1.8b Development

I do know they specifically complained about their microsoft exchange server not working to be able to get their emails...I assume that would directly relate to the VPN issue...right?

No idea what their setup is, but if they access their MS Exchange server through VPN, then it would explain that, yes.

Manuel, here is what one of the IT people sent me regarding their VPN....we upgraded to b500 but it appears they still cannot access their VPN for some reason....

I have never heard of a firewall blocking VPN traffic like this before.
 
Here is what we allow outbound through TRW firewalls for VPN to work properly.
 
minimum ports/protocols required:
 
Permit esp protocol
Permit ah protocol
Permit udp port 500
Permit udp port 10000
Other ports/protocols that may be needed
 
Permit udp port 4500
Permit tcp port 1723 (PPTP)
Permit tcp port 1701
permit tcp port 10000
Permit gre protocol
 
Any business class firewall will allow the return traffic without any additional configuration.  Also tell the firewall IT people that we use a standard Cisco IPSEC VPN client. 


Does this help diagnose why they cannopt access a Cisco VPN? Do you want access to our gateway to look at it?

Thanks DR01

This might also help....they also sent me this....

We had a phone conversation with our employee regarding the VPN issue, that I was facing from the remote site. I was able to connect to the VPN but unable to access any of the TRW servers / sites while being connected.

So it appears that the VPN is connecting however then once connected no remote company servers can be reached....

This is all on a b500 rev firmware loaded on a Generic PC gateway....

