My workplace offers a Cicso VPN which I am trying to use from home (via ADSL) to work remotely. I believe the workplace's VPN is IPSec, as it requires me to have an IPSec ID and an IPSec secret to connect.

Connecting the VPN tunnel works fine, but it stops transmitting bytes soon after, making it impossible to do anything useful.

The interesting thing is that I can work just fine by using my mobile phone (4G) as a wireless access point and connect my laptop to that instead of my home's WiFi router attached to the ADSL modem.

I contacted my ISP about this problem and got an email response in which the following (among other things) was suggested:

  1. Enable Port Forwarding for the VPN port 500, ( for IPSec VPN's), port 1723 for PPTP VPN's, and port 1701 for L2tp- L2tp routing and remote access. Port 500 may be listed under the list of services. [...] Note: Check if the WAN IP is Public or Private. Ports can be opened on Public IP addresses only.

Is port forwarding technically really required client-side? If that was true, wouldn't that also prevent other people on my home network from doing the same thing from their laptops (say, if one of my co-workers visited my home and also wanted to connect to the office's VPN)?

  1. By default the router's firewall is configured to drop (delete) ICMP packets sent from outside your network to the WAN port. Your VPN may require the ICMP packets.

Again, is this necessary for getting a Cisco VPN operational on client-side?

Or, in other words: Has anyone using such a Cisco VPN had to open ports on their modem/router from where they want to connect to the VPN endpoint?


Port forwarding is generally not required – once the VPN client makes an outgoing connection, the router's firewall keeps it in the "state table" for a certain time period. (The state table tells it where to send incoming packets through the NAT, too.)

For TCP the state entry closely corresponds to the TCP connection itself – SYN establishes both, FIN tears down both.

However, for UDP (both Cisco VPN and 'standard' IPsec NAT-T), some router models use very short-lived state entries – for example, expiring them after 30 or even 15 seconds of inactivity. This would explain the issues you're having.

Try using vpnc --dpd-idle 10 for connecting (if on Linux), or leave a ping -t <some_corp_server> running during your VPN usage so that it won't be idle for a long period of time.

  • Thanks for your insights, I'll test what you said. You're right I think it is UDP. – FriendFX Jul 31 '17 at 6:27
  • I can't confirm nor disprove what you said: I tried connecting directly to my ADSL modem, which doesn't seem to do NAT at all - so I am guessing it allows connections on all ports. Also, pinging didn't help. It is a strange problem indeed. Accepted your answer anyway. – FriendFX Aug 2 '17 at 0:16
  • Don't accept wrong answers... – grawity Aug 2 '17 at 3:43
  • How do you know it is wrong? Could you provide the right answer? – FriendFX Aug 3 '17 at 2:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.