Where's My VPN?



  • I feel silly for posting this but where the heck is my VPN? I am trying to transfer it to my new server and I went to our old VPN server and ROUTING AND REMOTE ACCESS is not even set up. Yet, if the server was down VPN would be down.

    Our firewall (Endian) has VPN settings for OpenVPN but it is NOT enabled. However, it does have BRIDGED enabled to one of our interface cards with Dynamic IP pool start and end addresses listed.

    Sounds like a "noob" kind of question but it is just something I've never had to touch with all my other duties.



  • So maybe it is not a Windows VPN in use. Might be a third party product. Check out the process table to see what is running.



  • On a humorous note, inserting "Dude," at the beginning of the title would be hilarious.

    Seriously, though, how do the clients connect? That should give you a starting place to look.



  • @alexntg said:

    On a humorous note, inserting "Dude," at the beginning of the title would be hilarious.

    Seriously, though, how do the clients connect? That should give you a starting place to look.

    "Dude"...being solo IT guy for everything means something's go untouched for years. LOL.

    @scottalanmiller said:

    So maybe it is not a Windows VPN in use. Might be a third party product. Check out the process table to see what is running.

    Well, that's why I thought it may be the firewall but if OpenVPN is not on, then it is somewhere else.

    If this helps, it is the broadcast address of our T1 internet service. It's address is after the WAN gateway and before the subnet mask.



  • How do the clients connect?



  • Garak, didn't I send you a link with information from TechNet on this topic elsewhere?



  • @alexntg said:

    How do the clients connect?

    Though the broadcast address and using their domain ID and password.



  • @garak0410 said:

    @alexntg said:

    How do the clients connect?

    Though the broadcast address and using their domain ID and password.

    Let's see if i can be more specific - Is it SSL? PPTP? IPSEC? Is there a VPN client installed, or does it use the built-in Windows VPN client?



  • @Bill-Kindle said:

    Garak, didn't I send you a link with information from TechNet on this topic elsewhere?

    Yes...the link will help but find it kind of puzzling that it wasn't configured on the original server at all (SBS 2003)

    @alexntg said:

    @garak0410 said:

    @alexntg said:

    How do the clients connect?

    Though the broadcast address and using their domain ID and password.

    Let's see if i can be more specific - Is it SSL? PPTP? IPSEC? Is there a VPN client installed, or does it use the built-in Windows VPN client?

    Sorry...Windows VPN client...they configure it with the broadcast IP address of our internet service. Security is set to Automatic type of VPN and data encryption is optional. Windows 8x users have to also select ALLOW THESE PROTOCOLS.. Sign in with domain ID and password and they are in.



  • @garak0410

    Also, when on a VPN connection, when you do IPCONFIG /ALL, it shows the OLD server IP as primary DNS, so it has to be there. But if I go into ROUTING AND REMOTE ACCESS on the old server, and go into properties, it says THE SERVER HAS NOT BEEN SET UP FOR ROUTING. Perhaps I am just in the wrong properties?



  • You should see a related tunnel/rule in your firewall configuration. In an AD environment, the DC should be set as the DNS server, so that doesn't necessarily point to anything specific as the VPN.



  • @alexntg said:

    You should see a related tunnel/rule in your firewall configuration. In an AD environment, the DC should be set as the DNS server, so that doesn't necessarily point to anything specific as the VPN.

    Checking...



  • @garak0410 said:

    @alexntg said:

    You should see a related tunnel/rule in your firewall configuration. In an AD environment, the DC should be set as the DNS server, so that doesn't necessarily point to anything specific as the VPN.

    Checking...

    Well, the "free" Endian firewall we use kind of hid these options but I did find something (masking out the IP and port numbers):

    Uplink ANY UDP/1701 ALLOW with IPS 0.0.0.0: 000 L2TP

    Uplink ANY TCP/1723 ALLOW 0.0.0.0: 0.0.0.0 PPTP

    It was pointed at the old server. So, just point this to the new DC and I'll be good? No need to go through and set up ROUTING AND REMOTE ACCESS since it was never configured on the old server? That's basically where my confusion was in how ROUTING AND REMOTE ACCESS was never set up on the old one.



  • @garak0410 said:

    @garak0410 said:

    @alexntg said:

    You should see a related tunnel/rule in your firewall configuration. In an AD environment, the DC should be set as the DNS server, so that doesn't necessarily point to anything specific as the VPN.

    Checking...

    Well, the "free" Endian firewall we use kind of hid these options but I did find something (masking out the IP and port numbers):

    Uplink ANY UDP/1701 ALLOW with IPS 0.0.0.0: 000 L2TP

    Uplink ANY TCP/1723 ALLOW 0.0.0.0: 0.0.0.0 PPTP

    It was pointed at the old server. So, just point this to the new DC and I'll be good? No need to go through and set up ROUTING AND REMOTE ACCESS since it was never configured on the old server? That's basically where my confusion was in how ROUTING AND REMOTE ACCESS was never set up on the old one.

