Windows VPN server behind iptables

Windows VPN server behind iptables

[John York]

Hi all,

I set up my first IPtables box, doing NAT and port forwarding. I've
managed to Google most of the kinks out, but this one perplexes me.
There is a Win2K VPN server behind the firewall, using PPTP. It will
accept connections, but chokes before accepting the username/password.
The most I've been able to figure out is that it has something to do
with protocol 47.

All other forwards (HTTP, HTTPS, POP, SMTP, Telnet) work fine. Any
ideas?

Thanks,
John

RE: Windows VPN server behind iptables

[John York]

Got it.

Started using shorewall, and configured it per their instructions. Sorry
to waste bandwidth :)

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of John York
Sent: Thursday, January 16, 2003 20:27
To: netfilter@lists.netfilter.org
Subject: Windows VPN server behind iptables

Hi all,

I set up my first IPtables box, doing NAT and port forwarding. I've
managed to Google most of the kinks out, but this one perplexes me.
There is a Win2K VPN server behind the firewall, using PPTP. It will
accept connections, but chokes before accepting the username/password.
The most I've been able to figure out is that it has something to do
with protocol 47.

All other forwards (HTTP, HTTPS, POP, SMTP, Telnet) work fine. Any
ideas?

Thanks,
John

RE: Windows VPN server behind iptables

[Rowan Reid]

> 
> I set up my first IPtables box, doing NAT and port 
> forwarding. I've managed to Google most of the kinks out, but 
> this one perplexes me. There is a Win2K VPN server behind the 
> firewall, using PPTP. It will accept connections, but chokes 
> before accepting the username/password. The most I've been 
> able to figure out is that it has something to do with protocol 47.
> 
> All other forwards (HTTP, HTTPS, POP, SMTP, Telnet) work 
> fine. Any ideas?

I tried to do exactly what yoru doing, I'll explain where I am.  In
order to support pptp traffic you have to support protocol 47, and allow
traffic forwarding on tcp port 1723. seems simple enough ..... Err no
trick is netfilter doesn't nativly support pptp traffic. The two options
you have are to get the latest POM and apply the pptp Nat patches. There
is also another patch available below. Let me know if yo uget it to
work. I gave up and went with an IPSEC implimentation which is just as
much a pain in the ass

http://www.impsec.org/linux/masquerade/ip_masq_vpn.html