7

I have network situation like this:

Problem with VPN tunel from remote location through ISP (PPTP)

  • ISP Router (modem) - device given to us by our ISP - modem & router in one but it is set into transparent mode - ISP say so ;D we have to find it that it is true :)
  • MikroTik Router (MTR) - our edge router with firewall
  • Server NAS & VPN Server (NAS) - Synology box with our data storage and also with VPN server with running PPTP, OpenVPN, L2TP/IPSec services- to which workers from our local company and from remote location conect to get data
  • Local station (LS) - workers at our network site - they are using Windows 8 which means they use PPTP
  • Remote station (RS) - workers at remote site behind different ISP`s

Bellow I present our Mikrotik configuration:

Routing table:

Dst. address   | Gateway      | Distance | Pref. source   |
0.0.0.0/0      | 1.1.1.9      | 2        | -              |
1.1.1.8/30     | ether1       | -        | 1.1.1.8/30     |
192.168.1.0/24 | bridge local | -        | 192.168.1.0/24 |

Firewall:

Action | Chain | Dst. Address  | Protocol | Dst. Port |
accept | input | 192.168.1.230 | 6 (TCP)  | 1723      |
accept | input | 192.168.1.230 | 47 (GRE) | -         |
accept | input | 192.168.1.230 | 6 (TCP)  | 5006      |

NAT:

Action     | Chain  | Source Addr    | Dst Address   | Proto    | Dst Port | Out Intf   |
masquerade | srcnat | -              | -             | -        | -        | ether1     |
dstnat     | dstnat | -              | 1.1.1.9       | 6 (TCP)  | 1723     | -          |
dstnat     | dstnat | -              | 1.1.1.9       | 47 (GRE) | -        | -          |
dstnat     | dstnat | -              | 1.1.1.9       | 6 (TCP)  | 5006     | -          |
masquerade | srcnat | 192.168.1.0/24 | 192.168.1.230 | -        | -        | -          |

The last rule is used to avoid hairpin occurrence

Rules at Mikrotik are made for now only for PPTP protocol !!!

Our LS have no problem to connect to to NAS within PPTP VPN tunel. The problem starts when our RS workers from different locations trying to get VPN tunnel to our NAS. They receive a Windows 619 VPN error code.

I made some tests.

I connected directly from ISP site and I eliminated ISP modem and host which I used to the test (it had 1.1.1.9 IP addr. and gateway 1.1.1.10) and it worked fine - but in the NAT rules at MTR were set 1.1.1.10 destinations addresses not 1.1.1.9 like now.

I changed it because when I use what.is.my.ip I received our public address within 1.1.1.9 - I also use this adres in dynDNS. That why I changed it.

So when there is 1.1.1.10 there is no problem to get VPN tunel (only remotes had them - so it could be port blocking at ISP site I think) but when I use 1.1.1.9 in NAT rules also my host acting like a ISP modem get 619 error code.

Today they get 800 VPN error code instead of 619 :/

What could be the cause of my problem ?

Why it works from our side when I use 1.1.1.10 and I get error using 1.1.1.9 in NAT table ?

Improve this question
0

1 Answer 1

Reset to default
4

Why it works from our side when I use 1.1.1.10 and I get error using 1.1.1.9 in NAT table?

You have a problem with the 1.1.1.9 configuration as an external NAT IP on the Mikrotik. The outside interface of the Mikrotik is a /30; you're using 1.1.1.9/30 as the default gateway and an outside NAT IP on the Mikrotik. If you're going to use 1.1.1.9/30 on the Mikrotik, you need 1.1.1.10 as a default-gateway.

As it stands, you're currently using 1.1.1.9 as both default-gateway and external NAT IP.

Current Routing table:

Dst. address   | Gateway      | Distance | Pref. source   |
0.0.0.0/0      | 1.1.1.9      | 2        | -              |

Current NAT table:

Action     | Chain  | Source Addr    | Dst Address   | Proto    | Dst Port | Out Intf   |
masquerade | srcnat | -              | -             | -        | -        | ether1     |
dstnat     | dstnat | -              | 1.1.1.9       | 6 (TCP)  | 1723     | -          |
dstnat     | dstnat | -              | 1.1.1.9       | 47 (GRE) | -        | -          |
dstnat     | dstnat | -              | 1.1.1.9       | 6 (TCP)  | 5006     | -          |
masquerade | srcnat | 192.168.1.0/24 | 192.168.1.230 | -        | -        | -          |

What's a little confusing is the diagram, which says the ISP-A's router is in transparent "modem state". Please be sure that the IP addressing scheme you're using on the Mikrotik is consistent with ISP-A's expectations. If the router is transparent, I'm not entirely sure you should have an IP address on it.

Improve this answer
5
  • Yes I`m sure because network pool is given to us by our ISP.
    – DDos Schwagins
    Jul 14, 2014 at 9:46
  • 1
    Well, the Mikrotik is misconfigured as long as you use 1.1.1.9 as both default-gateway and external NAT IP on the Mikrotik
    – Mike Pennington
    Jul 14, 2014 at 9:47
  • When I changed default gateway from 1.1.1.9 to 1.1.1.10 I lost connectivity to the Internet from my MTR and whole LAN. SO If I want to use 1.1.1.9 IP addres I have to leave 1.1.1.9 in NAT table and change in routing table default gateway to 1.1.1.10 ? I`m I correct ?
    – DDos Schwagins
    Jul 14, 2014 at 9:50
  • Please join me in chat
    – Mike Pennington
    Jul 14, 2014 at 9:55
  • Like You advised I returned to old settings and now we are able to establish VPN tunel :) Thank You !
    – DDos Schwagins
    Jul 14, 2014 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.