I have an AirPort Extreme (purchased about a month ago, so the latest model) and I have an iMac connected to it running a VPN server; the iMac has a static IP address on the network and is configured properly; I can connect to the iMac as a VPN client without trouble on the local network.

However, if I try to access it from outside the local network, the VPN connection fails with the following message:

Error Message

In AirPort Utility, I have the port mapping set up as follows:

Port Mapping

I also have SSH forwarding set up exactly the same but using TCP port 22 obviously. I have confirmed SSH works as expected and I have no trouble connecting, but the VPN fails. Again, if I'm inside the local network and replace the router's public IP address with the address of the VPN server ( it connects fine, but entering the router's public IP fails exactly the same way.

These exact UDP ports worked fine on the old Belkin router (though the router itself was sketchy) - any ideas why they no longer work on the AirPort Extreme? I already changed all the settings on the VPN server itself to match the 10.0.1.xxx local IP addresses assigned by the AirPort so there should be no issues there. I also added the iMac's address as the NAT Default Host; no dice.

Any thoughts?

FOLLOW-UP 1: Disabling Back To My Mac did NOT solve the problem.

FOLLOW-UP 2: Adding port 1723 and changing all ports to both TCP and UDP at the same time do NOT help.

  • Anyone have any ideas? Still trying to figure this one out... – Justin Mrkva Jun 1 '11 at 4:44
  • Did you solve this? I'm running into a similar issue and I've opened up ports 500, 4500, 1701 and 1723 for both UDP and TCP. – CadentOrange Mar 15 '16 at 18:12

Make sure you use a network enabled user if you have an open directory running, your local accouny you might have created before installing open directory does not support authentication for VPN tunnel


Make sure you do not have your base station set to do Back To My Mac. BTMM uses the IKE/ISAKMP port (500/UDP), and it gets in the way of the VPN port mapping.

  • Ah... I did have that enabled because I needed to perform configuration over the internet, but I found I could use my DynDNS hostname to reach it without enabling BTTM. HOWEVER it still does not work, even combining it with adding the additional ports. – Justin Mrkva May 31 '11 at 4:17

Turn off all the Back to My Mac features on your Apple computers and disable Back to My Mac on Airport Extreme.

L2TP doesn't work because Back to My Mac is using 1701, 500, as well 4500. PPTP however can't be configured on the newest Airport firmware. It won't let you save the port 1723 TCP. I read Apple uses it for Lion Server VPN. I guess they reserved it for the server, but what if you don't have OS X Server and you use Windows 2008 Server R2?

I solved my problem by turning off all Back to My Mac on my computers and Airport. But I did set it back. I might set up the VPN in a different subnet with a new router. I guess that's the only possible fix I can see.

Anybody have an idea for a workaround? I wish Apple didn't use the VPN ports.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.