VPN Gateway - IP Routing Problem

Question

Level 2

290 points

VPN Gateway - IP Routing Problem

Greetings All.. I have a puzzler which I could use some help with.

I currently have a couple of LANs which are connected by external VPN Routers. Each of the LANs use static addresses within the 192.168.0.0/25 range. That is to say the network has been divided into 2 subnets with a netmask of 255.255.255.128 - The first subnet utilizing address from 192.168.0.1 to 192.168.0.127 and the second with addresses of 192.168.0.129 to 192.168.0.254

I now have to provide VPN access for a couple of road warriors who will be connecting from an unknown IP. The existing external VPN routers can't provide this functionality without installing software (a VPN Client) onto the remote hosts - and (of course) it doesn't support Mac OS X. Hence I need to achieve this with what I have.

As we have a few spare static IPs in the allocation from our ISP, I decided to set up one of the Xserves as a VPN Gateway - but I just can't seem to get it to route IP properly.

Here's what I've done so far:
Assigned the public IP to en1 - tested and confirmed I can connect to the internet
Assigned the private static IP to en0 - tested and confirmed I can access the internal network
Set en1 to the top of the service order list.
Configured the Firewall so that any traffic is allowed on 192.168-net and only the required ports are open to facilitate a VPN connection on any-net
Configured the VPN service to use L2TP with MS-CHAPv2 authentication and a shared secret and assigned an address range of 192.168.0.100 to 192.168.0.120 - which are not used on the LAN
Assigned the correct settings for the internal DNS and default search domain and specified a private route for 192.168.0.0/25
Enabled NAT and specified en1 as the WAN port.

In theory this should work... but although the remote host can connect to the VPN, authenticates OK and receives an IP address within the range 192.168.0.100 to 192.168.0.120, it is unable to connect to anything on the LAN.

Pinging the remote host from the server results in 100% packet loss. Pinging the server from the host results in a strange "Cannot Allocate Memory" error.

I'm guessing that this is probably something to do with an overlapping DHCP range - except I have static addresses on the LAN and DHCP is not turned on.

Any clues?

Thanks - Anton

Many and varied.. but all Macs, Mac OS X (10.5.5)

Posted on Nov 22, 2008 7:21 AM

Reply

Answer 1

MrHoffman

Level 10

146,821 points

Nov 22, 2008 8:20 AM in response to Anton Stewart

VPN routing wants unique subnets on each end. Accordingly, I try to avoid 192.168.0.0/24; everybody uses that range. Try testing with another within subnet in 10.0.0.0/8 or 172.16.0.0/12.

There are various firewall routers which are compatible with PPTP and L2TP, and these are supported by Mac OS X and Mac OS X Server. Other firewall routers can have VPN pass-through options.

If you're working with PPTP or L2TP and having trouble with your configuration, try the other.

Reply

Answer 2

Anton Stewart Author

Level 2

290 points

Nov 23, 2008 5:16 AM in response to MrHoffman

Thanks for your reply MrHoffman,

I certainly see your point about unique subnets at each end of the VPN.

So I tried both 10.0.0.0/8 and 172.16.0.0/12 on both PPTP and L2TP and I get the self same problem... client can connect and authenticate, gets handed an IP but that's as far as it goes.

I've tried with DHCP on and off... still no odds.

I would swear that I have the VPN gateway set up correctly.. but I must be missing something.

Any clues as to what this maybe?

Cheers - Anton

Reply

Answer 3

MrHoffman

Level 10

146,821 points

Nov 23, 2008 7:14 AM in response to Anton Stewart

This seems like a routing issue.

I'll assume the testing is with a remote (off-LAN) client.

Has a test with the clients configured to route all network traffic through the VPN (once the tunnel is established) been performed? This checkbox is in the tunnel options Advanced panel in the particular VPN. Toss all the traffic up the connection.

There's a log option in the Mac OS X VPN client, and most VPN servers offer some sort of a connection logging and connection diagnostic mechanism. If you're tunneling directly into Mac OS X Server with no intervening firewall(s), you can turn on verbose connection diagnostics on the server. If that checkbox is not already lit.

My general preference is to tunnel into a firewall, not directly into a server. For many reasons, that is easier to configure and manage.

Reply

Answer 4

Anton Stewart Author

Level 2

290 points

Nov 23, 2008 1:09 PM in response to MrHoffman

You were absolutely right about it being a routing issue, and the verbose logging was able to give me the pointers I needed to straighten it out.

So here's what fixed it...
I needed to setup a very small subnet in DHCP that consisted of just 2 addresses not currently assigned in the (static addressed) LAN and specified the LAN IP address of the machine as router and DNS. Started DHCP service.

Started DNS service - not necessary to set any zones, as it's just going to be used for DNS caching.

In VPN settings (L2TP) I specified a block of addresses (that would fall within the LAN subnet, but did not overlap the DHCP supplied addresses). Specified the server LAN address as the DNS in VPN Client Settings.

Enabled NAT with en1 as the external gateway.

Bingo - can route IP.

Thanks very much for the helpful suggestions.

Cheers - Anton

Reply