    You'll want to configure remote access on the new server first.



  • @alexntg said:

    @garak0410 said:

    @garak0410 said:

    @alexntg said:

    You should see a related tunnel/rule in your firewall configuration. In an AD environment, the DC should be set as the DNS server, so that doesn't necessarily point to anything specific as the VPN.

    Checking...

    Well, the "free" Endian firewall we use kind of hid these options but I did find something (masking out the IP and port numbers):

    Uplink ANY UDP/1701 ALLOW with IPS 0.0.0.0: 000 L2TP

    Uplink ANY TCP/1723 ALLOW 0.0.0.0: 0.0.0.0 PPTP

    It was pointed at the old server. So, just point this to the new DC and I'll be good? No need to go through and set up ROUTING AND REMOTE ACCESS since it was never configured on the old server? That's basically where my confusion was in how ROUTING AND REMOTE ACCESS was never set up on the old one.

    You'll want to configure remote access on the new server first.

    On the DC or allow my "services/file" server to handle it?



  • @garak0410 said:

    @alexntg said:

    @garak0410 said:

    @garak0410 said:

    @alexntg said:

    You should see a related tunnel/rule in your firewall configuration. In an AD environment, the DC should be set as the DNS server, so that doesn't necessarily point to anything specific as the VPN.

    Checking...

    Well, the "free" Endian firewall we use kind of hid these options but I did find something (masking out the IP and port numbers):

    Uplink ANY UDP/1701 ALLOW with IPS 0.0.0.0: 000 L2TP

    Uplink ANY TCP/1723 ALLOW 0.0.0.0: 0.0.0.0 PPTP

    It was pointed at the old server. So, just point this to the new DC and I'll be good? No need to go through and set up ROUTING AND REMOTE ACCESS since it was never configured on the old server? That's basically where my confusion was in how ROUTING AND REMOTE ACCESS was never set up on the old one.

    You'll want to configure remote access on the new server first.

    On the DC or allow my "services/file" server to handle it?

    Personal preference? There's pros and cons to both.



  • @alexntg said:

    @garak0410 said:

    @alexntg said:

    @garak0410 said:

    @garak0410 said:

    @alexntg said:

    You should see a related tunnel/rule in your firewall configuration. In an AD environment, the DC should be set as the DNS server, so that doesn't necessarily point to anything specific as the VPN.

    Checking...

    Well, the "free" Endian firewall we use kind of hid these options but I did find something (masking out the IP and port numbers):

    Uplink ANY UDP/1701 ALLOW with IPS 0.0.0.0: 000 L2TP

    Uplink ANY TCP/1723 ALLOW 0.0.0.0: 0.0.0.0 PPTP

    It was pointed at the old server. So, just point this to the new DC and I'll be good? No need to go through and set up ROUTING AND REMOTE ACCESS since it was never configured on the old server? That's basically where my confusion was in how ROUTING AND REMOTE ACCESS was never set up on the old one.

    You'll want to configure remote access on the new server first.

    On the DC or allow my "services/file" server to handle it?

    Personal preference? There's pros and cons to both.

    Quick side question...since ROUTING AND REMOTE ACCESS was never configured on the old server/DC (SBS 2003), how did it work then? Just by the tunneling?



  • @garak0410 said:

    @alexntg said:

    @garak0410 said:

    @alexntg said:

    @garak0410 said:

    @garak0410 said:

    @alexntg said:

    You should see a related tunnel/rule in your firewall configuration. In an AD environment, the DC should be set as the DNS server, so that doesn't necessarily point to anything specific as the VPN.

    Checking...

    Well, the "free" Endian firewall we use kind of hid these options but I did find something (masking out the IP and port numbers):

    Uplink ANY UDP/1701 ALLOW with IPS 0.0.0.0: 000 L2TP

    Uplink ANY TCP/1723 ALLOW 0.0.0.0: 0.0.0.0 PPTP

    It was pointed at the old server. So, just point this to the new DC and I'll be good? No need to go through and set up ROUTING AND REMOTE ACCESS since it was never configured on the old server? That's basically where my confusion was in how ROUTING AND REMOTE ACCESS was never set up on the old one.

    You'll want to configure remote access on the new server first.

    On the DC or allow my "services/file" server to handle it?

    Personal preference? There's pros and cons to both.

    Quick side question...since ROUTING AND REMOTE ACCESS was never configured on the old server/DC (SBS 2003), how did it work then? Just by the tunneling?

    I've never worked with SBS before.



  • @alexntg said:

    @garak0410 said:

    @alexntg said:

    @garak0410 said:

    @alexntg said:

    @garak0410 said:

    @garak0410 said:

    @alexntg said:

    You should see a related tunnel/rule in your firewall configuration. In an AD environment, the DC should be set as the DNS server, so that doesn't necessarily point to anything specific as the VPN.

    Checking...

