PPTP port forwarding

PPTP port forwarding

[Wim Ceulemans]

[-- Attachment #1: Type: text/plain, Size: 1171 bytes --]

Hi

We have noticed a problem with PPTP forwarding not working as it should.

We have a system on kernel 2.4.24 with latest pom and iptables 1.2.9. 
There is a port forwarding PPTP to a windows 2000 server behind the 
firewall.

We noticed that when someone connects with PPTP the connection is closed 
after 3 to 4 minutes. This problem only occurs if there is a router in 
nat mode between the firewall and the internet. If the public ip is on 
the firewall then this problem does not occur.

Can this be solved in the firewall or will we have to install another 
router (in bridged mode)?

Regards
Wim

-- 
Wim Ceulemans
R&D Engineer

Secure Internet Communication with aXs Guard

aXs GUARD "à la Carte" at Infosecurity
Brussels Kart Expo
10-11 March 2004
stand 1.C.060
FREE registration click here:
http://www.databadge.nl/isbe2004/reg/reg.php?link=d9ca37ba1cb635dc2061

Able NV
Leuvensesteenweg 282 - B-3190 Boortmeerbeek - Belgium
Phone: + 32 15 50.44.00 - Fax: + 32 15 50.44.09
E-mail: wim.ceulemans@able.be


--
---
Security check and anti-virus control on this e-mail has been done by aXs GUARD (http://www.axsguard.com)

Re: PPTP port forwarding

[Antony Stone]

On Thursday 19 February 2004 11:53 am, Wim Ceulemans wrote:

> Hi
>
> We have noticed a problem with PPTP forwarding not working as it should.
>
> We have a system on kernel 2.4.24 with latest pom and iptables 1.2.9.
> There is a port forwarding PPTP to a windows 2000 server behind the
> firewall.
>
> We noticed that when someone connects with PPTP the connection is closed
> after 3 to 4 minutes. This problem only occurs if there is a router in
> nat mode between the firewall and the internet. If the public ip is on
> the firewall then this problem does not occur.

You cannot operate PPTP across a NATted connection without a special helper 
module (hence your need for pom as stated above).

If the other nat-mode router does not have a suitable helper for PPTP then you 
can't use this combination.

Regards,

Antony.

-- 
Abandon hope, all ye who enter here.
You'll feel much better about things once you do.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: PPTP port forwarding

[Wim Ceulemans]

[-- Attachment #1: Type: text/plain, Size: 1605 bytes --]

Antony

Ok, thanks, but this setup with the NATed router worked with kernel 
2.2.17, so where is the difference?

Regards
Wim

Antony Stone wrote:

>On Thursday 19 February 2004 11:53 am, Wim Ceulemans wrote:
>
>  
>
>>Hi
>>
>>We have noticed a problem with PPTP forwarding not working as it should.
>>
>>We have a system on kernel 2.4.24 with latest pom and iptables 1.2.9.
>>There is a port forwarding PPTP to a windows 2000 server behind the
>>firewall.
>>
>>We noticed that when someone connects with PPTP the connection is closed
>>after 3 to 4 minutes. This problem only occurs if there is a router in
>>nat mode between the firewall and the internet. If the public ip is on
>>the firewall then this problem does not occur.
>>    
>>
>
>You cannot operate PPTP across a NATted connection without a special helper 
>module (hence your need for pom as stated above).
>
>If the other nat-mode router does not have a suitable helper for PPTP then you 
>can't use this combination.
>
>Regards,
>
>Antony.
>
>  
>


-- 
Wim Ceulemans
R&D Engineer

Secure Internet Communication with aXs Guard

aXs GUARD "à la Carte" at Infosecurity
Brussels Kart Expo
10-11 March 2004
stand 1.C.060
FREE registration click here:
http://www.databadge.nl/isbe2004/reg/reg.php?link=d9ca37ba1cb635dc2061

Able NV
Leuvensesteenweg 282 - B-3190 Boortmeerbeek - Belgium
Phone: + 32 15 50.44.00 - Fax: + 32 15 50.44.09
E-mail: wim.ceulemans@able.be


--
---
Security check and anti-virus control on this e-mail has been done by aXs GUARD (http://www.axsguard.com)

Re: PPTP port forwarding

[Antony Stone]

On Thursday 19 February 2004 1:32 pm, Wim Ceulemans wrote:

> Antony
>
> Ok, thanks, but this setup with the NATed router worked with kernel
> 2.2.17, so where is the difference?

You were using netfilter/iptables under kernel 2.2.17 ???

I think in fact that would have been ipchains, which works very differently.

Regards,

Antony.

-- 
This is not a rehearsal.
This is Real Life.

                                                     Please reply to the list;
                                                           please don't CC me.