2

I have a L2TP server on my LAN which I would like to access from WAN and there is a Juniper SRX standing between these two networks. I've had some success with this post: https://forums.juniper.net/t5/SRX-Services-Gateway/Destination-NAT-Port-Forwarding-Passthrough-for-VPN/td-p/264271

But while this allows me to connect to a PPTP server over port 1723, I can not reach the L2TP from outside the local network. These are the relevant part of my configuration where 111.111.111.111 is the public of an interface in the untrust zone.:

destination nat:

destination {
        pool pptp-pool {
            address 192.168.2.48/32 port 1723;
        }
        pool p500 {
            address 192.168.2.48/32 port 500;
        }
        pool p4500 {
            address 192.168.2.48/32 port 4500;
        }
        pool p1701 {
            address 192.168.2.48/32 port 1701;
        }
        rule-set l2tp-vpn {
            from interface ge-0/0/6.0;
            rule r500 {
                match {
                    destination-address 111.111.111.111/32;
                    destination-port {
                        500;
                    }
                }
                then {
                    destination-nat {
                        pool {
                            p500;
                        }
                    }
                }
            }
            rule r1701 {
                match {
                    destination-address 111.111.111.111/32;
                    destination-port {
                        1701;
                    }
                }
                then {
                    destination-nat {
                        pool {
                            p1701;
                        }
                    }
                }
            }
            rule 4500 {
                match {
                    destination-address 111.111.111.111/32;
                    destination-port {
                        4500;
                    }
                }
                then {
                    destination-nat {
                        pool {
                            p4500;
                        }
                    }
                }
            }
            rule r1723 {
                match {
                    destination-address 111.111.111.111/32;
                    destination-port {
                        1723;
                    }
                }
                then {
                    destination-nat {
                        pool {
                            pptp-pool;
                        }
                    }
                }
            }
        }
    }

security policy:

 from-zone untrust to-zone trust {
        policy vpn-access {
            match {
                source-address any;
                destination-address pd-nas;
                application any;
            }
            then {
                permit;
            }
        }
        policy untrust-to-trust {
            match {
                source-address any;
                destination-address any;
                application any;
                source-identity any;
            }
            then {
                deny;
            }
        }
    }
}

address book from trust zone

security-zone trust {
        address-book {
            address pd-nas 192.168.2.48/32;
        }
        host-inbound-traffic {
            system-services {
                all;
            }
            protocols {
                all;
            }
        }

How come this setup only works for the PPTP service? Do I need some additional setting to enable forwarding to the L2TP server?

0

Alrigth, I was wrong the issue isn't actually the configuration. I was using a router with a 4g card to test the VPN connection from an outside network. As it turns out, I can't connect to any vpn from that router, but it works from any other connection.

  • You should accept your answer so that the question doesn't keep popping up forever, looking for an answer. – Ron Maupin Apr 1 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.