Re: VPN PPTP problem with server behind fw

Andy
2004-06-09T15:36:46Z

Am Mit, den 09.06.2004 um 7:06 Uhr -0700 schrieb Tom
Eastep:
> Andy wrote:
> > Hi,
> >
> > some issue just driving me nuts, even though, Tom wrote the howto in
the
> > docs for running a pptp server behind shorewall.
> >
> > I am doing
> > dnat    wan     dmz:10.10.10.1  47      -
> > dnat    wan     dmz:10.10.10.1  tcp     1723    -
> >
> > and I cannot access from outside. I see in tcpdump the icmp message to
> > the client that protocol 47 is unreachable.
>
> Are you running tcpdump on the firewall''s external or interal
interface?

I was running it on the external interface to see, what the client gets
back

>
> >
> > Modules I loaded
> >     loadmodule ip_tables
> >     loadmodule iptable_filter
> >     loadmodule ip_conntrack
> >     loadmodule ip_conntrack_ftp
> >     loadmodule ip_conntrack_irc
> >     loadmodule iptable_nat
> >     loadmodule ip_nat_ftp
> >     loadmodule ip_nat_irc
> >     loadmodule ip_nat_h323
> >     loadmodule ip_conntrack_h323
> >     loadmodule ip_conntrack_proto_gre
> >     loadmodule ip_conntrack_pptp
> >     loadmodule ip_nat_pptp
> >     loadmodule ip_nat_proto_gre
>
> I suggest getting it working with a single client first *without* the
> last four modules. There are quite a few broken versions of those
> floating around. The only reason you need those at all is to be able to
> handle multiple clients behind the same remote masquerading gateway.
>

I did that as well, and it did not help.
Do I have to set any additional rules etc? It just look like the
1723/tcp connection is handled well but then it breaks during password
validation. (Server did not respond). Trying it from LAN to DMZ works.

Andy