Hot answers tagged

14

Let's suppose your AWS is reachable via SSH at IP "your.ec2.ip.address". Let's suppose your office network has Internet access via a router that apply some NAT translations and, as such, your office PCs are seen, on the Internet, with IP "your.office.external.ip". Let's also suppose that you are located OUTSIDE of your office, with your laptop connected ...


9

If you're that concerned about it, why not go for peace of mind and set up an openvpn connection? They are quite simple to set up, and if anything were to go wrong (as far as a compromise is concerned), using a more secure set up will help prove you weren't criminally negligent. It's a sad but real truth that you need to cover you butt when dealing with ...


7

You can use the command last |grep ppp The above command uses last to display all logins of users. As all PPTP VPN are connected through ppp0 / ppp1 / pp2 / ... , you can get VPN user access history. Sample result: root@www:~# last |grep ppp user1 ppp0 <client-IP-address> Mon Jul 7 23:45 still logged in user2 ppp0 <client-...


5

That sums it up.


5

Attention that unfortunatly SSTP (as of November 2011) will not work over a proxy server with authentication. This is documented, although not many realize it. It is also possible for the network administrator for a non-authenticating proxy to detect SSTP headers and drop the connections. So the statement that it goes across any firewall, etc... is true ...


5

The stock ASA configuration does not include support for PPTP passthrough by default -- crazy as to why. Cisco TAC likely gets a handful of cases related to this... There are at most three things required to get PPTP working through an ASA If server is behind ASA Configure necessary NAT/PAT if using NAT/PAT (Optional but usually required) ACL permit TCP/...


5

It should be noted that a new attack on MS-CHAPv2 by Moxie Marlinspike and David Hulton makes PPTP tunnels less desirable. Based on this I would go with an IPSEC or SSL VPN based tunnel for remote access. More info: Infosecurity Article Covering Attack IT Security Article Covering Attack


5

You don't really seem to have the GRE protocol enabled, from what I can see. You have port 47 TCP allowed, but that's not the same. Your rc.local rules regarding GRE seem fine but are probably being overwritten, so add those rules in your firewall system proper. You also have a DROP policy for forwarding packets - add this rule as a mininum: iptables -A ...


5

VPN Client Test Check you can ping from client to vpn server ping 10.0.0.1 Check you can ping google by IP ping 8.8.8.8 Check you can ping google by name ping google.com If 1 failed, pptp has issue. If 1,2 succeeded but 3 failed, it is dns issue. Goto Step 1 in next section. If 1 succeeded but 2 failed, properly routing issue. Goto Step 2 in next ...


5

What you've essentially done is setup a VPN AND setup RDP access through the firewall (opening port 3389 to the world). You shouldn't allow RDP access through the firewall at all if you want to limit it to VPN users. Disable that rule completely for RDP. Then...A user will VPN in using the VPN tunnel you setup and THEN rdp into "system A". The VPN puts ...


4

This could be a firewall problem. Check that you are allowing the correct traffic into your VPN Server, specifically you need to permit TCP 1723 and Protocol 47 (GRE) before PPTP will work correctly. The problem you see in your log can be caused by GRE not being correctly relayed from your firewall. You might also need to add mppe-stateful to your pptpd-...


4

There is no way to push routes from a PPTP server. The connection is established and configured using IPCP, the PPP Internet Protocol Control Protocol defined in RFC 1332. In fact, its very name ("Point to Point") implies that you won't find any support for routing. Which routes are available depend entirely on the client-side configuration. There are three ...


4

With 2048/512 kbit/s, you are most likely restricted by bandwidth, not by your routers hardware.


4

iThingies are picky about what exactly they need when it comes to VPN. The problem is basically, the defaults most VPN servers use for IPSec is too insecure for iThingies. Has some good tips: Error connecting to Sonicwall L2TP VPN from iPad/iPhone I had a very similar problem getting iThingies to talk to a SonicWall, and had to make some significant ...


4

What exactly is NAT "healing". What you're likely running into is a firewall timeout issue. The firewall is probably killing sessions in it's state table that have been idle for a long period of time in order to make room in the state table for other connections and to release any resources being consumed by the idle session. http://en.wikipedia.org/wiki/...


