Tag Info

Hot answers tagged

6

If you look at the route table with route print does it show things correctly when you have the /23 route? Does a traceroute show the traffic trying to leave the correct interface? Some times what you see in the Windows GUI does not reflect what Windows is actually doing. I find that it is always best to double check from the command line.


5

Yes, solicited traffic is traffic that was initiated by you. Solicited traffic automatically gets a pass, no matter the port, because you initiated it. This alleviates a lot of the headaches of traditional firewalls, e.g., having to open up ALL the ephemeral ports, because Windows Firewall will keep track of the session state for you.


5

Locked the keys in the car, eh? I don't believe that one is configurable via Group Policy. Periodic policy refresh isn't going to help you run a script or install software on the machine since both of those operations only occur on a synchronous policy refresh (i.e. a reboot). I think you're going to be stuck laying hands on the machine. I've forgotten ...


5

You have to erase these invalid future entries. Use rrddump to export your rra to an XML file, then edit the XML file. Set all the future time to NaN, and set the lastupdate to 0. Restore the RRD files using rrdrestore. Note, however, that depending on how far ahead your clock was set, you may have lost all your data! For a 5 minute average over a day, ...


4

This is the same question as "Windows 7, network connection with no default gateway: any way to change the “Unknown network” status?". Short answer is: this is normal behavior. Unfortunately you won't be able to make the "unidentified network" message go away unless you specify a default gateway on the adapter. The specified gateway must respond to ARP ...


4

You mentioned that you cannot access your server "from a location outside the house". Does it mean that you cannot access your home server from any location, or just from work? If you cannot establish an RDP session to your server from any location, and assuming that everything is properly configured, I'd suggest switching RDP default port (3389) to ...


4

Exchange servers can only be exchange servers. Do not install any other roles on them. It's not supported, and as you've noticed - it won't work.


4

Performance for any VPN solution is typically limited by the available bandwidth between the clients and the termination point. Unless you have an extraordinarily large pipe and a significant amount of remote users (thousands), it's not going to make a difference. And if you do have that volume, you should look at load-balanced VPN concentrators rather than ...


3

If your proxy can also route traffic, you can just configure RRAS to route all traffic from the NAT interface to the proxy. If your proxy does not route, then you should use something like GPO to enforce proxy settings on browsers inside of your network and block outbound traffic that does not go through the proxy at your firewall.


3

I found them at c:\Windows\System32\LogFiles - The RRAS logs are in form INI####. Also of note, you need to have logging turned on for RRAS if you want this to work properly. Directions on how to do so are over here: http://technet.microsoft.com/en-us/library/ee922651(v=ws.10).aspx


3

What you're looking for is called "hairpin NAT", and Microsoft's NAT implementation doesn't appear to support it. Packets that aren't traversing the NAT'd interface don't get NAT applied (i.e. sourcing from the private or local interface, destined for the private interface). Microsoft's documentation isn't particularly clear about it (that I've ever been ...


3

This is a pretty straightforward configuration. While you can use your Windows Server machine to perform network address translation for the PCs on your network, I'd recommend purchasing a NAT firewall / router device. One of the consumer-grade Linksys devices, for example, would suit you fine. To configure your Windows Server machine to act as a NAT router ...


3

Check for IP address conflicts. I had exactly the same problem for hours before I figured it out.


3

I can think of two solutions-- one at layer 3 and one at layer 7. I'd consider getting a hosted server somewhere w/ a static IP address and hosting something like OpenVPN there. You can deploy an OpenVPN configuration that causes any access to the API to be routed across the OpenVPN to the hosted server with the static IP, whereupon you can NAT it to that ...


3

What model is the Cisco? Depending on the Cisco hardware involved it might be easier to just terminate the RRAS there rather than trying to pass it along as SIP to some sort of virtual modem bank. But you didn't supply a model number for the existing hardware. Updated based on comment providing model information: I'm not sure I see any good reason to ...


2

You should be able to use Routing and Remote Access (RRAS) on both servers to setup a VPN connection between the two. You can set the connections as "Persistent" and they will automatically connect the VPN at startup. I have tested this with a 2003 Server on Rackspace at one end and a Watchguard Firebox X20e on the other end, communicating over a PPTP VPN. ...