    Well, the "free" Endian firewall we use kind of hid these options but I did find something (masking out the IP and port numbers):

    Uplink ANY UDP/1701 ALLOW with IPS 0.0.0.0: 000 L2TP

    Uplink ANY TCP/1723 ALLOW 0.0.0.0: 0.0.0.0 PPTP

    It was pointed at the old server. So, just point this to the new DC and I'll be good? No need to go through and set up ROUTING AND REMOTE ACCESS since it was never configured on the old server? That's basically where my confusion was in how ROUTING AND REMOTE ACCESS was never set up on the old one.

    You'll want to configure remote access on the new server first.

    On the DC or allow my "services/file" server to handle it?

    Personal preference? There's pros and cons to both.

    Quick side question...since ROUTING AND REMOTE ACCESS was never configured on the old server/DC (SBS 2003), how did it work then? Just by the tunneling?

    I've never worked with SBS before.

    Thanks for tips...as I said, not having ROUTING AND REMOTE ACCESS set up on the original was causing me to just sit here and shake my head...as I multitask with other things... 🙂



  • @garak0410

    Made the changes in the firewall tunneling and configured ROUTING AND REMOTE ACCESS on the services server (though had to use CUSTOM since this is a VM and only had one NIC.) Using Windows Authentication, MS-CHAP v2 only...tried a test VPN connection and it fails with ERROR 812...complaining about a policy on the RAS/VPN server and the authentication method used by the server to verify username and password.. Can't seem to find the solution yet but love OTJ training... 🙂 Still searching...



  • @garak0410 said:

    @garak0410

    Made the changes in the firewall tunneling and configured ROUTING AND REMOTE ACCESS on the services server (though had to use CUSTOM since this is a VM and only had one NIC.) Using Windows Authentication, MS-CHAP v2 only...tried a test VPN connection and it fails with ERROR 812...complaining about a policy on the RAS/VPN server and the authentication method used by the server to verify username and password.. Can't seem to find the solution yet but love OTJ training... 🙂 Still searching...

    Still trying to solve this problem. Do I need to set up NPS to configure NAP? As I've referred to Ad nauseam, the old server didn't have anything special set up.



  • More in depth details on the connection problem:

    Error 812: THE CONNECTION WAS PREVENTED BECAUSE OF A POLICY CONFIGURED ON YOUR RAS/VPN SERVER. SPECIFICALLY, THE AUTHENTICATION METHOD USED BY THE SERVER TO VERIFY YOUR USERNAME AND PASSWORD MAY NOT MATCH THE AUTHENICATION METOHD CONFIGURED IN YOUR CONNECTION PROFILE.

    In the properties under ROUTING AND REMOTE ACCESS for my server, under security tab, I have EAP and MS-CHAP V2 selected. on the client, it's security tab is set to Automatic VPN and Allow these protocols with MS-CHAP V2 selected.



  • @garak0410 I have never used Windows RAS before so cannot help ya there. Are you sure there was no 3rd party application running as a service on the old server?



  • @JaredBusch said:

    @garak0410 I have never used Windows RAS before so cannot help ya there. Are you sure there was no 3rd party application running as a service on the old server?

    Agreed and checked...nothing...after all the suggestions above, I only found the tunneling information in the firewall that pointed to this server.



  • @garak0410

    Going to remove and reinstall the Remote Access role. Just waiting for people to get out of here...come on people...it is well after 5 on a Friday! 🙂



  • @garak0410 said:

    @garak0410

    Going to remove and reinstall the Remote Access role. Just waiting for people to get out of here...come on people...it is well after 5 on a Friday! 🙂

    Can't work remotely?



  • @scottalanmiller said:

    @garak0410 said:

    @garak0410

    Going to remove and reinstall the Remote Access role. Just waiting for people to get out of here...come on people...it is well after 5 on a Friday! 🙂

    Can't work remotely?

    Well, Scott...I fixed that issue we discussed with the IP address of the old server needed for pre-migration created projects...adding it as a secondary IP to the new file server works like a charm. Now if I can get this dang VPN working, I can officially shut down that old, blasted server.



  • Have you used telnet to verify that the server is responding on that port as expected?



  • @scottalanmiller

    Yes it responds...now, one thing I didn't know about is that there is a DIAL-IN tab for the users...it is not in the remote admin tools but I have to do it directly from the DC...I go into a remote user, go to the Dial-In tab and allow permission...bam...got in but then couldn't name resolve anything while on VPN and my network connection on my client went to limited...

    So firing up the old server for now to just retain VPN and figure it out next week...



  • @garak0410

    This problem bugged me so came into the office. I've made a successful VPN connection (woo) but cannot connect to desktop via Remote Desktop. The subnet mask should be 255.255.255.0 in my static address pool for VPN and it shows that subnet. When I VPN with a client, it shows 255.255.255.255 but with a good IP, good DNS server and no default gateway. Any way to fix that? If I can get that fixed, my work here is done and the old server is gone for good.


Log in to reply