VPN through TOmato Router

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › VPN through TOmato Router

thekiwi

295 posts

Ultimate Geek

#196610 6-Jun-2016 17:05

Hey all.

Have replaced an aging WRT54GL running Tomato with a newer AC1900 which Ive got Advanced Tomato running on.

Behind this I have a Win2k8 server and Im wanting to VPN into it. Was working fine with the necessary port forwarding and mod to the iptables, but I just cant get it working on the new touter.

Has anyone got a similar system working well and can prod me in the right direction?

Cheers

Craig

BarTender

3219 posts

Uber Geek

Trusted

Lifetime subscriber

#1566614 6-Jun-2016 17:10

Google for OpenVPN and OpenWRT and plenty of examples come up.

and

thekiwi

295 posts

Ultimate Geek

#1566617 6-Jun-2016 17:14

BarTender: Google for OpenVPN and OpenWRT and plenty of examples come up.

Sorry may not have been quite detailed enough. I dont want to VPN onto the router, Im trying pass through it to the Win2k8 server in behind.

Ive got all the necessary ports forwarded, but Im guessing GRE isnt.

Ive tried vatious combinations of:

iptables -t nat -I PREROUTING -p 47 -j DNAT --to 10.0.0.12
iptables -I wanin -p 47 -d 10.0.0.12 -j logaccept
iptables -I INPUT -s 111.221.29.161 -j DROP

iptables -A INPUT -p tcp —dport 1723 -j ACCEPT
iptables -A INPUT -p gre -j ACCEPT
iptables -A INPUT -i ppp+ -j ACCEPT
iptables -A FORWARD -i ppp+ -j ACCEPT
iptables -A FORWARD -o ppp+ -j ACCEPT

iptables -t nat -I PREROUTING -p tcp —dport 1723 -j ACCEPT
iptables -I INPUT -p tcp —dport 1723 -j ACCEPT
iptables -I INPUT -i ppp+ -j ACCEPT
iptables -I FORWARD -i ppp+ -j ACCEPT

and
iptables -I INPUT 1 -p tcp —dport 1723 -j ACCEPT

but nothing works.

froob

579 posts

Ultimate Geek

Lifetime subscriber

#1567378 7-Jun-2016 19:12

Probably not any help to you, but quite recently I had an L2TP/IPSec server sitting behind my tomato router (Shibby mod), which worked with just the appropriate port forwarding rules.

macuser

2120 posts

Uber Geek

#1567399 7-Jun-2016 19:26

If you're client is windows, need to change registry key to allow VPN behind nat (nat-transversal).

Additionally you need to be forwarding 500, 4500 and the 17XX port if L2TP/PPTP pass through is not an option on router.

If its a NAT-T issue, and not a port forwarding issue, you'll be able to connect using Android but not Windows. If its a port forwarding issue (aka 500, 4500) you won't be able to connect at all.

thekiwi

295 posts

Ultimate Geek

#1567453 7-Jun-2016 20:26

Ended up being one of those "DOOOHHhhh" moments :)

Just so happens on the day that I installed the new router, the Win2k8 server also needed restarting ... and Routing and Remote Access service didnt auto start!!!

So Id been testing against a dead end! Found out when I put the old router back online and VPN's still wouldnt work.

SO I had the standard VPN port forwarding, and then added to the Firewall Scripts:

iptables -t nat -I PREROUTING -p 47 -j DNAT --to 10.0.0.12
iptables -I wanin -p 47 -d 10.0.0.12 -j logaccept
iptables -I INPUT -s 111.221.29.161 -j DROP

and all was good! :)