I have network situation like this:
- ISP Router (modem) - device given to us by our ISP - modem & router in one but it is set into transparent mode - ISP say so ;D we have to find it that it is true :)
- MikroTik Router (MTR) - our edge router with firewall
- Server NAS & VPN Server (NAS) - Synology box with our data storage and also with VPN server with running PPTP, OpenVPN, L2TP/IPSec services- to which workers from our local company and from remote location conect to get data
- Local station (LS) - workers at our network site - they are using Windows 8 which means they use PPTP
- Remote station (RS) - workers at remote site behind different ISP`s
Bellow I present our Mikrotik configuration:
Routing table:
Dst. address | Gateway | Distance | Pref. source |
0.0.0.0/0 | 1.1.1.9 | 2 | - |
1.1.1.8/30 | ether1 | - | 1.1.1.8/30 |
192.168.1.0/24 | bridge local | - | 192.168.1.0/24 |
Firewall:
Action | Chain | Dst. Address | Protocol | Dst. Port |
accept | input | 192.168.1.230 | 6 (TCP) | 1723 |
accept | input | 192.168.1.230 | 47 (GRE) | - |
accept | input | 192.168.1.230 | 6 (TCP) | 5006 |
NAT:
Action | Chain | Source Addr | Dst Address | Proto | Dst Port | Out Intf |
masquerade | srcnat | - | - | - | - | ether1 |
dstnat | dstnat | - | 1.1.1.9 | 6 (TCP) | 1723 | - |
dstnat | dstnat | - | 1.1.1.9 | 47 (GRE) | - | - |
dstnat | dstnat | - | 1.1.1.9 | 6 (TCP) | 5006 | - |
masquerade | srcnat | 192.168.1.0/24 | 192.168.1.230 | - | - | - |
The last rule is used to avoid hairpin occurrence
Rules at Mikrotik are made for now only for PPTP protocol !!!
Our LS have no problem to connect to to NAS within PPTP VPN tunel. The problem starts when our RS workers from different locations trying to get VPN tunnel to our NAS. They receive a Windows 619 VPN error code.
I made some tests.
I connected directly from ISP site and I eliminated ISP modem and host which I used to the test (it had 1.1.1.9 IP addr. and gateway 1.1.1.10) and it worked fine - but in the NAT rules at MTR were set 1.1.1.10 destinations addresses not 1.1.1.9 like now.
I changed it because when I use what.is.my.ip I received our public address within 1.1.1.9 - I also use this adres in dynDNS. That why I changed it.
So when there is 1.1.1.10 there is no problem to get VPN tunel (only remotes had them - so it could be port blocking at ISP site I think) but when I use 1.1.1.9 in NAT rules also my host acting like a ISP modem get 619 error code.
Today they get 800 VPN error code instead of 619 :/
What could be the cause of my problem ?
Why it works from our side when I use 1.1.1.10 and I get error using 1.1.1.9 in NAT table ?