For the life of me can not get my VPN working using PPTP or L2TP or anything.
My subnet is set to 192.168.13.1 to avoid conflicts.
I have tried to reach my desktop/server from my laptop/client using both from mobile phone WIFI and at a friends cabled internet. Both unsuccessful.
I am trying to use the built-in VPN functionality in Win7 (my desktop/server) and Win8.1 (my laptop/client) - both use Windows Firewall.
I have router TP-Link TL-R860. DSL modem is Efficient Networks Speedstream 5100.
I have set my desktop/server to always be the same IP address (useful for port forwarding)
Since I have been told I can not trust WIFI over mobile, I need to go to my friends each time testing a setup. This means I need to avoid any chance of me misconfiguring any ports... At this point I just want some kind of VPN working which is why I try open up for it all. In the end, I would probably like to use L2TP/IPSec.
Here is my current understanding of what I need to setup:
--router forward settings to my desktop/server computer--
Ports I am quite sure of:
- 1723 TCP (PPTP)
- 1701 UDP (L2TP)
- 500 UDP (IPSec using IKE/IKEv2, e.g. used by L2TP)
- 4500 UDP (IKE/IKEv2 and NAT-T)
My router does not support selecting "IP Protocol" - what to do?:
- 47 IP Protocol (GRE for PPTP)
- 50 IP Protocol (ESP for IPSec)
Ports to forward if using OpenVPN which I am not:
- 443 TCP (OpenVPN-TCP)
- 54 UDP (OpenVPN-UDP)
--router firewall settings--
- off (I essentionally only have on/off here. I think on should work, but...)
--desktop/server computer inbound firewall rules--
- 1701 UDP
- 1723 TCP
- 4500 UDP
- 500 UDP
(are all these necessary?)
--desktop/server computer outbound firewall rules--
- 1701 UDP
- 1723 TCP
- 4500 UDP
- 500 UDP
(are all these necessary?)
--laptop/client computer inbound firewall rules--
- 1701 UDP
- 1723 TCP
- 4500 UDP
- 500 UDP
(are all these necessary?)
--laptop/client computer outbound firewall rules--
- 1701 UDP
- 1723 TCP
- 4500 UDP
- 500 UDP
(are all these necessary?)
In preparing for a new test, I need to understand what configurations (e.g. ports) I should open in firewalls, forward in router etc. to maximize the chance of something to work. In particular I have doubts about how to handle e.g. GRE?
--Results from running PFPortChecker--
- 1701/UDP: port is open
- 1723/TCP: port is open (required shutting down VMware services)
I found that IKEExt / "IKE and Auth and IPsec Keying Modules" service (svchost.exe) blocks the following ports. (I guess that is okay if Windows VPN uses tthis service)
If I let the IKEExt service running I got:
- 4500/udp: some other application locked port
- 500/udp: some other application locked port
If I shutdown the IKEExt service I got:
- 4500/udp: port not open or reachable
- 500/udp: port not open or reachable
For reference: I used netstat -anobv command to find out which porcesses/services blocked ports