Access intranet with VPN through PPPoE

I use OpenVPN in my routers. With that package you use a directive called "push route" on the VPN server to open a path between VPN client and other devices on your internal LAN.

I don't know if Apple VPN has this directive or not.

Looks like the equivalent directive in Apple VPN is "offeredroutes".

See the man page for vpnd and this discussion:

http://the-mac-os-x-server-mailing-list.10970.n7.nabble.com/VPN-routes-for-clien ts-how-to-setup-td569.html

For a NAT'd network, please utilize one of the designated private IP address blocks (a subnet within 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16), and out of real and routable public IP address space; if your 1.0.0.0/8 routes should leak out — hopefully your ISP is configured to prevent that from happening — then your network activity could get very much more interesting. Your remote access via VPN may well be running into a routing issue, if there's a better IP route to 1.0.0.0/8 available elsewhere, too. There won't be a public route to one of the private blocks.

I agree - it does sound like the server is failing to recognize LAN packets directed to your VPN client and route them.

My only other suggestion is to consider using one of the usual private IP ranges on your LAN.

10.x.x.x or 192.168.x.x instead of 1.1.x.x.

The range you are using could be confusing to the server's routing logic. It may be sending them to the internet instead of your VPN client.

Just a suggestion

Computers of all kinds are often frustrating. If you like windows by all means use it.

Others are able to use the service you are having problems with. Something specific about your set up is defeating VPN.

Like a firewall issue or conflict on a port needed by VPN.

This might be a clue:

"OS X Server VPN service, Back to My Mac. Note: Configuring Back to My Mac on an AirPort Base Station or Time Capsule in NAT mode will impede connectivity to an OS X Server VPN service behind that NAT."

See this link:

http://support.apple.com/kb/HT6175?viewlocale=en_US

Good luck.

If Microsoft Windows better meets your needs, then by all means use it. Windows Server is a very capable server operating system environment, and very widely deployed.

I see you're using Internet connection sharing. I prefer to avoid that — trying to get OS X to act as a NAT router has been a longstanding issue, and having it exposed in this fashion tends to allow remote folks to poke directly at it. Short of fairly involved ccommand line configuration sequences, here are very few controls over that capability, as well. Given you're entirely public addresses and with no NAT, I'd tend to expect routing problems with trying to reach that NAT'd network.

In general, I'd have a firewall-gateway-router-NAT box connected to your ISP bridge, and having that handling NAT and either with an embedded VPN server, or with VPN pass-through.

if you don't want to configure that, then you'll probably want to get a second public static (routable) IP address from your ISP, and assign that to your target box. You can then connect directly, without NAT, using that IP address. No passthrough, no NAT.

At least so far, nothing discussed here is specific to Windows or to OS X, either. All of what's being discussed are IP and DNS networking configuration details, and the usual hassles that are VPNs. (I also generally don't prefer to use VPN passthrough, as I've found it to be fussy around NAT.)

VPNs generally do not require specification of routes, though I've had a few cases where I've had to specify one due to the local network and target configuration: Here's an example of adding a route, but this applies to reaching the target network via a working NAT box:

sudo route add 10.20.30.0/24 -interface ppp0

OZone. wrote:

There is no firewalls or NATs between OS X Server and internet. Direct connection through bridge. I can see all the packets going into server. They does not go to VPN back.

I'd either use NAT (and preferably a valid private block), or get a few more public addresses from the ISP network provider. I'd not use the 1.0.0.0/8 block, as that block is a real and routable IPv6 block, and was assigned to APNIC in 2010.

I'd get a firewall in general, as I don't trust OS X Server to keep all of its ports secure against remote probes.

With a firewall (preferably with an embedded VPN server) there's little reason not to use NAT. Well, not unless additional public static IP addresses are available, and available sufficiently cheaply.

NAT also usually expects use of one of the three private address blocks (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16), and properly-functioning routers will generally prevent those blocks from being presented as routable.

In effect you are using a Mac mini as a router. More often folks use an airport or similar device with NAT as their primary connection. Your problem seems to arise from a conflict between internet connection sharing and vpn on the Mac.

I can't find much documentation on how internet connection sharing works under the covers.

I think you have two choices:

1) acquire a router and put it in front of you Mac. Turn off internet connection sharing.

2) figure out how to override this not well documented feature of osx.

Here are some links that may help

http://blog.macminicolo.net/post/67570761408/setup-a-vpn-server-with-mavericks-s erver-10-9

https://developer.apple.com/library/mac/documentation/Darwin/Reference/Manpages/ man8/pfctl.8.html

Good luck

not sure why you activated internet sharing on the mac mini ? From what to what. I did tried it a couple of time but now I have a wireless router and no need for it.

Have you solve your problem ?

I use to have a Mac pro with two ethernet port configure to be expose to public network

Now, I much prefer to have a router between my Mac and the external network. Mac Server use to a have much more fine control over the firewall. Now I use the router for it. The server does not need to have a public IP, only the router, and forward the service you want to the machine you want.

The Mac Mini only has one ethernet port.

Internet sharing only work from one network interface to another, what do you use, as a second port for internet sharing ?