Is DMZ a solution for PPTP server behind NAT?

tclam662

Distinguished
Apr 10, 2007
17
0
18,520
Quick Facts:
ISP Name: PCCW Hong Kong
ISP Service: FTTH
Modem: Huawei Echolife HG8045
Router: Huawei Echolife HG8045
PPTP Server: Linksys RV042
Config: ISP->Fiber->HG8045---->Internet TV Box
........................................|------->RV042
........................................|------->PC
........................................|------->Homeplug AV2 bridge->802.11g AP

Hello! I am from Hong Kong (sorry for my English ). I signed up for the PCCW FTTH service earlier this month but I found out that the modem they provided is a Huawei HG8045 GPON terminal which is a modem router combo.

The problem is that my ISP wont provide admin access to HG8045's web administration interface, I can only tinker some minor settings e.g. port forward, DMZ, wifi ssid, wifi security..etc, using an "user" account which I obviously cant disable NAT and change that to a bridge nor enabling PPTP passthough.

The old Linksys RV042 comes handy to bypass internet block at workplace or public wifi AP with PPTP server VPN function but I it barely works behind NAT, I can never connect to the pptp server at work, I tried forwarding port 1723 but it doesnt help.

I googled a bit and found that pptp uses GRE encapsulation which is not bound to a port and my only last hope is to assign my RV042's IP to DMZ, though it sort of worked as I can establish a VPN connection, got a valid ip from the RV042 and the RV042 administration interface could be accessed, strange that I cant visit any other webpages through PPTP tunnel.

Before troubleshooting other possible problems i.e. DNS setting, I would like to know if DMZ is a viable solution to pptp server behind NAT? Does it solves the GRE problem?

I swear to god, I will hack this router's admin account, they seems to left HG8045's telnet opened and telnet root account at default, I can even enter a linux shell mode though telnet , but that's another story I will probably open another thread for that.

Vincent
 
All you can do is try. You would port forward 1723 or put the machine in the DMZ. As you have found out the other part of pptp is the gre protocol 47 issue. Most routers vpn passthough just works but if your device has it disabled its going to be tough. This is why sslvpn is getting more and more popular. It is a little slower than l2tp or pptp but it passes though anything.
 


The VPN spec of RV042 are:
IPsec
50 IPsec site-to-site tunnels for branch office connectivity

QuickVPN
50 QuickVPN tunnels for remote client access

PPTP
5 PPTP tunnels for remote access

Encryption
Data Encryption Standard (DES), Triple Data Encryption Standard (3DES), and Advanced Encryption Standard (AES) encryption; AES-128, AES-192, AES-256

Authentication
MD5/SHA1 authentication

IPsec NAT traversal
Supported for gateway-to-gateway and client-to-gateway tunnels

VPN pass-through
PPTP, L2TP, IPsec

Advanced VPN
Dead peer detection (DPD), IKE, split DNS

Linksys RV042 Manual

Do you think RV042 support SSL VPN?

 
No but you could try L2TP which is IPSEC and run it in NATT mode which uses UDP ports 500 and 4500.

They generally say if they support SSLVPN. OPENVPN is one a lot of people use but more and more firewalls have support. Generally you do not use SSLVPN if you can use one of the other ones. It is very resource intensive compared to PPTP or L2TP.