Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to ask if I'm looking in the right direction. We have:

  • 1 x VPN server (Windows SBS 2003)
  • 5 x VPN users (One Public IP)

Currently, from our remote office, only one user at a time is able to connect the the VPN as when others try to connect simultaneously the connections fail.

I'm not a networking guy but I'm assuming this is because the VPN server gets confused about where to send packets or the like.

I'd seen mentioned elsewhere pfSense .. and this seemed to indicate I could use it to route VPN connections, rather than Windows - and it will handle mutliple users from the same external IP.

Is this correct; is pfSense a solution to this problem? (ie: ditching the Windows VPN and using pfSense instead).

share|improve this question
    
Is there snatting on the gateway the 5 VPN users use? –  Robbie Mckennie Jul 19 '13 at 7:35
    
Under the 'Routing and Remote Access' settings, Nat/Basic Firewall, it has been setup to currently say 'Basic Firewall Only' .. the setting 'Enable NAT on this interface' is not enabled. –  pierre Jul 19 '13 at 7:44
    
I assume this is the interface on your router? Another question, can these clients all access the internet at the same time? –  Robbie Mckennie Jul 19 '13 at 8:04
    
What subnets are there at the remote offices? are they they all the same or different? –  GeoSword Jul 19 '13 at 8:36
    
They can all access the Internet at once, and they are on different subnets. –  pierre Jul 19 '13 at 10:19
add comment

1 Answer 1

up vote 2 down vote accepted

TL;DR: If you use IPsec: try disabling "IPsec passthrough", on the NAT router in your remote office. I.e. the box that the VPN clients are behind, and which owns the single public IP.

I think that's your real problem. Switching to pfsense with the exact same VPN protocol wouldn't help it.


You should say which VPN protocol you're using at the moment (IPsec?). I assume you're using all software built into Windows, or you'd have mentioned it...

You're right to flag "one public IP" as an issue. NAPT (NAT) needs to handle each IP protocol being used. If the VPN protocol runs directly over IP, it will be subject to limitations of the NAPT box at the remote office. Limitations like a maximum of one connection at any time - I'm sure I've seen this in home routers.

Some Passthroughs are limited to one VPN tunnel at a time; other implementations use fields like IPsec SPI to multiplex several tunnels through one NAT-ing device. VPN Passthrough isn't a standard and behavior varies by product. Cite - quote is not really paywalled - just scroll down.

In that case you want to run your VPN protocol over UDP/IP, instead of directly over IP. This is often labelled NAT-T, for "NAT Traversal". (And unlike VPN passthrough it's a standard).

To force NAT-T, try configuring your NAPT box to block VPN over IP. In other words, disable the "VPN passthrough" feature. VPN clients will then have to use NAT-T. Windows IPsec client and server 2003 should support this out of the box. As per the client link above, you may need to ensure the the VPN server has a public IP address of its own. ("NAT-T ... has been disabled by default for the case when the VPN server is also behind a NAT device").

Alternatively replace your NAT box, with one that does support passthrough of your VPN protocol with as many connections as you need :).

The same problem would apply to PPTP, but worse because you can't run it over UDP. (Please don't use PPTP, it's not secure).

share|improve this answer
    
Thank you for the thorough explanation. I'll look into making the changes suggested. –  pierre Jul 19 '13 at 10:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.