13 Replies Latest reply: Mar 24, 2008 12:32 PM by andrussuitsu
Mike Matthews Level 1 Level 1 (10 points)
Hi:

I've set up our XServe with MacOS X Server 10.5.2 to do AFP and VPN (L2TP only; PPTP is disabled). The XServe is a standalone server, not connected to any other direstory server.

I can connect to the XServe's AFP server from my Mac over our wired and wireless network. The AFP server shows up in the sidebar of Finder windows. So far, so good.

I am able to successfully connect to our network via the VPN with Mac OS X 10.5.2 client (on two different machines) using L2TP through our network's firewall (on a Netopia T1 router; UDF ports 500 and 4500 and IP Protocol 50 and 51 are open) using a shared secret.

But I cannot connect to the XServe itself to use Server Admin or AFP (using afp://server.company.com or afp://xxx.xxx.xxx.xxx via the Go > Connect to Server command).

The error I get while connecting to the 10.5.2 AFP server is Some data in apf://server.mycompany.com could not be read or written (Error Code -36 ). I saw this error associated with a SMB problem in 10.4.x, but SMB is not running.

Other iChat users in my office also do not automatically show up in the Bonjour list when I connect to the network. Other computers on our network do not appear in the sidebar of a Finder window. (I'm told these are to be expected, as Bonjour isn't supported (in the "local area Bonjour" over a WAN link - it's purely a multicast feature on the network in the office, and won't be routed across the VPN link. True?)

Now, here's the odd part. There is a second server (v10.4.11) on our network running AFP. I can connect to it (using afp://server.company.com via the Go > Connect to Server command) and mount its various sharepoints via the VPN.

The only thing I see in the VPN log that seems amiss is this (but I have no idea what it means):
Tue Mar 11 23:09:27 2008 : Unsupported protocol 0x8057 received

--Both the 10.5.2 and the 10.4.11 servers have DNS properly configured (though our ISP; we're not running our own DNS).
--Both servers and the client have public IP addresses and have the same subnet mask. Network Utility confirms this while connected to the VPN.
--NAT is not running. The ISP is responding with public IPs for the servers.
--The firewall for the 10.5.2 server is not running (but will be once I get this all working).
--The IP address range for the VPN server doesn't overlap our DHCP pool (which also currently uses public IP addresses).
--Any user can access any service.
--No network routing definitions have been set up.
--In essence, I've followed the steps on Pages 141-142 of the Network Services Admin Guide.

One other note: After I connect, the Network Preferences > VPN > Advanced > TCP/IP window shows the IP address for the client just fine (assigned from the VPN pool), but lists the router as having the IP address of the XServe (rather than the router on the network). Is that normal?

I'm hoping I don't need to have the XServe run DNS as an internal LAN DNS server.... And I'm not sure why I would have to if I can already successfully connect to the 10.4.11 AFP server .

What simple step am I missing?

TIA,
mm

Xserve, Mac OS X (10.5.2), OS X Server 10.5.2
  • Mike Matthews Level 1 Level 1 (10 points)
    One more thing.

    I've seen this posted elsewhere in response to a similar problem (http://discussions.apple.com/thread.jspa?messageID=6172417&#6172417)

    "Once on VPN you need to connect to the internal address of the server, not the public address."

    This sounds like the solution to my problem, but how do you do that if the server has only a public (that is, non 192.168.x.x or 10.0.x.x) address?

    mm
  • andrussuitsu Level 1 Level 1 (65 points)
    Your server needs to have more than 1 IP address for you to access its resources using VPN. It does not matter if it is a private or public IP. You don't need to use a separate interface, just setting up an alias will do.
  • Mike Matthews Level 1 Level 1 (10 points)
    OK, so how do I do that? GUI? CLI?

    Do I simply add another ethernet service in the Network System Preference? And won't that screw up the DNS? I wouldn't want to have my Xserve's FQDN point to two different IP addresses, would I?

    Thanks,
    mm
  • andrussuitsu Level 1 Level 1 (65 points)
    System Preferences - Network. Press the '+' button, select your already used Ethernet interface, enter something like 'VPN access' for the Service Name and press Create. Then configure it by entering the IP address and netmask ONLY. Everything else is read automatically from the base configuration.

    Open Terminal and type ifconfing to see the configuration. You should see two IP addresses listed on the Ethernet interface.

