How do you get VPN access through a firestarter firewall

[dariwe]

I have a windows 2000 DC that I am trying to make a VPN connection with. I and am running a redhat box with Firestarter as my firewall. The VPN settings appear to be correct a session can be established from inside of the network. Port 1723 is forwarded to the win2k box, but when I try to establish a connection, I get a error saying that it cannot connect. Other ports are forwarding correctly as I can can view the website that is hosted on win2k box.

Any help you can give would be appreciated.

 

[John Lewis]

You also need to forward protocol 47. Note that that is PROTOCOL 47 not port 47.

 

[dariwe]

Thanks for your reply. I've been looking all over the net and so far haven't found a set of instructions that has helped me to get this going. Do you know of a place where I can find out how to forward that protocol?

thanks again.

 

[John Lewis]

Well, honestly, I was hoping someone else would pick up this thread. I don't do Firestarter. Not that I know of anything bad about it, I just prefer to handle rules myself.

The only decent Firestarter info I can find is at the Firestarter Sourceforge page

http://firestarter.sourceforge.net/

In particular, you might want to click on 'mailing list' at the top and post a question there. You might also try a post here in forum54 (Linux Server).

Having said that, I did poke around at the Firestarter mailing list a bit myself. It looks to me like Firestarter will use either ipchains or iptables. I would hope you are using iptables. If so, you would need to add rules something like:

$IPTABLES -A INPUT -s xxx.xxx.xxx.xxx/24 -i $EXTIF -p 47 -j ACCEPT
$IPTABLES -A OUTPUT -o $EXTIF -p 47 -j ACCEPT

You will need to change the $IPTABLES to whatever variable your script uses to point to iptables, change the $EXTIF to whatever interface is connected to the internet, ie eth1, and change the xxx.xxx.xxx.xxx/24 to the network/subnet that you are connecting from. You might want to remove the whole -s xxx.xxx.xxx.xxx/24 until you get up and running.

Now, the problem is, I am not sure where to put it. I didn't have time to dig through the stuff at sourceforge to find where firestarter puts the script. Also, that is a iptables rule, it will need to be modified to work with ipchains if that is what you are running.

Make up your own disclamer and insert here. I don't know anything, proceede at your own risk, gremlins might destroy your computer if you do this, etc.

Hope this gives you some idea where to go from here.

 

[dariwe]

thanks a lot for your help...that gives me a good place to start