dr01

click to select action    12:03:54.024192    LAN    172.20.1.147, port 54900    186.45.33.22, port 19627    TCP
click to select action    12:03:50.400719    LAN    172.20.1.147, port 55514    82.73.239.42, port 39330    TCP
click to select action    12:03:42.191620    LAN    172.20.1.157, port 54336    50.19.208.24, port 443    TCP
click to select action    12:03:41.206308    LAN    172.20.1.147, port 55777    83.84.169.136, port 13725    TCP
click to select action    12:03:40.800512    LAN    172.20.1.147, port 55825    76.10.147.244, port 6881    TCP
click to select action    12:03:28.485933    WAN    93.95.105.114, port 28932    172.20.1.147, port 56182    TCP
click to select action    12:03:25.130305    WAN    93.95.105.114, port 28932    172.20.1.147, port 56182    TCP
click to select action    12:03:16.990192    LAN    172.20.1.147, port 55514    82.73.239.42, port 39330    TCP
click to select action    12:03:15.273968    LAN    172.20.1.147, port 55753    24.148.90.60, port 48481    TCP
click to select action    12:03:10.738729    LAN    172.20.1.147, port 54573    86.44.155.32, port 52197    TCP
click to select action    12:03:02.349687    LAN    172.20.1.147, port 55753    24.148.90.60, port 48481    TCP
click to select action    12:03:00.234221    LAN    172.20.1.147, port 55777    83.84.169.136, port 13725    TCP
click to select action    12:02:56.799003    LAN    172.20.1.147, port 55825    76.10.147.244, port 6881    TCP
click to select action    12:02:51.845529    LAN    172.20.1.81, port 49183    173.223.185.83, port 443    TCP
click to select action    12:02:51.845346    LAN    172.20.1.81, port 49183    173.223.185.83, port 443    TCP
click to select action    12:02:50.145032    LAN    172.20.1.147, port 55707    108.162.128.6, port 1720    TCP
click to select action    12:02:49.946481    LAN    172.20.1.147, port 55137    128.12.145.79, port 12232    TCP
click to select action    12:02:49.438640    LAN    172.20.1.147, port 54900    186.45.33.22, port 19627    TCP
click to select action    12:02:49.336539    LAN    172.20.1.147, port 55753    24.148.90.60, port 48481    TCP
click to select action    12:02:43.681807    LAN    172.20.1.147, port 55514    82.73.239.42, port 39330    TCP
click to select action    12:02:39.051036    LAN    172.20.1.147, port 55707    108.162.128.6, port 1720    TCP
click to select action    12:02:38.191646    LAN    172.20.1.157, port 54336    50.19.208.24, port 443    TCP
click to select action    12:02:36.322411    LAN    172.20.1.147, port 55753    24.148.90.60, port 48481    TCP
click to select action    12:02:35.716014    LAN    172.20.1.147, port 54573    86.44.155.32, port 52197    TCP
click to select action    12:02:27.946151    LAN    172.20.1.147, port 55707    108.162.128.6, port 1720    TCP
click to select action    12:02:23.308985    LAN    172.20.1.147, port 55753    24.148.90.60, port 48481    TCP
click to select action    12:02:22.401920    LAN    172.20.1.147, port 55137    128.12.145.79, port 12232    TCP
click to select action    12:02:18.743148    LAN    172.20.1.84, port 57616    199.59.148.87, port 80    TCP
click to select action    12:02:16.851670    LAN    172.20.1.147, port 55707    108.162.128.6, port 1720    TCP
click to select action    12:02:10.397284    LAN    172.20.1.147, port 55753    24.148.90.60, port 48481    TCP
click to select action    12:02:10.298988    LAN    172.20.1.147, port 55514    82.73.239.42, port 39330    TCP
click to select action    12:02:05.754612    LAN    172.20.1.147, port 55707    108.162.128.6, port 1720    TCP
click to select action    12:02:00.720540    LAN    172.20.1.147, port 54573    86.44.155.32, port 52197    TCP
click to select action    12:01:54.967720    LAN    172.20.1.147, port 55137    128.12.145.79, port 12232    TCP
click to select action    12:01:54.665382    LAN    172.20.1.147, port 55707    108.162.128.6, port 1720    TCP
click to select action    12:01:44.881339    LAN    172.20.1.147, port 54900    186.45.33.22, port 19627    TCP
click to select action    12:01:36.915148    LAN    172.20.1.147, port 55514    82.73.239.42, port 39330    TCP
click to select action    12:01:34.191433    LAN    172.20.1.157, port 54336    50.19.208.24, port 443    TCP
click to select action    12:01:27.440642    LAN    172.20.1.147, port 55137    128.12.145.79, port 12232    TCP
click to select action    12:01:17.735797    LAN    172.20.1.147, port 55106    24.148.90.60, port 48481    TCP
click to select action    12:01:17.136580    LAN    172.20.1.147, port 55448    24.148.90.60, port 48481    TCP
click to select action    12:01:08.550788    LAN    172.20.1.147, port 55448    24.148.90.60, port 48481    TCP
click to select action    12:01:06.669357    LAN    172.20.1.84, port 57610    199.59.148.87, port 80    TCP
click to select action    12:00:59.987498    LAN    172.20.1.147, port 55448    24.148.90.60, port 48481    TCP
click to select action    12:00:59.878326    LAN    172.20.1.147, port 55137    128.12.145.79, port 12232    TCP
click to select action    12:00:57.854045    LAN    172.20.1.147, port 55106    24.148.90.60, port 48481    TCP
click to select action    12:00:51.397244    LAN    172.20.1.147, port 55448    24.148.90.60, port 48481    TCP
click to select action 2    12:00:48.600462    LAN    172.20.1.91    224.0.0.252    IGMP
click to select action 3    12:00:46.598376    LAN    172.20.1.91    224.0.0.252    IGMP
click to select action 2    12:00:45.593967    LAN    172.20.1.91    224.0.0.252    IGMP
click to select action 2    12:00:45.220237    LAN    172.20.1.91    224.0.0.252    IGMP
click to select action    12:00:42.823918    LAN    172.20.1.147, port 55448    24.148.90.60, port 48481    TCP
click to select action    12:00:40.097786    LAN    172.20.1.147, port 54900    186.45.33.22, port 19627    TCP
click to select action    12:00:37.979578    LAN    172.20.1.147, port 55106    24.148.90.60, port 48481    TCP
click to select action    12:00:32.335470    LAN    172.20.1.147, port 55137    128.12.145.79, port 12232    TCP
click to select action    12:00:30.192989    LAN    172.20.1.157, port 54336    50.19.208.24, port 443    TCP
click to select action    12:00:26.373742    LAN    172.20.1.147, port 54906    24.148.90.60, port 48481    TCP
