Microsoft VPN

Microsoft VPN

[Narti Kitiyakara]

We're having trouble accessing our Microsoft VPN server through an iptables firewall.  The first person to connect gets in fine, but we can't make concurrent VPN connections.  We used guarddog and guidedog to set up most of the firewall, but guidedog doesn't know how to DNAT based on IP protocol, so we added an initialization script to run level 5 (below) to DNAT based on protocol.  As I said, we're just perplexed as to why this would work for one user but not additional users.  Any help will be greatly appreciated.

/sbin/iptables -t nat -A ftolocal -p gre -j DNAT --to-destination 1.2.3.4
/sbin/iptables -t mangle -A ftolocal -p gre -j MARK --set-mark 1
/sbin/iptables -t nat -I PREROUTING 1 -p gre -j gforward


- narti

Re: Microsoft VPN

[Antony Stone]

On Wednesday 30 June 2004 6:27 pm, Narti Kitiyakara wrote:

> We're having trouble accessing our Microsoft VPN server through an iptables
> firewall.  The first person to connect gets in fine, but we can't make
> concurrent VPN connections.

Sounds like you don't have the PPTP NAT Conntrack helper loaded.

Check patch-o-matic for details.

Regards,

Antony.

-- 
Software development can be quick, high quality, or low cost.

The customer gets to pick any two out of three.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Microsoft VPN

[Wycliffe Bahati]

----- Original Message ----- 
From: "Narti Kitiyakara" <Nkitiyakara@nolacom.com>
To: <netfilter@lists.netfilter.org>
Sent: Wednesday, June 30, 2004 8:27 PM
Subject: Microsoft VPN


We're having trouble accessing our Microsoft VPN server through an iptables
firewall.  The first person to connect gets in fine, but we can't make
concurrent VPN connections.  We used guarddog and guidedog to set up most of
the firewall, but guidedog doesn't know how to DNAT based on IP protocol, so
we added an initialization script to run level 5 (below) to DNAT based on
protocol.  As I said, we're just perplexed as to why this would work for one
user but not additional users.  Any help will be greatly appreciated.

/sbin/iptables -t nat -A ftolocal -p gre -j DNAT --to-destination 1.2.3.4
/sbin/iptables -t mangle -A ftolocal -p gre -j MARK --set-mark 1
/sbin/iptables -t nat -I PREROUTING 1 -p gre -j gforward


- narti
Have u tried to uses snat to do a direct translation to the MS

Re: Microsoft VPN

[Antony Stone]

On Thursday 01 July 2004 10:07 am, Wycliffe Bahati wrote:

> > We're having trouble accessing our Microsoft VPN server through an
> > iptables firewall.  The first person to connect gets in fine, but we can't
> > make concurrent VPN connections.
> >
> > /sbin/iptables -t nat -A ftolocal -p gre -j DNAT --to-destination 1.2.3.4
> > /sbin/iptables -t mangle -A ftolocal -p gre -j MARK --set-mark 1
> > /sbin/iptables -t nat -I PREROUTING 1 -p gre -j gforward
>
> Have u tried to uses snat to do a direct translation to the MS

That won't help - if you notice, the problem is not that nobody can connect, 
but that only the first user can connect.   Therefore the NAT and routing are 
working fine, but the PPTP Conntrack Helper has not been loaded, so second 
and subsequent connections are not passed on correctly to the server.

Regards,

Antony.

-- 
I don't know, maybe if we all waited then cosmic rays would write all our 
software for us. Of course it might take a while.

 - Ron Minnich, Los Alamos National Laboratory

                                                     Please reply to the list;
                                                           please don't CC me.