VPN connection problem

Hi,

When I try to connect fra a WAN client to my win2k3 server (sp1) via vpn I
cannot
do so. The server starts to validate client user and password and nothing
more
happens....the session times out. I have tried to disconnected the routers
firewall
and goes directly into the server.

When trying to make a vpn connection from a client on/from the LAN - there
is no problem it validates ok and make the vpn connection - it´s only a
problem when a WAN client tries to connect.

What is wrong and how to solve it?

Regards, Torben Broendum

Is your server directly connected to the Internet? If so, check the
filters on the public NIC. If it is behind a router, check the filtering on
that.

If you are using PPTP, the most common problem is blocking GRE (IP
protocol 47). This must be enabled for both incoming and outgoing traffic
(because the encrypted data is inside a packet with a GRE header).

Torben Broendum wrote:
> Hi,
>
> When I try to connect fra a WAN client to my win2k3 server (sp1) via
> vpn I cannot
> do so. The server starts to validate client user and password and
> nothing more
> happens....the session times out. I have tried to disconnected the
> routers firewall
> and goes directly into the server.
>
> When trying to make a vpn connection from a client on/from the LAN -
> there is no problem it validates ok and make the vpn connection -
> it´s only a problem when a WAN client tries to connect.
>
> What is wrong and how to solve it?
>
> Regards, Torben Broendum

I thing my problem is that GRE is not enablet for both incomming and outgoing
traffic. How to do that on my win2k3 ?

It has nothing to do with the servers firewall then? - I am using SP1

Torben Broendum



"Bill Grant" wrote:

> Is your server directly connected to the Internet? If so, check the
> filters on the public NIC. If it is behind a router, check the filtering on
> that.
>
> If you are using PPTP, the most common problem is blocking GRE (IP
> protocol 47). This must be enabled for both incoming and outgoing traffic
> (because the encrypted data is inside a packet with a GRE header).
>
> Torben Broendum wrote:
> > Hi,
> >
> > When I try to connect fra a WAN client to my win2k3 server (sp1) via
> > vpn I cannot
> > do so. The server starts to validate client user and password and
> > nothing more
> > happens....the session times out. I have tried to disconnected the
> > routers firewall
> > and goes directly into the server.
> >
> > When trying to make a vpn connection from a client on/from the LAN -
> > there is no problem it validates ok and make the vpn connection -
> > it´s only a problem when a WAN client tries to connect.
> >
> > What is wrong and how to solve it?
> >
> > Regards, Torben Broendum
>
>
>

Your router is probably not passing 47 through nat to w2k3. Forward 47
to your w2k3 box from your router..

What kind of router do you have?

psg

Linksys WRT54GP2.

I have tried not to use the router => directly into the server = same problem.

Can You tell me how to enable (how to control for) GRE for incomming and
outgoing traffic?

Torben Broendum




"chrispsg" wrote:

> Your router is probably not passing 47 through nat to w2k3. Forward 47
> to your w2k3 box from your router..
>
> What kind of router do you have?
>
> psg
>
>

The port has to be open on the device facing the internet. If the
WRT54GP2 is the only device that stands between the w2k3 server and the
internet then the port has to be allowed through it and forwarded to
the w2k3 RAS server.

Instructions for the above router can be found on page 44:

ftp://ftp.linksys.com/pdf/WRT54GP2us...revDwebpdf.pdf


psg

Port 1723 had to be forwarded also for pptp.

psg

I know about the router - I think my problem is GRE on the server which is
not enablet I think - how to enable GRE ?

I have tried not to use the router = same problem: Wna vpn connection
results in validating id and passw. and then times out. I thing GRE is
blokked on my win2k3 server SP1.

Torben Brondum



"chrispsg" wrote:

> Port 1723 had to be forwarded also for pptp.
>
> psg
>
>

I doubt that GRE is blocked on the server. Do you only have one NIC in the
server?

Also note that GRE is an IP protocol, not a port. It can be allowed or
enabled, or it can be disallowed or blocked. It cannot be forwarded!

Torben Broendum wrote:
> I know about the router - I think my problem is GRE on the server
> which is not enablet I think - how to enable GRE ?
>
> I have tried not to use the router = same problem: Wna vpn connection
> results in validating id and passw. and then times out. I thing GRE is
> blokked on my win2k3 server SP1.
>
> Torben Brondum
>
>
>
> "chrispsg" wrote:
>
>> Port 1723 had to be forwarded also for pptp.
>>
>> psg

Bill thanks for the clarification about GRE.

Below are steps to take if the OP only has one NIC in the server.

http://support.microsoft.com/default...b;en-us;217766

Here is some more information:

http://support.microsoft.com/default...b;en-us;888201

psg