3

For the life of me can not get my VPN working using PPTP or L2TP or anything.

My subnet is set to 192.168.13.1 to avoid conflicts.

I have tried to reach my desktop/server from my laptop/client using both from mobile phone WIFI and at a friends cabled internet. Both unsuccessful.

I am trying to use the built-in VPN functionality in Win7 (my desktop/server) and Win8.1 (my laptop/client) - both use Windows Firewall.

I have router TP-Link TL-R860. DSL modem is Efficient Networks Speedstream 5100.

I have set my desktop/server to always be the same IP address (useful for port forwarding)

Since I have been told I can not trust WIFI over mobile, I need to go to my friends each time testing a setup. This means I need to avoid any chance of me misconfiguring any ports... At this point I just want some kind of VPN working which is why I try open up for it all. In the end, I would probably like to use L2TP/IPSec.

Here is my current understanding of what I need to setup:

--router forward settings to my desktop/server computer--

Ports I am quite sure of:

  • 1723 TCP (PPTP)
  • 1701 UDP (L2TP)
  • 500 UDP (IPSec using IKE/IKEv2, e.g. used by L2TP)
  • 4500 UDP (IKE/IKEv2 and NAT-T)

My router does not support selecting "IP Protocol" - what to do?:

  • 47 IP Protocol (GRE for PPTP)
  • 50 IP Protocol (ESP for IPSec)

Ports to forward if using OpenVPN which I am not:

  • 443 TCP (OpenVPN-TCP)
  • 54 UDP (OpenVPN-UDP)

--router firewall settings--

  • off (I essentionally only have on/off here. I think on should work, but...)

--desktop/server computer inbound firewall rules--

  • 1701 UDP
  • 1723 TCP
  • 4500 UDP
  • 500 UDP

(are all these necessary?)

--desktop/server computer outbound firewall rules--

  • 1701 UDP
  • 1723 TCP
  • 4500 UDP
  • 500 UDP

(are all these necessary?)

--laptop/client computer inbound firewall rules--

  • 1701 UDP
  • 1723 TCP
  • 4500 UDP
  • 500 UDP

(are all these necessary?)

--laptop/client computer outbound firewall rules--

  • 1701 UDP
  • 1723 TCP
  • 4500 UDP
  • 500 UDP

(are all these necessary?)

In preparing for a new test, I need to understand what configurations (e.g. ports) I should open in firewalls, forward in router etc. to maximize the chance of something to work. In particular I have doubts about how to handle e.g. GRE?

--Results from running PFPortChecker--

  • 1701/UDP: port is open
  • 1723/TCP: port is open (required shutting down VMware services)

I found that IKEExt / "IKE and Auth and IPsec Keying Modules" service (svchost.exe) blocks the following ports. (I guess that is okay if Windows VPN uses tthis service)

If I let the IKEExt service running I got:

  • 4500/udp: some other application locked port
  • 500/udp: some other application locked port

If I shutdown the IKEExt service I got:

  • 4500/udp: port not open or reachable
  • 500/udp: port not open or reachable

For reference: I used netstat -anobv command to find out which porcesses/services blocked ports

3
+50
  1. You need to make sure you set your Windows 7 machine to have a reserved address on your router (so that it is always given the same LAN IP address).
  2. Set the port forwarding rule for the PPTP port (1723) to point to your Windows machine IP (the reserved one).
  3. If your router blocks VPN passthrough then you will need to check this (in the UK, VirginMedia's SuperHub blocks VPN passthrough and this catches people out) and enable it.
  4. Windows 7 has built-in "VPN server" capability
  5. HowToGeek have written a detailed "how-to" to configure Windows to be a VPN server - this works for both Windows 7 and Windows 8. There link is here
  • 1+2) already done, 3) as far as I know, it does not block, 4+5) exactly what I already tried :( – Tom May 28 '14 at 11:52
  • What errors do you get when trying to connect? – Kinnectus May 28 '14 at 11:55
  • connecting from my friends Win8.1: Default=800, PPTP=807, L2TP=809 – Tom May 28 '14 at 11:58
  • Have you manually edited the client VPN connection settings so that "automatic" VPN type is set to "PPTP"? – Kinnectus May 28 '14 at 12:01
  • 1
    In case of network doubt, you can always install & fire up Wireshark to do network analysis of what comes in/out of your PCs. You'll know which ports are trying to get out at one end and be able to see if you receive something at the other end – Remi Letourneau Jun 7 '14 at 1:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.