Being a complete pillock, I said Win2K SP3... It is, of course, running
Service Pack 4...
"Charles Crawley" <(E-Mail Removed)> wrote in message
news:3ff96cd2$(E-Mail Removed)...
> Hi,
>
> I am having a few problems re-setting up my VPN, for client PCs I have
> connected to the internet elsewhere, using a new Netgear DG834
> modem/router/firewall. I used to have my Win2k SP3 DC connected directly
to
> the internet using the BT Frog (Alcatel USB ADSL modem), but this has
always
> caused massive instability on my server, so have moved to a separate
router
> (the DG834).
> I have had a VPN (PPTP) set up using RRAS on this server, which has always
> worked fine. I have now, obviously removed the RRAS configuration on the
> server that provided the internet connectivity for my LAN clients and have
> instead set up the new router to provide this. I have now reconfigured
RRAS
> to simply provide VPN functions.
> I performed the following tasks to accomplish this:
>
> (1) Created firewall rules on the DG834 to forward PPTP and IPSec traffic
to
> my Win2K server:
>
> Outbound Services
> 1 Port135 BLOCK always Any Any Always
> Default Yes Any ALLOW always Any Any Never
>
> Inbound Services
> 1 Any(ALL) ALLOW always 192.168.0.5 Any Never - THIS IS DISABLED and
only
> there for testing...
> 2 SETI ALLOW always 192.168.0.5 Any Always
> 3 VNC1 ALLOW always 192.168.0.5 Any Always
> 4 VNC2 ALLOW always 192.168.0.5 Any Always
> 5 FTP ALLOW always 192.168.0.5 Any Always
> 6 HTTP ALLOW always 192.168.0.5 Any Always
> 7 SMTP ALLOW always 192.168.0.5 Any Always
> 8 RemAcc ALLOW always 192.168.0.5 Any Always
> 9 Port135 ALLOW always 192.168.0.5 Any Always
> 10 POP3 ALLOW always 192.168.0.5 Any Always
> 11 VPN-PPTP ALLOW always 192.168.0.5 Any Always
> 12 VPN-IPSEC ALLOW always 192.168.0.5 Any Always
> Default Yes Any BLOCK always Any Any Never
>
> I am a little unsure about the necessity for IPSEC, as I thought this was
> only required for L2TP VPNs, but did see an article somewhere on the
Netgear
> forums saying it should be used. I'm probably wrong about it either way!
> I am blocking Port135 out as I have another DC at the end of a VPN
> connection that my main DC is sending 135 traffic to, but my ISP is
> detecting all 135 traffic out and blocking the connection, due to the
> possibility of it being a virus / worm. I am not worried about this and
> don't really need the other DC.
>
> (2) Set up RRAS on my Win2k Server:
> I started the configuration wizard and selected to install the RRAS
Service
> manually, as advised in many places, due to a bug in RRAS. I then allowed
> the service to start. I right clicked the Server and selected "Properties"
> and ensured that "Router" was ticked, "LAN and demand-dial routing" was
> selected and "Remote Access Server" was ticked. On the "IP" tab, "Enable
IP
> Routing" and "Allow IP-based remote access and demand-dial connection" are
> both ticked and I set up the server to assign IP addresses using a "Static
> address pool" of 192.168.0.200 - 192.168.0.210
> Next, I clicked on the "Ports" icon and selected "Properties", clicked on
> "WAN Miniport (L2TP)" and "Configure" and reduced the "Maximum Ports" to
0.
> I did the same for "WAN Miniport (PPTP)", but increased the number of
ports
> to 10. Both "Remote access connections (inbound only)" and "Demand-dial
> routing connections (inbound and outbound)" are ticked. "Phone number for
> this device" is left blank, as I am not using "Called-Station-Id"
> attribute... !
> All other options have been left at defaults.
>
> (3) Configure VPN client:
> I did nothing to change my original VPN network connections that
previously
> worked fine. They are pretty standard and have the static IP address of my
> modem / router entered as the destination, IP address and DNS are set to
be
> assigned automatically, Windows Domain is included and the option to use
the
> "default gateway on the remote network" is disabled. I have subsequently
> tried setting the type of VPN to "PPTP VPN" explicitly, but his has had no
> effect.
>
> (4) Tested the connection:
> When running the connect attempt, I get a dialogue saying that it is
> "Verifying username and password...", but this eventually times out with
an
> error (Error 721: The remote computer did not respond)
> The only log information that I can find is in the file
> C:\WINNT\SYSTEM32\LOGFILES\IN010405.LOG and seems to be of little help, in
> fact, for most of my testing nothing has been logged at all:
>
192.168.0.5,,01/05/2004,10:11:51,RAS,SERVER01,4,192.168.0.5,44,40,40, 8,4108,
> 192.168.0.5,0,,4136,4,4142,0
>
192.168.0.5,,01/05/2004,10:31:49,RAS,SERVER01,4,192.168.0.5,44,41,40, 7,4108,
> 192.168.0.5,0,,4136,4,4142,0
>
192.168.0.5,,01/05/2004,10:59:40,RAS,SERVER01,4,192.168.0.5,44,41,40, 8,4108,
> 192.168.0.5,0,,4136,4,4142,0
>
192.168.0.5,,01/05/2004,10:59:45,RAS,SERVER01,4,192.168.0.5,44,42,40, 7,4108,
> 192.168.0.5,0,,4136,4,4142,0
>
> Nothing seems to be logged in the Windows Event Log, even though I have
> turned full logging on, so I suspect that my problem lies with my router
and
> either the VPN passthrough is not working properly or I have messed up my
> rules somehow.
>
> (5) Further information:
> My Win2k SP3 Server has all Windows Update patches applied as does my
> Windows XP Professional workstation attempting to connect. The Netgear
DG834
> has the latest 1.03.00 firmware loaded.
>
> I hope this is sufficient information and if anyone can help me with this
> problem I would be very grateful. If you need further information, I can
> obviously get that to you.
>
> Thanks,
>
> Charles Crawley
>
>
Similar Threads
Linear Mode
