[pptp-server] PPTP client connection trough masqueraded firewall

[Greg Muehl]

I have the same problem. I am using an extendnet4000 firewall at work 
(based on 2.2.14) that claims to support VPN port forwarding. I have it 
forward to an inside Linux Slackware 2.2.16 box.

I can connect multiple clients that are inside the local network (useless 
except for testing). Outside the network I get this in my pptpd.log when I 
connect multiple machines, even from different locations:

May 30 00:15:35 file_server pppd[227]: sent [LCP ConfReq id=0x1 <asyncmap 
0x0> <auth chap MD5> <magic 0x3e94174e> <pcomp> <accomp>]
May 30 00:15:35 file_server pptpd[202]: GRE: Discarding out of order packet
May 30 00:15:35 file_server pptpd[226]: GRE: Discarding out of order packet
May 30 00:15:35 file_server pptpd[202]: GRE: Discarding out of order packet
May 30 00:15:35 file_server pptpd[226]: GRE: Discarding out of order packet
May 30 00:15:38 file_server pppd[227]: sent [LCP ConfReq id=0x1 <asyncmap 
0x0> <auth chap MD5> <magic 0x3e94174e> <pcomp> <accomp>]
May 30 00:15:38 file_server pptpd[202]: GRE: Discarding out of order packet
May 30 00:15:38 file_server pptpd[226]: GRE: Discarding out of order packet
May 30 00:15:38 file_server pptpd[202]: GRE: Discarding out of order packet
May 30 00:15:38 file_server pptpd[226]: GRE: Discarding out of order packet
May 30 00:15:41 file_server pppd[227]: LCP: timeout sending Config-Requests
May 30 00:15:41 file_server pppd[227]: Connection terminated.
May 30 00:15:41 file_server pppd[227]: Exit.
May 30 00:15:41 file_server pptpd[226]: GRE: 
read(fd=4,buffer=804d840,len=8196) from PTY failed: status = -1 error = 
Input/output error
May 30 00:15:41 file_server pptpd[226]: CTRL: PTY read or GRE write failed 
(pty,gre)=(4,5)
May 30 00:15:41 file_server pptpd[226]: CTRL: Client 100.0.0.199 control 
connection finished

any ideas???







At 03:35 PM 5/30/2001 -0400, you wrote:
>FW-1 probably only supports 1 concurrent connection behind it.  it's not
>smart enough to figure out based on call id which machine should get the
>GRE packets.  See if there's an update.  if not, get a box to route.
>
>Scott
>
>On Wed, 30 May 2001, Kurt Glazemakers wrote:
>
> >
> > I'm sorry, the image totally screwed up by sending it, maybe this will
> > be more clear
> >
> >       Linux   PPTP server
> >                 |
> >                 |
> >               ...
> >            Internet
> >               ...
> >                 |
> >                 |
> >          213.2.45.6
> >             FW-1
> >          192.168.1.254/24
> >                 |
> >         -------------
> >         |            |
> >       PC-A            PC-B
> >   192.168.1.1/24      192.168.1.2/24
> >
> > Yep, the internet address of the firewall is fixed, and yep PC-A or PC-B
> > is able to connect. Only both PPTP connections togheter don't work.
> >
> > I could make one connection and route it, but then I need an extra
> > machine, because PC-A and PC-B are laptop pc's. If possible I would like
> > to avoid it.
> >
> >
> > -----Original Message-----
> > From: Justin Kreger [mailto:lists at earthling.2y.net]
> > Sent: woensdag 30 mei 2001 19:25
> > To: Kurt Glazemakers
> > Cc: pptp-server at lists.schulte.org
> > Subject: Re: [pptp-server] PPTP client connection trough masqueraded
> > firewall
> >
> >
> > Your diagram is.... umm... not clear..   Dose the internet side of your
> > firewall have a static ip?  Is it acceptable to have one connect to the
> > pptp server, and route between the two networks?
> >
> > Justin Kreger, MCP MCSE CCNA
> > jkreger at earthling.2y.net jwkreger at uncg.edu jkreger at aristotle.wss.net
> >
> >
> > On Wed, 30 May 2001, Kurt Glazemakers wrote:
> >
> > >
> > > This is the setup I wanted to use:
> > >     Machine A                 Checkpoint  FW-1
> > >    192.168.1.1/24=======|  |-----------|
> > > |-------------------|
> > >                             |==|               |========....
> > > INTERNET  ....======| Linux PPTP server |
> > >     Machine B               |  |               |
> > > |                       |
> > >    192.168.1.2/24=======|  |-----------|
> > > |-------------------|
> > >                     192.168.1.254/24     213.2.45.6
> > >
> > > Machine A and machine B needs to connect to the PPTP server and are
> > > using 2 different accounts.
> > >
> > > My question is: Is it possible to do this, can the PPTP protocol be
> > > masqueraded ? The TCP port 1723 will be offcourse no problem, but what
> > > about the GRE. Because 1 connection works, but a second fails ...
> > >
> > > Thanks,
> > >
> > > Kurt
> > > _______________________________________________
> > > pptp-server maillist  -  pptp-server at lists.schulte.org
> > > http://lists.schulte.org/mailman/listinfo/pptp-server
> > > List services provided by www.schulteconsulting.com!
> > >
> >
> > _______________________________________________
> > pptp-server maillist  -  pptp-server at lists.schulte.org
> > http://lists.schulte.org/mailman/listinfo/pptp-server
> > List services provided by www.schulteconsulting.com!
> >
>
>_______________________________________________
>pptp-server maillist  -  pptp-server at lists.schulte.org
>http://lists.schulte.org/mailman/listinfo/pptp-server
>List services provided by www.schulteconsulting.com!