Take the 2-minute tour ×
Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.

I have network situation like this:

Network situation

  • ISP Router (modem) - device given to us by our ISP - modem & router in one but it is set into transparent mode - ISP say so ;D we have to find it that it is true :)
  • MikroTik Router (MTR) - our edge router with firewall
  • Server NAS & VPN Server (NAS) - Synology box with our data storage and also with VPN server with running PPTP, OpenVPN, L2TP/IPSec services- to which workers from our local company and from remote location conect to get data
  • Local station (LS) - workers at our network site - they are using Windows 8 which means they use PPTP
  • Remote station (RS) - workers at remote site behind different ISP`s

Bellow I present our Mikrotik configuration:

Routing table:

Dst. address   | Gateway      | Distance | Pref. source   |
0.0.0.0/0      | 1.1.1.9      | 2        | -              |
1.1.1.8/30     | ether1       | -        | 1.1.1.8/30     |
192.168.1.0/24 | bridge local | -        | 192.168.1.0/24 |

Firewall:

Action | Chain | Dst. Address  | Protocol | Dst. Port |
accept | input | 192.168.1.230 | 6 (TCP)  | 1723      |
accept | input | 192.168.1.230 | 47 (GRE) | -         |
accept | input | 192.168.1.230 | 6 (TCP)  | 5006      |

NAT:

Action     | Chain  | Source Addr    | Dst Address   | Proto    | Dst Port | Out Intf   |
masquerade | srcnat | -              | -             | -        | -        | ether1     |
dstnat     | dstnat | -              | 1.1.1.9       | 6 (TCP)  | 1723     | -          |
dstnat     | dstnat | -              | 1.1.1.9       | 47 (GRE) | -        | -          |
dstnat     | dstnat | -              | 1.1.1.9       | 6 (TCP)  | 5006     | -          |
masquerade | srcnat | 192.168.1.0/24 | 192.168.1.230 | -        | -        | -          |

The last rule is used to avoid hairpin occurrence

Rules at Mikrotik are made for now only for PPTP protocol !!!


Our LS have no problem to connect to to NAS within PPTP VPN tunel. The problem starts when our RS workers from different locations trying to get VPN tunnel to our NAS. They receive a Windows 619 VPN error code.


I made some tests.

I connected directly from ISP site and I eliminated ISP modem and host which I used to the test (it had 1.1.1.9 IP addr. and gateway 1.1.1.10) and it worked fine - but in the NAT rules at MTR were set 1.1.1.10 destinations addresses not 1.1.1.9 like now.

I changed it because when I use what.is.my.ip I received our public address within 1.1.1.9 - I also use this adres in dynDNS. That why I changed it.

So when there is 1.1.1.10 there is no problem to get VPN tunel (only remotes had them - so it could be port blocking at ISP site I think) but when I use 1.1.1.9 in NAT rules also my host acting like a ISP modem get 619 error code.

Today they get 800 VPN error code instead of 619 :/

What could be the cause of my problem ?

Why it works from our side when I use 1.1.1.10 and I get error using 1.1.1.9 in NAT table ?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Why it works from our side when I use 1.1.1.10 and I get error using 1.1.1.9 in NAT table?

You have a problem with the 1.1.1.9 configuration as an external NAT IP on the Mikrotik. The outside interface of the Mikrotik is a /30; you're using 1.1.1.9/30 as the default gateway and an outside NAT IP on the Mikrotik. If you're going to use 1.1.1.9/30 on the Mikrotik, you need 1.1.1.10 as a default-gateway.

As it stands, you're currently using 1.1.1.9 as both default-gateway and external NAT IP.

Current Routing table:

Dst. address   | Gateway      | Distance | Pref. source   |
0.0.0.0/0      | 1.1.1.9      | 2        | -              |

Current NAT table:

Action     | Chain  | Source Addr    | Dst Address   | Proto    | Dst Port | Out Intf   |
masquerade | srcnat | -              | -             | -        | -        | ether1     |
dstnat     | dstnat | -              | 1.1.1.9       | 6 (TCP)  | 1723     | -          |
dstnat     | dstnat | -              | 1.1.1.9       | 47 (GRE) | -        | -          |
dstnat     | dstnat | -              | 1.1.1.9       | 6 (TCP)  | 5006     | -          |
masquerade | srcnat | 192.168.1.0/24 | 192.168.1.230 | -        | -        | -          |

What's a little confusing is the diagram, which says the ISP-A's router is in transparent "modem state". Please be sure that the IP addressing scheme you're using on the Mikrotik is consistent with ISP-A's expectations. If the router is transparent, I'm not entirely sure you should have an IP address on it.

share|improve this answer
    
Yes I`m sure because network pool is given to us by our ISP. –  user3799089 Jul 14 at 9:46
1  
Well, the Mikrotik is misconfigured as long as you use 1.1.1.9 as both default-gateway and external NAT IP on the Mikrotik –  Mike Pennington Jul 14 at 9:47
    
When I changed default gateway from 1.1.1.9 to 1.1.1.10 I lost connectivity to the Internet from my MTR and whole LAN. SO If I want to use 1.1.1.9 IP addres I have to leave 1.1.1.9 in NAT table and change in routing table default gateway to 1.1.1.10 ? I`m I correct ? –  user3799089 Jul 14 at 9:50
    
Please join me in chat –  Mike Pennington Jul 14 at 9:55
    
Like You advised I returned to old settings and now we are able to establish VPN tunel :) Thank You ! –  user3799089 Jul 14 at 14:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.