Re: VPN PPTP problem with server behind fw

Eduardo Ferreira
2004-06-09T16:34:03Z

Tom wrote on 09/06/2004 12:40:07:

> Andy wrote:
>
> >
> > Do I have to set any additional rules etc? It just look like the
> > 1723/tcp connection is handled well but then it breaks during password
> > validation. (Server did not respond). Trying it from LAN to DMZ works.
>
>
Where is your autentication done? Via Radius to a windows AD server box?
if yes, where is the box? I had a simmilar problem and finally found out
that I needed a ACCEPT rule for udp/1812 and udp/1813 from my dmz to my
loc zone, where my W2K3 AD Server box sits.

> What is your dmz->net policy? If it isn''t "ACCEPT"
then you need:
>
>    ACCEPT   dmz   net   47
Talking about rules, I use a differente aproach here: instead of a DNAT
rule, I use a NAT entry combined with a couple of accept rules:
-- nat File:
www.xxx.yyy.zzz  eth0            192.168.231.1   No No
-- rules File:
OkPPTP     net                  dmz:192.168.231.1
-- action.OkPPTP File:
ACCEPT               -              -               tcp     1723
ACCEPT:info      -              -               47      -
This works here since 1.4.2, at least.  The action, of course, was created
recently when I recently migrated/upgraded/reinstalled to 2.0.x.  I have
the feeling that both sets of shorewall rules (DNAT as in shorewall site
or mine NAT+rules) will lead to the same set of iptables rules.  But the
different DNATs could lead to different conntrack entries - I surely could
be wrong here...

hope it helps,

________________________
Eduardo Ferreira
Icatu Holding S.A.
Supervisor de TI
(5521) 3804-8606