I'm setting up port forwarding for an L2TP VPN connection to the local Windows 2003 VPN server. The router is a simpel Debian machine with iptables. The VPN server works perfect. But I cannot log in from the WAN. I'm missing something.

The VPN server is using a pre-shared key (L2TP) and give's out an IP in the range: Local network range is

I added the route: with route add -net netmask gw (the vpn server)

iptables -t nat -A PREROUTING -p udp --dport 1701 -i eth0 -j DNAT --to
iptables -A FORWARD -p udp --dport 1701 -j ACCEPT
iptables -t nat -A PREROUTING -p udp --dport 500 -i eth0 -j DNAT --to
iptables -A FORWARD -p udp --dport 500 -j ACCEPT
iptables -t nat -A PREROUTING -p udp --dport 4500 -i eth0 -j DNAT --to
iptables -A FORWARD -p udp --dport 4500 -j ACCEPT
iptables -t nat -A PREROUTING -p 50 -j DNAT --to
iptables -A FORWARD -p 50 -j ACCEPT
iptables -t nat -A PREROUTING -p 51 -j DNAT --to
iptables -A FORWARD -p 51 -j ACCEPT

The whole iptables script is (without the line's from above):

    echo 1 > /proc/sys/net/ipv4/ip_forward
    echo 1 > /proc/sys/net/ipv4/tcp_syncookies

            #Flush table's
            iptables -F INPUT
            iptables -F OUTPUT
            iptables -F FORWARD
            iptables -t nat -F

            #Drop traffic
            iptables -P INPUT DROP
            iptables -P FORWARD DROP
            iptables -P OUTPUT ACCEPT

            #verkeer naar buiten toe laten en nat aanzetten
            iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
            iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
            iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

            #RDP forward voor windows servers
            iptables -t nat -A PREROUTING -p tcp --dport 3389 -i eth0 -j DNAT --to
            iptables -A FORWARD -p tcp --dport 3389 -j ACCEPT
            iptables -t nat -A PREROUTING -p tcp --dport 3340  -i eth0 -j DNAT --to
            iptables -A FORWARD -p tcp --dport 3340 -j ACCEPT

            #toestaan SSH verkeer
            iptables -t nat -A PREROUTING -p tcp --dport 22 -i eth0 -j DNAT --to-destination
            iptables -A INPUT -p tcp --dport 22 -j ACCEPT

            #toestaan verkeer loopback
            iptables -A INPUT -i lo -j ACCEPT

            #toestaan lokaal netwerk
            iptables -A INPUT -i eth1 -j ACCEPT

            #accepteren established traffic
            iptables -A INPUT -i eth0 --match state --state RELATED,ESTABLISHED -j ACCEPT

        #droppen ICMP boodschappen
        iptables -A INPUT -p icmp -i eth0 -m limit --limit 10/minute -j ACCEPT
        iptables -A INPUT -p icmp -i eth0 -j REJECT

    ifconfig eth1
    ifconfig eth0 XXXXXXXXXXXXX/30
    ifconfig eth0 up
    ifconfig eth1 up
    route add default gw XXXXXXXXXXXXXXXXXXX
    route add -net netmask gw

Please run a tcpdump session while doing the test and also look at the counters from iptables -L -nv before and after the test.


The solution: iptables -A FORWARD -p udp --sport 1701 -j ACCEPT


If you are behind a Firewall and NAT you might be looking for: http://support.microsoft.com/kb/885407/en-us

  • Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Scott Pack Nov 5 '12 at 18:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.