Re: VPN PPTP problem with server behind fw

Tom Eastep
2004-06-09T14:06:05Z

Andy wrote:
> Hi,
>
> some issue just driving me nuts, even though, Tom wrote the howto in the
> docs for running a pptp server behind shorewall.
>
> I am doing
> dnat    wan     dmz:10.10.10.1  47      -
> dnat    wan     dmz:10.10.10.1  tcp     1723    -
>
> and I cannot access from outside. I see in tcpdump the icmp message to
> the client that protocol 47 is unreachable.

Are you running tcpdump on the firewall''s external or interal
interface?

>
> Modules I loaded
>     loadmodule ip_tables
>     loadmodule iptable_filter
>     loadmodule ip_conntrack
>     loadmodule ip_conntrack_ftp
>     loadmodule ip_conntrack_irc
>     loadmodule iptable_nat
>     loadmodule ip_nat_ftp
>     loadmodule ip_nat_irc
>     loadmodule ip_nat_h323
>     loadmodule ip_conntrack_h323
>     loadmodule ip_conntrack_proto_gre
>     loadmodule ip_conntrack_pptp
>     loadmodule ip_nat_pptp
>     loadmodule ip_nat_proto_gre

I suggest getting it working with a single client first *without* the
last four modules. There are quite a few broken versions of those
floating around. The only reason you need those at all is to be able to
handle multiple clients behind the same remote masquerading gateway.

-Tom
--
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net