Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I properly route VPN traffic past two firewalls?

  • Network setup: DSL Modem/Gateway/Router(FW1) >> Router(FW2) >> VPN Server
  • Ports open on both routers/firewalls:
    • L2TP (UDP 500, 1701, 4500)
    • PPTP (TCP 1723)

FW1: 192.168.1.x FW2: 192.168.2.x (VPN server is on this network)

Am I missing support for other protocols through the firewall (non-port related)? If I DMZ FW2 from FW1, then user can connect. <-- Is this the only solution?

share|improve this question
up vote 0 down vote accepted

Using double NAT causes problems with VPN and is bad practice in general. I would remove FW2 or change it to bridge mode. Either way, you need to eliminate the double NAT situation.

share|improve this answer
Apologies for the belated response. Double NAT was indeed the issue. Fixed now. Of course, the server died as soon as I got this figured out. Off to new challenges. – Crusty Barnacle Sep 9 '12 at 17:37

Maybe, should you start by checking /private/var/log/ppp/ on the client and /var/log/ppp/vpn.log on the server

Also the official documentation notices : "When configuring VPN,make sure the firewall allows VPN traffic on needed ports with the following settings: Enable GRE, ESP, VPN L2TP (port 1701), and VPN ISAKMP/IKE (port 500)." (

Might be related to those two protocols so: GRE ESP

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.