Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do I properly route VPN traffic past two firewalls?

  • Network setup: DSL Modem/Gateway/Router(FW1) >> Router(FW2) >> VPN Server
  • Ports open on both routers/firewalls:
    • L2TP (UDP 500, 1701, 4500)
    • PPTP (TCP 1723)

FW1: 192.168.1.x FW2: 192.168.2.x (VPN server is on this network)

Am I missing support for other protocols through the firewall (non-port related)? If I DMZ FW2 from FW1, then user can connect. <-- Is this the only solution?

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

Using double NAT causes problems with VPN and is bad practice in general. I would remove FW2 or change it to bridge mode. Either way, you need to eliminate the double NAT situation.

share|improve this answer
    
Apologies for the belated response. Double NAT was indeed the issue. Fixed now. Of course, the server died as soon as I got this figured out. Off to new challenges. –  Crusty Barnacle Sep 9 '12 at 17:37
add comment

Maybe, should you start by checking /private/var/log/ppp/ on the client and /var/log/ppp/vpn.log on the server

Also the official documentation notices : "When configuring VPN,make sure the firewall allows VPN traffic on needed ports with the following settings: Enable GRE, ESP, VPN L2TP (port 1701), and VPN ISAKMP/IKE (port 500)." (http://manuals.info.apple.com/en_US/NetworkSvcs_v10.6.pdf)

Might be related to those two protocols so: GRE ESP

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.