VPN via a Cisco 2620 router

[RDK45]

Folks...We have a small business with several servers (Windows and Linux) which we will like to access via a VPN. We want to use the PPTP client which comes with Windows.

I have installed VPN on a Window 2000 server. There are two methods for setting up a VPN server, one using RRAS and the other, simpler process using the "Network Connections/New Connection Wizard". Since we are not running a Domain Server, the later is easier.

However, I have tried both and can not connect to the VPN server from outside. From the internal LAN both setups work fine.

We are using an older Cisco 2620 router as our connection to the Internet. It is running IOS 12.0. It is listening on two public-side IP addresses, but we want to only use one of those addresses for the VPN. The following lines are in the configuration file, real IP's replaced with 1.2.3.4

access-list 113 permit tcp any host 1.2.3.4 eq 1723
access-list 113 permit gre any host 1.2.3.4

which we thought would be enough to get traffic to the Windows 2000 VPN server.

By the way, there are other services on that server which are getting their traffic, so we know the router can reach the server.

Now the questions,
1) What are we doing wrong? Is there an issue with the 2620 and passing VPN traffic to our LAN? Can this router be configured as a VPN endpoint thus eliminating the need for the Windows 2000 VPN server?

2) Assuming that we can not do this with the 2620, the could we switch out that router for a more modern one that will not break the bank? Will any of the current Linksys, Netgear, Belkin, etc routers do what we want to do for routing to specific servers depending on incoming port id's as well as allow the VPN tunnel to be created to the server?

Thanks.....RDK

 

[bill001g]

I am going guess you have NAT involved in someway with this. If you apply that access list inbound on the outside interface it is interpreted before that nat so you must put in public ip address.

I would remove the access list and see if you can get this to work first. NAT and ipsec/pptp get a little tricky even without filtering access lists.

To actually terminate vpn on the router your need the firewall feature set of the IOS. I have only configured ipsec and I don't remember if it supports pptp but of course it will run unencrypted GRE.

 

[Dreamslacker]

Folks...We have a small business with several servers (Windows and Linux) which we will like to access via a VPN. We want to use the PPTP client which comes with Windows.

I have installed VPN on a Window 2000 server. There are two methods for setting up a VPN server, one using RRAS and the other, simpler process using the "Network Connections/New Connection Wizard". Since we are not running a Domain Server, the later is easier.

However, I have tried both and can not connect to the VPN server from outside. From the internal LAN both setups work fine.

We are using an older Cisco 2620 router as our connection to the Internet. It is running IOS 12.0. It is listening on two public-side IP addresses, but we want to only use one of those addresses for the VPN. The following lines are in the configuration file, real IP's replaced with 1.2.3.4

access-list 113 permit tcp any host 1.2.3.4 eq 1723
access-list 113 permit gre any host 1.2.3.4

which we thought would be enough to get traffic to the Windows 2000 VPN server.

By the way, there are other services on that server which are getting their traffic, so we know the router can reach the server.

Now the questions,
1) What are we doing wrong? Is there an issue with the 2620 and passing VPN traffic to our LAN? Can this router be configured as a VPN endpoint thus eliminating the need for the Windows 2000 VPN server?

2) Assuming that we can not do this with the 2620, the could we switch out that router for a more modern one that will not break the bank? Will any of the current Linksys, Netgear, Belkin, etc routers do what we want to do for routing to specific servers depending on incoming port id's as well as allow the VPN tunnel to be created to the server?

Thanks.....RDK

If you are using NAT, you need to add a NAT rule to forward those ports. Simply adding the protocols/ ports to an ACL wouldn't work if it is not applied to NAT.

You can use static NAT:
e.g.
ip nat inside source static tcp 1.2.3.4 1723 <WAN IP> 1723 extendable

Alternatively, if you want to use ACLs (useful if you want to forward many ports or UDP port ranges), use a route-map to perform the forwarding instead.
E.g.

ip nat inside source static 1.2.3.4 <WAN IP> route-map vpnsvr
route-map vpnsvr
match ip address 113
access-list 113 permit tcp any host 1.2.3.4 eq 1723
access-list 113 permit gre any host 1.2.3.4

 

[RDK45]

Dreamslaker and bill001g.....Thanks for the replies. I have discussed your comments with my son (the Cisco "expert"). He says he is not using NAT but rather only port forwarding (public address&port to internal address&port). He thinks he has tried your suggestions, but will try again. Thanks....RDK
=============================================
If you are using NAT, you need to add a NAT rule to forward those ports. Simply adding the protocols/ ports to an ACL wouldn't work if it is not applied to NAT.

You can use static NAT:
e.g.
ip nat inside source static tcp 1.2.3.4 1723 <WAN IP> 1723 extendable

Alternatively, if you want to use ACLs (useful if you want to forward many ports or UDP port ranges), use a route-map to perform the forwarding instead.
E.g.

ip nat inside source static 1.2.3.4 <WAN IP> route-map vpnsvr
route-map vpnsvr
match ip address 113
access-list 113 permit tcp any host 1.2.3.4 eq 1723
access-list 113 permit gre any host 1.2.3.4[/quotemsg]

 

[Dreamslacker]

Dreamslaker and bill001g.....Thanks for the replies. I have discussed your comments with my son (the Cisco "expert"). He says he is not using NAT but rather only port forwarding (public address&port to internal address&port). He thinks he has tried your suggestions, but will try again. Thanks....RDK

If he is port forwarding a public address to internal address, then he is running a NAT whether he realizes it or not.

Next thing he needs to do is verify that the default route is configured correctly.