4

The OUTPUT chain only applies to locally generated packets. For packets that are routed via the system, one needs to use the FORWARD chain. So, you need to use this command: iptables -A FORWARD -m state --state NEW,ESTABLISHED,RELATED -d IP_address -j REJECT


3

There has been some time that has passed since PPTP's initial inception and rollout. These days there are also a number of application protocols which are secure within themselves (where there was not in the past). If that is the case with your specific deployment, then PPTP may adequately serve as the initial/external delivery transport.


3

I found this out msyself... PPTP Passthrough As I suspected the GRE protocol used for the tunnel with PPTP doesn't use ports. This means it can't traverse a NAT device natively. There are two versions of GRE though; the native one and an enhanced version called Enhanced GRE used specifically for PPTP. The enhanced version adds a call ID into the header. ...


3

PPTP uses PPP and GRE tunneling - quite old protocols, especially GRE which may be awkward to pass by some routers. It uses TCP port 1723. OpenVPN is more flexible - it may be set up on any UDP or TCP port. OpenVPN uses OpenSSL library with all its goods. I don't see any reason any of them could not be routed by Ubuntu server. OpenVPN is for you if: you ...


3

Your VPN connection uses MPPE encryption, but according to router's page http://www.draytek.co.uk/products/vigor2830.html - MPPE have no hardware support. Try to setup something else as encryption protocol (AES/DES/3DES). IMHO it is available only with L2TP protocol.


3

My understanding of poptop (the pptpd server) is that you are unable to specify a port number for the server without patching the source and recompiling. Having a look over the source seems to suggest similar [welby@blackpudding pptpd-1.3.4]$ fgrep PPTP_PORT -R . ./pptpmanager.c: address.sin_port = htons(PPTP_PORT); ./pptpdefs.h:#define ...


3

Those iptables rules don't allow traffic to the VPN server, so the VPN can't be established. You need the following rules in the OUTPUT chain before the final DROP rule, where 1.2.3.4 is the IP address of the VPN server. These allow TCP connections to port 1723 (the PPTP control channel) and GRE packets (the data channel). iptables --append OUTPUT --...


3

The PPTP protocol uses GRE (Generic Routing Encapsulation) for transporting the payload data. The GRE protocol unlike tcp/udp/etc has no ports that can be used to uniquely identify packets from each other that cross a NAT. The PPTP protocol does use the optional Key header to store a length, call id, and sequence number. But some NAT implementations ...


3

You should probably use IKEv2 as a primary if you have Windows Vista/7 clients and 2008r2 servers, with a fallback to SSTP if for whatever reason UDP port 500 is blocked at the client's site. SSTP has a severe performance problem in that you get TCP-in-TCP for most data traffic. This causes the "inner" TCP layer to be mis-informed about the actual packet ...


3

You're almost certainly using an OpenVZ-based VPS. In this case, the host must enable the ppp kernel module (and anything else you might need) for you. Open a support ticket with your hosting provider. If they are unable or unwilling to make this change for you, buy another VPS, that doesn't use OpenVZ, so that you can choose your own kernel modules.


3

Figured it out. The problem was giving the "auth" and "require-mschap-v2" options to pppd on the client end. Evidently only the server end must be configured to request authentication with the client configured to not request any kind of auth. What was happening was that the client asked the server to authenticate itself, which failed.


3

ifconfig should return the ppp[X] interface when you have a connected user. Use that with who and last (grep with 'ppp' to find out users who are connected via VPN) , and it should provide plenty of information to cross reference.


3

You should get site 2 a permanent, reliable internet connection and use a permanent site to site VPN. You'll need a router each side capable of doing so, though.


3

It seems, with the ping functioning, that the problem is with your MTU being too high, as the VPN adds headers, it means packets are getting fragmented and dropped. To adjust the MTU on your mac, open System Preferences > Network > [your connection] > Advanced > Hardware > Configure: {Manually,Automatically} There you will see if it is configured ...


3

Try: remoteip 192.168.0.2-254,192.168.1.2-254 The annotation in the pptpd.conf file is weird.


Only top voted, non community-wiki answers of a minimum length are eligible