Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




295 posts

Ultimate Geek
+1 received by user: 7


Topic # 196610 6-Jun-2016 17:05
Send private message

Hey all.

 

 

 

Have replaced an aging WRT54GL running Tomato with a newer AC1900 which Ive got Advanced Tomato running on.

 

Behind this I have a Win2k8 server and Im wanting to VPN into it.  Was working fine with the necessary port forwarding and mod to the iptables, but I just cant get it working on the new touter.

 

Has anyone got a similar system working well and can prod me in the right direction?

 

 

 

Cheers

 

 

 

Craig


Filter this topic showing only the reply marked as answer Create new topic
2474 posts

Uber Geek
+1 received by user: 884

Trusted
Lifetime subscriber

  Reply # 1566614 6-Jun-2016 17:10
Send private message

Google for OpenVPN and OpenWRT and plenty of examples come up.







295 posts

Ultimate Geek
+1 received by user: 7


  Reply # 1566617 6-Jun-2016 17:14
Send private message

BarTender: Google for OpenVPN and OpenWRT and plenty of examples come up.

 

 

 

Sorry  may not have been quite detailed enough.  I dont want to VPN onto the router, Im trying pass through it to the Win2k8 server in behind.

 

Ive got all the necessary ports forwarded, but Im guessing GRE isnt.  

 

 

 

Ive tried vatious combinations of:

 

 

 

iptables -t nat -I PREROUTING -p 47 -j DNAT --to 10.0.0.12
iptables -I wanin -p 47 -d 10.0.0.12 -j logaccept
iptables -I INPUT -s 111.221.29.161 -j DROP

 


iptables -A INPUT -p tcp —dport 1723 -j ACCEPT
iptables -A INPUT -p gre -j ACCEPT
iptables -A INPUT -i ppp+ -j ACCEPT
iptables -A FORWARD -i ppp+ -j ACCEPT
iptables -A FORWARD -o ppp+ -j ACCEPT

 

iptables -t nat -I PREROUTING -p tcp —dport 1723 -j ACCEPT
iptables -I INPUT -p tcp —dport 1723 -j ACCEPT
iptables -I INPUT -i ppp+ -j ACCEPT
iptables -I FORWARD -i ppp+ -j ACCEPT

 

and
iptables -I INPUT 1 -p tcp —dport 1723 -j ACCEPT

 

 

 

but nothing works.


 
 
 
 


470 posts

Ultimate Geek
+1 received by user: 116

Lifetime subscriber

  Reply # 1567378 7-Jun-2016 19:12
Send private message

Probably not any help to you, but quite recently I had an L2TP/IPSec server sitting behind my tomato router (Shibby mod), which worked with just the appropriate port forwarding rules. 


2100 posts

Uber Geek
+1 received by user: 512


  Reply # 1567399 7-Jun-2016 19:26
Send private message

If you're client is windows, need to change registry key to allow VPN behind nat (nat-transversal).

Additionally you need to be forwarding 500, 4500 and the 17XX port if L2TP/PPTP pass through is not an option on router.

If its a NAT-T issue, and not a port forwarding issue, you'll be able to connect using Android but not Windows. If its a port forwarding issue (aka 500, 4500) you won't be able to connect at all.



295 posts

Ultimate Geek
+1 received by user: 7


  Reply # 1567453 7-Jun-2016 20:26
Send private message

 

 

Ended up being one of those "DOOOHHhhh" moments :)

 

 

 

Just so happens on the day that I installed the new router, the Win2k8 server also needed restarting ... and Routing and Remote Access service didnt auto start!!!

 

So Id been testing against a dead end! Found out when I put the old router back online and VPN's still wouldnt work.

 

SO I had the standard VPN port forwarding, and then added to the Firewall Scripts:

 

 

 

iptables -t nat -I PREROUTING -p 47 -j DNAT --to 10.0.0.12
iptables -I wanin -p 47 -d 10.0.0.12 -j logaccept
iptables -I INPUT -s 111.221.29.161 -j DROP

 

 

 

and all was good! :)


Filter this topic showing only the reply marked as answer Create new topic



Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.