ISP ?
kraai
I think this is a good idea. This takes out the factor of PPTP client going through firewall. And you can just concentrate on the PPTP server issues.
Also remember to do a step by step ping ( from your XP server ) to make sure it can reach the PPTP client before you even proceeding to perform PPTP connection. Basic tcp/ip routing must be setup correctly before proceeding.
Cheers
I think this is a good idea. This takes out the factor of PPTP client going through firewall. And you can just concentrate on the PPTP server issues.
Any idea how to set this up ?
set wl500 to static IP eg. 83.100.0.1 and give pc which is connected to wan port also an ip in this range ?
And than connect vpn client to server at LAN side.
rgds kraai
Any idea how to set this up ?
set wl500 to static IP eg. 83.100.0.1 and give pc which is connected to wan port also an ip in this range ?
And than connect vpn client to server at LAN side.
Yeah you have already answered it yourself.
Also before initiating the PPTP connection, make sure you can ping from the XP PPTP server to the pc PPTP client and also ping from pc PPTP client to the public IP of wl500.
This will make sure you set up the ip/routes correctly.
Cheers