Re-2: connection to vpn Server (pptp) behind iptables FW

Re-2: connection to vpn Server (pptp) behind iptables FW

[peter.gehle]

 
 
> Micro$oft has a 'technote' on this in their technet section on the
> website. AFAIR you need to allow protocol 37 to be forwarded between the
> two.
> 
I have added a rule that forwards the protocol 37, but it still not works?

Thanx Peter

To: raymondl@knowledgefactory.co.za
Cc: netfilter@lists.netfilter.org

Re: Re-2: connection to vpn Server (pptp) behind iptables FW

[Antony Stone]

On Friday 12 March 2004 10:34 am, peter.gehle@sbgit.com wrote:

> > Micro$oft has a 'technote' on this in their technet section on the
> > website. AFAIR you need to allow protocol 37 to be forwarded between the
> > two.
>
> I have added a rule that forwards the protocol 37, but it still not works?

Have you tried adding my suggested LOGging rules to see if there's something 
important still being DROPped?

Antony.

-- 
I'm pink, therefore I'm Spam.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Re-2: connection to vpn Server (pptp) behind iptables FW

[Ray Leach]

[-- Attachment #1: Type: text/plain, Size: 702 bytes --]

On Fri, 2004-03-12 at 12:34, peter.gehle@sbgit.com wrote:
>   
> > Micro$oft has a 'technote' on this in their technet section on the
> > website. AFAIR you need to allow protocol 37 to be forwarded between the
> > two.
> > 
> I have added a rule that forwards the protocol 37, but it still not works?
> 
What about searching technet?

> Thanx Peter
> 
> To: raymondl@knowledgefactory.co.za
> Cc: netfilter@lists.netfilter.org
-- 
--
Raymond Leach <raymondl@knowledgefactory.co.za>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
--

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Re-2: connection to vpn Server (pptp) behind iptables FW

[Cedric Blancher]

Le ven 12/03/2004 à 11:34, peter.gehle@sbgit.com a écrit :  
> > Micro$oft has a 'technote' on this in their technet section on the
> > website. AFAIR you need to allow protocol 37 to be forwarded between the
> > two.
> I have added a rule that forwards the protocol 37, but it still not works?

PPTP relies on a slightly modified GRE tunnel, which protocol _47_, not
37.

cbr@anduril:~$ grep gre /etc/protocols
gre     47      GRE             # General Routing Encapsulation

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: Re-2: connection to vpn Server (pptp) behind iptables FW

[Ray Leach]

[-- Attachment #1: Type: text/plain, Size: 955 bytes --]

On Fri, 2004-03-12 at 14:01, Cedric Blancher wrote:
> Le ven 12/03/2004 à 11:34, peter.gehle@sbgit.com a écrit :  
> > > Micro$oft has a 'technote' on this in their technet section on the
> > > website. AFAIR you need to allow protocol 37 to be forwarded between the
> > > two.
> > I have added a rule that forwards the protocol 37, but it still not works?
> 
> PPTP relies on a slightly modified GRE tunnel, which protocol _47_, not
> 37.

Yup, you are correct. My mistake. I found the info at Technet in their
document entitled 'VPN servers and firewall configuration'

> cbr@anduril:~$ grep gre /etc/protocols
> gre     47      GRE             # General Routing Encapsulation
-- 
--
Raymond Leach <raymondl@knowledgefactory.co.za>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
--

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]