click to select action    12:00:18.104513    LAN    172.20.1.147, port 55106    24.148.90.60, port 48481    TCP
click to select action    12:00:06.803176    LAN    172.20.1.147, port 54906    24.148.90.60, port 48481    TCP
click to select action    12:00:06.654371    LAN    172.20.1.84, port 57610    199.59.148.87, port 80    TCP
click to select action    12:00:04.784729    LAN    172.20.1.147, port 55137    128.12.145.79, port 12232    TCP
click to select action    11:59:58.231328    LAN    172.20.1.147, port 55106    24.148.90.60, port 48481    TCP
click to select action    11:59:47.240617    LAN    172.20.1.147, port 54906    24.148.90.60, port 48481    TCP
click to select action    11:59:38.366525    LAN    172.20.1.147, port 55106    24.148.90.60, port 48481    TCP
click to select action    11:59:37.252398    LAN    172.20.1.147, port 55137    128.12.145.79, port 12232    TCP
click to select action    11:59:35.331521    LAN    172.20.1.147, port 54900    186.45.33.22, port 19627    TCP
click to select action    11:59:27.655088    LAN    172.20.1.147, port 54906    24.148.90.60, port 48481    TCP
click to select action    11:59:26.191472    LAN    172.20.1.157, port 54336    50.19.208.24, port 443    TCP
click to select action    11:59:18.629625    LAN    172.20.1.84, port 57610    199.59.148.87, port 80    TCP
click to select action    11:59:18.491781    LAN    172.20.1.147, port 55106    24.148.90.60, port 48481    TCP
click to select action    11:59:14.604699    LAN    172.20.1.84, port 57609    199.59.148.87, port 80    TCP
click to select action    11:59:08.087384    LAN    172.20.1.147, port 54906    24.148.90.60, port 48481    TCP
click to select action    11:58:48.527148    LAN    172.20.1.147, port 54906    24.148.90.60, port 48481    TCP
click to select action    11:58:30.655896    LAN    172.20.1.147, port 54900    186.45.33.22, port 19627    TCP
click to select action    11:58:29.049902    LAN    172.20.1.147, port 54706    108.162.128.6, port 1720    TCP
click to select action    11:58:28.947363    LAN    172.20.1.147, port 54906    24.148.90.60, port 48481    TCP
click to select action    11:58:22.191291    LAN    172.20.1.157, port 54336    50.19.208.24, port 443    TCP
click to select action    11:58:16.936993    LAN    172.20.1.147, port 54706    108.162.128.6, port 1720    TCP
click to select action    11:58:04.832380    LAN    172.20.1.147, port 54706    108.162.128.6, port 1720    TCP
click to select action    11:57:52.729302    LAN    172.20.1.147, port 54706    108.162.128.6, port 1720    TCP
click to select action    11:57:40.625030    LAN    172.20.1.147, port 54706    108.162.128.6, port 1720    TCP
click to select action    11:57:28.526466    LAN    172.20.1.147, port 54706    108.162.128.6, port 1720    TCP
click to select action    11:57:23.374821    LAN    172.20.1.147, port 53655    75.169.61.207, port 21374    TCP
click to select action    11:57:18.191509    LAN    172.20.1.157, port 54336    50.19.208.24, port 443    TCP
click to select action    11:56:46.191211    LAN    172.20.1.157, port 54336    50.19.208.24, port 443    TCP
click to select action    11:56:30.191189    LAN    172.20.1.157, port 54336    50.19.208.24, port 443    TCP
click to select action    11:56:22.191193    LAN    172.20.1.157, port 54336    50.19.208.24, port 443    TCP
click to select action    11:56:18.718617    LAN    172.20.1.147, port 53655    75.169.61.207, port 21374    TCP
click to select action    11:56:18.191126    LAN    172.20.1.157, port 54336    50.19.208.24, port 443    TCP
click to select action    11:56:16.191162    LAN    172.20.1.157, port 54336    50.19.208.24, port 443    TCP
click to select action    11:56:15.199893    LAN    172.20.1.157, port 54336    50.19.208.24, port 443    TCP
click to select action    11:56:15.199650    LAN    172.20.1.157, port 54336    50.19.208.24, port 443    TCP
click to select action    11:56:07.836192    LAN    172.20.1.84, port 57599    199.59.148.87, port 80    TCP
click to select action    11:56:03.436874    LAN    172.20.1.84, port 57600    199.59.148.87, port 80    TCP
click to select action    11:55:36.752024    WAN    98.139.235.13, port 80    172.20.1.93, port 51573    TCP
click to select action    11:55:14.172413    LAN    172.20.1.147, port 53655    75.169.61.207, port 21374    TCP
click to select action    11:54:52.807909    LAN    172.20.1.84, port 57594    199.59.149.232, port 80    TCP
click to select action    11:54:50.175518    WAN    184.52.120.69, port 32285    172.20.1.147, port 54246    TCP
click to select action    11:54:38.301042    LAN    172.20.1.157, port 54338    107.20.244.227, port 443    TCP
click to select action    11:54:09.646323    LAN    172.20.1.147, port 53655    75.169.61.207, port 21374    TCP


These all show a red X in the ACT column....does this log help?

DR01

Any chance that your m0n0wall's LAN subnet coincides with the subnet that the company uses for their VPN clients?

yes it does....our gateway is setup as our standard to 172.20.1.1  /16
does this mean there is a bug in the code or a change needs to be made?

thanks manuel...

Then it's clear that it won't work, and not because of m0n0wall (you would have the same problem with any other firewall if you configured it with the same addresses), but because the client gets confused as there are two routes for the same subnet: one to the directly connected LAN, and one to the VPN.

Looks like you'll have to renumber your LAN. You might have better luck using something exotic (like 10.215.34.0/24 or whatever) than using a whole /16 (which you probably won't need anyway) out of a common range.

thank you, we will try switching our LAN address scheme and then I will update you....thanks again

dr01

Manuel, I have seen some gateways out there using static global WAN IP assign to a client for a VPN at sign in to the CP page....this would bypass the firewall rules and give them direct global IP access to the internet and no port blockages or any local IP subnet issues. What do you think about adding a WAN range of IP feature that can be entered and then when they (as an example) check a request VPN box at the CP login screen Monowall issues them a WAN IP in the available range that was entered in the WAN section. 

Your thoughts? Would this code be hard to write?
Let me know...

thanks dr01