Level 1

1 points

Trouble connecting to VPN while outside local network

Hi,

I have setup a VPN on OS X Server and opened all the ports (Airport had this already put in for some reason) and I am using No-IP as the address and I can connect to the VPN within the local network using the No-IP address but when I go outside of the address and I have the ports point towards my Mac Mini running OS X Server (with Mavericks) but when I try to connect outside of the local network I get "The PPTP-VPN server did not repond. Try reconnecting. If the problem continues, verify your settings and contact your Administrator." this also happens for L2TP-VPN aswell.

Any help would be greatly apreciated I need this setting up ASAP as I need to be able to have an external office connecting to here so I can back up their Mac's locally.

Thanks,

Bruce

Mac mini, OS X Mavericks (10.9.1), OS X Server

Posted on Feb 12, 2014 1:25 AM

44 replies

Mar 17, 2014 7:43 AM in response to bruce00j

It is possible that the satalite router does not allow VPN passthrough

That is the question you should ask your ISP

bruce00j Author

Level 1

1 points

Mar 17, 2014 7:53 AM in response to William Bowden1

I phoned them up about this last week and they said nothing should be stopping it going through the satalite they only thing they quired was if the VPN had a latency cap of bellow 700/800 and I think the bad latency is due to it being a satalite router so unless there is something hidden that is forcing this then I would not know.

Thanks,

Bruce

Mar 17, 2014 7:55 AM in response to William Bowden1

Thats one thing, to ask about VPN passthrough, but I can't emagine that they would block it.

For me it sounds strange that your IPv4 address is the same as your public IP.

Usually you have a public IP thats reflected by the no-ip app. And the you build a private network inside your home with other ip addresses.

For me it really helped to watch the youtube sessions from Todd Olthoff. Check it out:

http://www.youtube.com/watch?v=xVfEicYfMTE&list=PLbR1g3FxrfmJ22SLY0W8OJ6_WDdhviK rU

He has several sessions about setting up your Apple Server.

Mar 17, 2014 8:15 AM in response to bruce00j

Well satalite puts a different light on this the only thing i can say is in racoon the unix program that deals with VPN you can change the time it waits for a reply but it is a dangerous thing to play with these settings

below is the part of the /etc/racoon/racoon.conf file if you note by default both phase one and 2 wait for 30 seconds if the logs show a hang up then its good to assume the client failed to respond within 30 seconds.

racoons own default is 10 seconds but apple upped it to 30

timer

{

# These value can be changed per remote node.

counter 10; # maximum trying count to send.

interval 3 sec; # interval to resend (retransmit)

persend 1; # the number of packets per a send.

# timer for waiting to complete each phase.

phase1 30 sec;

phase2 30 sec;

# Auto exit delay timer - for use when controlled by VPN socket

auto_exit_delay 3 sec;

}

bruce00j Author

Level 1

1 points

Mar 17, 2014 9:43 AM in response to William Bowden1

Thanks for the info but a ping of 800 doesnt even account to a second as far as I am aware any suggestions of what I should up the 30 sec wait up to if is required?

Thanks,

Bruce

Mar 18, 2014 12:44 AM in response to bruce00j

Hi bruce

What is it you are needing to do over vpn?

bruce00j Author

Level 1

1 points

Mar 18, 2014 2:06 AM in response to William Bowden1

Hi Will,

I am wanting to use the VPN to back up another office we have as well as be able to remote accsess it so I am able to provide help if something goes wrong and be able to controll their mac's

Thanks,

Bruce

bruce00j Author

Level 1

1 points

Mar 18, 2014 2:41 AM in response to bruce00j

Well I have finally found out as to why I can't use a VPN I managed to talk to someone with my broadband provider who knew what I was talking about and their router that they provide for the type of account we have with them blocks all ports and there is no way of changing it.

What sort of broadband provider does this?!

Mar 18, 2014 2:50 AM in response to bruce00j

Her is a solution if you travel with a laptop

it does require comandline but its simple

Install Brew if you have not done so http://brew.sh

once installed the do this is comandline brew install sshuttle

once installed you will need to reboot

now all you have to do is any time you want to vpn in from terminal go

sshuttle --dns -r any.address.com 0/0 -vv

from there all your traffic will go over ssh so to connect to remote mac type its ip in screen sharing and there you go

bruce00j Author

Level 1

1 points

Mar 18, 2014 3:49 AM in response to William Bowden1

I don't do much travelling really I wont be needing accsess to the computer outside office hours that much all I want to be able to do is connect the office I work in to the head office we have via a VPN and now I have found out I can not because of the satalite router we have been provided and the only way to change this is either change broadband provider (which may be happening anyway its just there is no good ones via good old fasioned cabling) or pay more for an account which allows us to modify ports in the satalite router.

Mar 18, 2014 4:13 AM in response to bruce00j

Thats ok there is always teamviewer I have over 20 clients and I use teamviewer to access them on my ipad iphone or laptop saved my life many atime when on train

bruce00j Author

Level 1

1 points

Mar 18, 2014 9:14 AM in response to William Bowden1

I know of teamviewer but this would not let me transfer a large amount of files would it? My primary use for a VPN is file transfer of documents at the end of the week the controlling of the macs is secondary really.

Is it possible to host an SSL VPN from my Mac mini at all? I have done some google(-ing) and come accross that SSL VPN can bypass blocked ports which is what I have and this would be of great use to me if it was possible!

Thanks,

Bruce

jmaline

Level 1

8 points

Apr 14, 2014 8:13 PM in response to Heinz Hegnauer

I had that same "invalid address parameter ... for ms-dns option" trouble. It cropped up when my server started getting a valid (globally routable) IPv6 address.

I found a fix. I go to the Server app VPN section. Click "Edit..." on DNS settings. Prior to this all was empty in the VPN DNS settings. I enter my one valid IPv4 DNS server address (just IPv4, no IPv6). It asks to restart VPN and I let it.

After this VPN connections work and no more of the "invalid address ... ms-dns option" in the log.

Aug 18, 2014 8:48 AM in response to bruce00j

bruce00j wrote:

Hi,

The router I am using is an Airport Timecapsual and I tried adding special characters in and I still got the same error message.

Thanks,

Bruce

Try removing special characters. I have a Time Capsule also and removing special characters fixed my issues!

Native iOS L2TP VPN not working on Lion Server

NIK

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Trouble connecting to VPN while outside local network