2

Create a virtual switch in ESXi for your "internal" network. Give your "internal" VMs a single virtual network adapter and connect it to the internal virtual switch. Give your "router" VM two network adapters; connect one to the internal virtual switch, connect the other to whatever virtual switch you're using to access your "real" network. Choose an IP ...


2

Check the External Inbound/Outbound Packet Filters - most likely it enabled highly restrictive filters that just allow inbound/outbound VPN traffic (that's what it did on mine). Open the RRAS console, expand IPv4, click General, right click your External interface->Properties. Check the inbound/outbound filters. You're probably going to want to add ICMP to ...


2

I too found (following Dan's answer - +1) that restrictive filters were added when I installed RRAS on my new Windows Server 2008 R2 machine. Looking at the same thing on Windows Server 2003, no such filters were added by default. To restore the ability to ping the machine (or RDP in, or pretty much anything else) I first just unticked Enable IP Router ...


2

Reason: Authentication failed due to a user credentials mismatch. Either the user name provided does not map to an existing user account or the password was incorrect. I think that's your problem right there. Verify that the account has the correct permissions to connect remotely via RRAS. These links might help you. Note that ...


2

I had an identical experience, but we also had a 24-bit subnet mask on our LAN and were running out of IP addresses. RRAS grabs addresses from DHCP in blocks of 10, and I discovered that our DHCP server wasn't configured to check with DNS to ensure that addresses were truly available before handing them out....which was a problem in our address-starved ...


2

For the gateways on the member machines i have set no gateway That would be exactly why you can't ping outside the subnet -- the gateway is the default route, and you don't have one.


2

Yes, this definitely sounds like an issue with their router. GRE or Generic Route Encapsulation protocol is used in point to point tunneling and uses TCP port 1723 and IP protocol 47. In order to fix it the user needs to enable enable PPTP/GRE pass through. I do know that alot of lower end Linksys routers do not allow you to enable this, I'm sure there are ...


2

It seems that Windows RRAS cannot do what I want, instead those real ip addresses will be connected via nat on RRAS. I give up finally and have a CentOS setup providing the routing/nat for the network.


2

Without looking at what the AT&T one can do, you should be able to disable the DHCP on it and have the Win server hand out all the IP's. I actually do it the other way and have my router hand out the IP's, but I can specify the DNS to use with the DHCP so the DNS it has the workstations pointing to is the Win server. The Win server doesn't have a ...


2

Massimo pretty much answered this question in another post: You can use RRAS for firewalling, NAT and VPN, so, yes, you can give a single public IP address to your Windows Server 2008 firewall and have it route traffic for all your internal network and forward specific ports (f.e. 80) to your internal servers, and you can also have it act like a VPN ...


2

You're looking for the Connection Manager Administation Kit. You can use this tool to create a program to automatically configure client computers with a "connection" to your VPN server. It's actaully rather nice to use. We take the output from the CMAK and deploy it onto clients with startup scripts, but you could definitely email the resulting program (or ...


2

Windows Firewall/ICS and RRAS often don't play nice with each other. It has something to do with an IPNAT.sys conflict as mentioned in that article. If you don't want Windows Firewall running on that box at all, your best bet will be to do the following: Disable RRAS (temporarily) by going to Administrative Tools -> RRAS, right click on your server name, ...


2

A couple of things to try without seeing your full event log: Try backing up your registry and then deleting the following key: HKEY_LOCAL_MACHINE\System\currentcontrolset\services\remoteaccess\routermanagers\IPV6 and then rebooting. Try removing the RRAS role completely from the server in Server Manager Roles and rebooting then re-adding the RRAS role. ...


2

You could change the priority of a process in Task Manager on the Processes tab. You would right click and choose Set Priority. The RRAS service is likely run through svchost.exe but I don't have a machine up and running to check that. You could go to the service and go to properties to see the path to the executable. However, you don't really provide ...



Only top voted, non community-wiki answers of a minimum length are eligible