VPN Windows Server 2003

[saif]

Dear Experts,

I have Windows 2003 Enterprise edition box running behind the linux box router (firewall also running)

My Windows box IP is 10.0.0.5. I installed VPN with single NIC. When i try to connect to seerver through VPN dialer on LAN, it let me connect. But When i try to connect it from the internet it doesn't

here are the rules that i implemented for port forwarding and also tcpdump output.

Firewall rules:

iptables -A PREROUTING -t nat -i $publicif -p tcp --dport 1723 -j DNAT --to 10.0.0.5:1723
iptables -A FORWARD -p tcp --dport 1723 -d 10.0.0.5 -j ACCEPT



TCPDUMP output


09:34:20.299903 IP 117ip.tw1.biz.32799 > 10.0.0.5.1723: S 3249621641:3249621641(0) win 16384 <mss 1300,nop,nop,sackOK>
09:34:20.300012 IP 10.0.0.5.1723 > 117ip.tw1.biz.32799: S 87334747:87334747(0) ack 3249621642 win 16384 <mss 1460,nop,nop,sackOK>
09:34:21.160838 IP 117ip.tw1.biz.32799 > 10.0.0.5.1723: P 1:157(156) ack 1 win 16900: pptp CTRL_MSGTYPE=SCCRQ PROTO_VER(1.0) FRAME_CAP(A) BEARER_CAP(A) MAX_CHAN(0) FIRM_REV(2600) [|pptp]
09:34:21.162126 IP 10.0.0.5.1723 > 117ip.tw1.biz.32799: P 1:157(156) ack 157 win 65379: pptp CTRL_MSGTYPE=SCCRP PROTO_VER(1.0) RESULT_CODE(1) ERR_CODE(0) FRAME_CAP(S) BEARER_CAP(DA) MAX_CHAN(0) FIRM_REV(3790) [|pptp]
09:34:21.919730 IP 117ip.tw1.biz.32799 > 10.0.0.5.1723: P 157:325(168) ack 157 win 16744: pptp CTRL_MSGTYPE=OCRQ CALL_ID(49152) CALL_SER_NUM(20911) MIN_BPS(300) MAX_BPS(100000000) BEARER_TYPE(Any) FRAME_TYPE(E) RECV_WIN(64) PROC_DELAY(0) PHONE_NO_LEN(0) [|pptp]
09:34:21.920866 IP 10.0.0.5.1723 > 117ip.tw1.biz.32799: P 157:189(32) ack 325 win 65211: pptp CTRL_MSGTYPE=OCRP CALL_ID(61670) PEER_CALL_ID(49152) RESULT_CODE(1) ERR_CODE(0) CAUSE_CODE(0) CONN_SPEED(14808325) RECV_WIN(16384) PROC_DELAY(0) PHY_CHAN_ID(0)
09:34:22.559894 IP 117ip.tw1.biz.32799 > 10.0.0.5.1723: P 325:349(24) ack 189 win 16712: pptp CTRL_MSGTYPE=SLI PEER_CALL_ID(1028) SEND_ACCM(0xffffffff) RECV_ACCM(0xffffffff)
09:34:22.670592 IP 10.0.0.5.1723 > 117ip.tw1.biz.32799: . ack 349 win 65187
09:34:59.478682 IP 117ip.tw1.biz.32799 > 10.0.0.5.1723: P 349:365(16) ack 189 win 16712: pptp CTRL_MSGTYPE=CCRQ CALL_ID(49152)
09:34:59.478836 IP 10.0.0.5.1723 > 117ip.tw1.biz.32799: P 189:337(148) ack 365 win 65171: pptp CTRL_MSGTYPE=CDN CALL_ID(61670) RESULT_CODE(0) ERR_CODE(0) CAUSE_CODE(0) [|pptp]
09:35:00.297333 IP 117ip.tw1.biz.32799 > 10.0.0.5.1723: P 365:381(16) ack 337 win 16564: pptp CTRL_MSGTYPE=StopCCRQ REASON(1)
09:35:00.297458 IP 10.0.0.5.1723 > 117ip.tw1.biz.32799: P 337:353(16) ack 381 win 65155: pptp CTRL_MSGTYPE=StopCCRP RESULT_CODE(1) ERR_CODE(0)
09:35:00.817662 IP 117ip.tw1.biz.32799 > 10.0.0.5.1723: F 381:381(0) ack 353 win 16548
09:35:00.817842 IP 10.0.0.5.1723 > 117ip.tw1.biz.32799: F 353:353(0) ack 382 win 65155
09:35:01.639378 IP 117ip.tw1.biz.32799 > 10.0.0.5.1723: . ack 354 win 16548


At the end VPN dialer shows the status "Verifying username and password". after that this message appears

"Error 721: Remote Computer did not respond."

Please help

Saif ur Rab

 

[gavm99]

Hi,

You need another rule on your firewall to allow GRE packets which is protocol 47 to be forwarded to the Windows server. It will work then!!

Please note GRE is not a port, it is a protocol!

Thanks.

----------------------------------------
"Nobody cares how it works, as long as it works