    Whichever IP you connect to, use the other one to access local resources on the server. For consistency reasons it would make more sense to make the VPN connection to the alias IP and then connect to the familiar server IP to access local resources.
  • Leif Carlsson Level 5 Level 5 (4,950 points)
    "I am able to successfully connect to our network via the VPN with Mac OS X 10.5.2 client (on two different machines) using L2TP through our network's firewall (on a Netopia T1 router; UDF ports 500 and 4500 and IP Protocol 50 and 51 are open) using a shared secret."

    I suspect you mean UDP ports and you might need UDP port 1701 open too.

    You only need IP protocol 50 (ESP), protocol 51 (AH) isn't used. And ESP is only used when client and server isn't behind NAT (when NAT is used only the UDP ports are used).

    "Unsupported protocol 0x8057 received"

    This is usually seen when you can't get GRE through but since you don't use PPTP I can't be sure why this is registered in the logs. Sometimes when connecting using PPTP you have to disconnect and then reconnect for everything to work - you might try this for L2TP too.

    But if you already can reach services on any LAN nodes through the VPN I wouldn't bother with it.

    As you have a firewall in front of the server you need a second alias IP on the server that you can use to get at the services running on the server through the VPN. The firewall blocks all ports protocols not opened - that's why you can't use the server main IP even if the VPN is up.

    The netmask is used by all nodes to determine how big your subnet is: what part of the IP number is the network number and what range the node number is in => really: should traffic be directed to a node on the same LAN or sent directly to the gw/router for forwarding.

    What you can't do is connect from a NATed network to another NATed network that both are using the same network number. (That's why people should stay away from using the "default" 192.168.0.0/24 and 192.168.1.0/24 networks for VPN server LANs).

    Try your settings at http://www.jodies.de/ipcalc to see what I mean.


    "...lists the router as having the IP address of the XServe (rather than the router on the network). Is that normal?"

    Yes. The VPN server is the VPN gw/router.


    "The firewall for the 10.5.2 server is not running (but will be once I get this all working)."

    If you already have a firewall in front of your servers that is a bit redundant.


    "--No network routing definitions have been set up."
    "I'm hoping I don't need to have the XServe run DNS as an internal LAN DNS server"

    You need routing definitions if you want to setup a split tunnel VPN or all traffic is routed through the VPN when connected. The VPN becomes the default gw.

    Without ipforwarding ON in the server you can only reach nodes on the server LAN - not Internet.

    DNS is needed for your servers forward and reverse names/IPs for advanced services but doesn't need to run in any of your own servers.


    If you decide to do a split tunnel VPN config (adding public and private routing definitions) a reachable DNS IP for VPN clients (in VPN config on server) is needed for VPN clients or they can't use names to find anything. To reach this DNS IP if public/not on your server LAN, you need your server to forward IP DNS lookups and have a routing definition for it.

    A split tunnel VPN only send traffic for your server LAN through the VPN and all other traffic directly to the local gw/router (Internet).
  • Leif Carlsson Level 5 Level 5 (4,950 points)
    "It does not matter if it is a private or public IP" - yes it does.

    You only need a second IP if the server use only public IPs (and have a firewall running - which you should).

    Message was edited by: Leif Carlsson
  • Mike Matthews Level 1 Level 1 (10 points)
    Hi:

    OK, still not there yet.

    I made a duplicate of my en0 settings with a new second public IP and still can't connect. I also duplicated my firewall rules for the second public IP to match the original IP on en0. No luck.

    Also, I found this <http://macosxhosting.wordpress.com/2008/01/24/optimizing-an-xserve-for-web-hos ting/>:

    Assuming you have already acquired the domain names and IP addresses you’ll be using, the first step in creating an IP-based hosting setup is to configure the Xserve to have multiple IP addresses on the same Ethernet card. This can be done from System Preferences on the Xserve. Open the Network Preferences pane. Select “Active Network Ports” from the Show drop-down menu. Choose the port corresponding to the Ethernet card that you want to assign multiple IP addresses to, and click “Duplicate.” Then simply change the duplicate configuration to reflect the second IP address. It is necessary also to make sure that the Subnet Mask setting for all but one of the ports is 255.255.255.255. This will prevent conflicts in the routing tables.

    On a headless Xserve, the same thing can be accomplished with the IPAliases startup item. If the file /etc/IPAliases.conf doesn’t exist, create it. For each additional IP address, this file should contain one line of the form

    interface:IPaddress:netmask

    For example, to add the IP address 192.168.50.210 to the en0 network interface, the following line would be used:
    en0:192.168.50.210:255.255.255.255

    The netmask should always be 255.255.255.255.

    In addition, IP aliases must be turned on, by adding to /etc/hostconfig the line
    IPALIASES=-YES-

    Every time the system is booted, the aliases listed in /etc/IPAliases.conf will be added. The file can contain any number of aliases.



