Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an AirPort Extreme (purchased about a month ago, so the latest model) and I have an iMac connected to it running a VPN server; the iMac has a static IP address on the network and is configured properly; I can connect to the iMac as a VPN client without trouble on the local network.

However, if I try to access it from outside the local network, the VPN connection fails with the following message:

Error Message

In AirPort Utility, I have the port mapping set up as follows:

Port Mapping

I also have SSH forwarding set up exactly the same but using TCP port 22 obviously. I have confirmed SSH works as expected and I have no trouble connecting, but the VPN fails. Again, if I'm inside the local network and replace the router's public IP address with the address of the VPN server ( it connects fine, but entering the router's public IP fails exactly the same way.

These exact UDP ports worked fine on the old Belkin router (though the router itself was sketchy) - any ideas why they no longer work on the AirPort Extreme? I already changed all the settings on the VPN server itself to match the local IP addresses assigned by the AirPort so there should be no issues there. I also added the iMac's address as the NAT Default Host; no dice.

Any thoughts?

FOLLOW-UP 1: Disabling Back To My Mac did NOT solve the problem.

FOLLOW-UP 2: Adding port 1723 and changing all ports to both TCP and UDP at the same time do NOT help.

share|improve this question
Anyone have any ideas? Still trying to figure this one out... – Justin Mrkva Jun 1 '11 at 4:44
Did you solve this? I'm running into a similar issue and I've opened up ports 500, 4500, 1701 and 1723 for both UDP and TCP. – CadentOrange Mar 15 at 18:12

Make sure you use a network enabled user if you have an open directory running, your local accouny you might have created before installing open directory does not support authentication for VPN tunnel

share|improve this answer

Make sure you do not have your base station set to do Back To My Mac. BTMM uses the IKE/ISAKMP port (500/UDP), and it gets in the way of the VPN port mapping.

share|improve this answer
Ah... I did have that enabled because I needed to perform configuration over the internet, but I found I could use my DynDNS hostname to reach it without enabling BTTM. HOWEVER it still does not work, even combining it with adding the additional ports. – Justin Mrkva May 31 '11 at 4:17

Turn off all the Back to My Mac features on your Apple computers and disable Back to My Mac on Airport Extreme.

L2TP doesn't work because Back to My Mac is using 1701, 500, as well 4500. PPTP however can't be configured on the newest Airport firmware. It won't let you save the port 1723 TCP. I read Apple uses it for Lion Server VPN. I guess they reserved it for the server, but what if you don't have OS X Server and you use Windows 2008 Server R2?

I solved my problem by turning off all Back to My Mac on my computers and Airport. But I did set it back. I might set up the VPN in a different subnet with a new router. I guess that's the only possible fix I can see.

Anybody have an idea for a workaround? I wish Apple didn't use the VPN ports.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .