VPN newbie question

[webfuture]

Hi all,

Just starting to play around with VPN... Here's what I plan on doing... any comments suggestion are welcomed.

Internet --- FW(netgear FVL328) -- VPN server -- domain (dns)

on the FW, I have configured a second static IP to point to the second IP of the VPN server. everything is on 10.1.1.x segment. The VPN server connected on my domain as two IP, one for the intranet and one for the internet. So the FW rule point to the second IP on the server.

For now I can connect from a client to the VPN, but I cannot authenticate. Either I have a timeout or a bad user/pass.

Thanks for all comments and help

Simon

 

[webfuture]

I did another test, if I use only one IP on the vpn server with no ip-filtering, everything is ok. So the problem seems to be related to the way I use the two IP...

VPN server config... that does not work
10.1.1.223 (intranet side) -- Server -- 10.1.1.4 (internet side) -- FW

VPN server config that works (no ip filters)
FW -- 10.1.1.223 -- server

Still investigating the two IP config that I need...

Anyone?

 

[webfuture]

Update:

When I do my setup with two IP but without the IP filters, the VPN works. Do there is a problem with my 2 IP setup and IP filters combination.

Anybody seen those problems

Thanks,

Simon

 

[minxca]

1st setup, why you use the same subnetting for lan and wan?
what ip filter do you use? it's very difficult for us to help you if you give only little bit of info

 

[webfuture]

I think I have some limitations on my firewall, the test I did running on 2 different subnet is not working. Cannot connect.

My lan is 10.1.1.x
On my firewall I have tried connecting my second WAN static IP to a 192.168.2.x network but that did not work.

Now my setup works with this

Lan -- 10.1.1.223 (VPN server) 10.1.1.4 -- Wan -- FW

The problem I have now is when I use ip filters, done automatically by the windows 2003 wizard, the connecting either timeout or give bad user/pass pair.

The IP filters is on the 10.1.1.4 side and looks like this:
Inbound

http://fichierforum.iservio.ca/inbound.jpg

Outbound :

http://fichierforum.iservio.ca/outbound.jpg

Thanks for any help

Simon

 

[minxca]

off course you can't connect, as you see, the filter allow to connect only to your VPN server and only allow the traffic from your vpn server to your client.

Try to add the filter (input) from any to your DC for any protocol and add output filter from your DC to any client.

 

[minxca]

after that you still have to add another filter to access to the other servers or if you don't care just remove the filter.

 

[webfuture]

Ok thanks... it works if I put those rules... What is the potential problem if I remove those filters, is there any way a hacker can do stuff from the web...

Thanks

 

[minxca]

Usually we use filters to allow specific users/group to have access via VPN for specific servers only.

Hacker??? I'm not a hacker but for me everything is hackable, if they want to hack your network they will be able to do it

 

[webfuture]

Thanks... So my last question would be... Will IP filters will make it harder, will it protect more? From what I see only port 1723 is opened on the internet. IP filters will only make a differences after you have successfully login into the VPN...

Do I understand correctly?

Simon

 

[minxca]

Like I said, you use it to allow/block connection to specific servers/ IP. I use it for a group of users to allow them to connect to one file server, email and citrix

 

[webfuture]

Thanks for all the help...

I tested my VPN from home and I always get disconnected. I don't see any bad logs and-or event viewer items...

Any clues why I would always loose the connection.

Thanks

 

[minxca]

What is your VPN server? for w2k3, you have to apply the hotfix

 

[webfuture]

My VPN server is windows 2003 STD SP1 fully updated.

I have seen this one

http://support.microsoft.com/?kbid=897651

but I do not think it applies to me...

My connection drops like clockwork after 3min + or - a few seconds.

I have seen some post here and on the net about some firewall problems related to this ... Still investigating.

any comments?

Thanks

 

[minxca]

http://support.microsoft.com/?kbid=875501

 

[webfuture]

Thanks for the info... I have now bypassed the firewall and the problem is gone. But funny enough, now I don't need two rules in the filters to access my servers... I will have to read more, because a lot to me does not make sense...

Thanks,

Simon