    Should the subnet mask for the second public IP address be 255.255.255.255 (to differentiate from the 255.255.255.128 of the first IP address on that same port)? And if I edit these two files by hand, won't I have to continue to do that every time there's a software update or if I add a service?

    I was reserving the second ethernet port on the Xserve for lights out management, but I'm thinking maybe I should just use that port for the VPN. Would that be an easier fix?

    Appreciate the help so far. Please keep it coming.

    mm
  • andrussuitsu Level 1 Level 1 (65 points)
    This is the first time I read that an alias IP address should have netmask 255.255.255.255. For years we have had our company VPN server running on Windows Server having an alias IP address and netmask for both IP addresses was 255.255.255.0. I assumed that it would be the same for OS X and this is how I have configured our new XServer and the VPN actually works. So I am a bit confused now. Maybe somebody with more knowledge can shed some light.
  • Leif Carlsson Level 5 Level 5 (4,950 points)
    "I made a duplicate of my en0 settings with a new second public IP and still can't connect."

    You only need IP number and netmask.


    "I also duplicated my firewall rules for the second public IP to match the original IP on en0."

    In the Netopia router? This second server IP should have no access from Internet, only from server LAN/IP/VPN.


    "is necessary also to make sure that the Subnet Mask setting for all but one of the ports is 255.255.255.255. This will prevent conflicts in the routing tables."

    Never had any trouble with using the same subnetmask as the "real" interface.


    "On a headless Xserve, the same thing can be accomplished with the IPAliases startup item."

    I have only used the Network pref pane to set this up and it works.


    "Should the subnet mask for the second public IP address be 255.255.255.255"

    Hm... does maybe not matter but 255.255.255.128 should work fine.

    Your second serve IP is in the right half of your network (1-126 or 129-254)? Same as the first one?

    And you connect to the real IP with the VPN and then use the second one to get at services in the server?


    "I was reserving the second ethernet port on the Xserve for lights out management, but I'm thinking maybe I should just use that port for the VPN. Would that be an easier fix?"

    No, you would need to enable the firewall and NAT and force the second interface up. At least if you want to be able to reach Internet from a VPN connection. LOM can use the first port (need to be connected to the network).

    (Your LAN switch haven't got LACP capability?)
  • Mike Matthews Level 1 Level 1 (10 points)
    All:

    OK, I think it's working and I have no clear idea why. But here's what I did:

    • I deleted the previous duplicate ethernet service and started over, giving it a new name. (It wouldn't accept the old name a second time; I believe somewhere in a config file that old name is preserved. Not a big deal, so far.)

    • I included just the second IP address and subnet mask.

    And it seems to work.

    I can connect to the VPN server using either the FQDN or first IP address and then access the AFP server on the same Mac by using the second IP address. I cannot access the AFP server via a FQDN and it doesn't appear in the sidebar of Finder windows.

    But I still cannot connect to the VPN using the second IP address.

    What I'd ideally like to do is access the VPN server via the second IP address and access the AFP server by using the FQDN that our users will be accustomed to, as andrussuitsu mentioned:

    "Whichever IP you connect to, use the other one to access local resources on the server. For consistency reasons it would make more sense to make the VPN connection to the alias IP and then connect to the familiar server IP to access local resources."

    Switching the order of the services in the Network pref pane to list the VPN first followed by Ethernet 1 didn't work. I guess I could erase and reinstall the software (not that big a deal; this isn't a production server yet) and during the set-up process use the second IP address for the IP address of the server and then use the first IP address of the FQDN as the duplicate service. But that seems like a bit of a hassle.

    Anyone know if that would work? Or of an easy way to accomplish this?

    Thanks to all who've helped so far.

    mm
  • andrussuitsu Level 1 Level 1 (65 points)
    Do you have set firewall rules allowing you to connect to the second IP address? I cannot think of another reason right now. Look at the VPN log and see if there is any activity at all when you connect to the second IP. If not, then I'd say the firewall rules are not in place.
  • Mike Matthews Level 1 Level 1 (10 points)
    All the same ports (UDP 500, 4500, and 1701; IP protocols 50 & 51) are open for both static IP addresses on the Netopia router's firewall.

    And the log shows:

    IPSec connection started
    IPSec connection established
    ...then 20 seconds later...
    L2TP cannot connect to server

    There's no firewall running on the xServe itself.

    mm
  • andrussuitsu Level 1 Level 1 (65 points)
    Hmm... I have not really tried L2TP, only PPTP. Maybe this a specific issue related to L2TP :-S