Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

User profile for user: chee1987
chee1987 Author
User level: Level 1
0 points

Setup VPN on Mac Mini Server running OSX through a BT Hub Router

Hello everyone,


I know this question has been posted several times and I have looked at the suggested solutions, trying each of them. I think this is really down to my lack of knowledge hence hoping someone out there could point me to the right direction for more resources / information, please.


I am trying to setup a Mac Mini Server with VPN access. My server sits behind a BT Hub router. These are the steps that I have been through:

1. I am using the server app and after registering a free account with no-ip, I got myself a host name <myname>.ddns.net.

2. Then I setup the server using a domain name

3. I configured the DNS by first setting up a primary zone - zone: ddns.net. Then added machine record host name: <myname> pointing to my server which I have configured my router to assign a static ip address to it at 192.168.x.x

4. Then, I configured the VPN setting up for L2TP and PPTP, setup the shared secret, change the ip address range to match that of the DHCP range on my router. My router by default has a DHCP range between 64 - 253.

5. Then, I also configured my router to port forward 500, 1701, 1723, and 4500 to my server at 192.168.x.x (I selected both TCP and UDP).

6. Finally, setup a user account with account name test and password abcd12345

7. Gone on my "client" machine which is basically my Samsung S4 handphone, selected VPN -> PPTP -> server address: <myname>.ddns.net -> entered account name test and password abcd12345.


This didn't work.


Then, I read some post about manually configure DHCP on the server app. Went on the server app, turned on DHCP and setup a network named TestDHCP. Assigned ip address range between that of the default DHCP range on my BT Hub router.


This does not work either.


Could someone please kindly help me with it? I am completely lost.


Thank you in advance.

Posted on Jul 11, 2014 7:12 AM

Reply
Question marked as Best reply
User profile for user: Linc Davis
Linc Davis
User level: Level 10
209,541 points

Posted on Jul 11, 2014 8:29 AM

To run a public VPN server behind an NAT gateway, you need to do the following:

1. Give the gateway either a static external address or a dynamic DNS name. The latter must be a DNS record on a public DNS registrar, not on the server itself. Also in the latter case, you must run a background process to keep the DNS record up to date when your IP address changes.

2. Give the VPN server a static address on the local network, and a hostname that is not in the top-level domain "local" (which is reserved for Bonjour.)

3. Forward external UDP ports 500, 1701, and 4500 (for L2TP) and TCP port 1723 (for PPTP) to the corresponding ports on the VPN server.

If your router is an Apple device, select the Network tab in AirPort Utility and click Network Options. In the sheet that opens, check the box marked

Allow incoming IPSec authentication

if it's not already checked, and save the change.

With a third-party router, there may be a similar setting.

4. Configure any firewall in use to pass this traffic.

5. Each client must have an address on a netblock that doesn't overlap the one assigned by the VPN endpoint. For example, if the endpoint assigns addresses in the 10.0.0.0/24 range, and the client has an address on a local network in the 10.0.1.0/24 range, that's OK, but if the local network is 10.0.1.0/16, there will be a conflict. To lessen the chance of such conflicts, it's best to assign addresses in a random sub-block of 10.0.0.0./0 with a 24-bit netmask.

6. "Back to My Mac" is incompatible with the VPN service. It must be disabled both on the server and on an AirPort router, if applicable.

If the server is directly connected to the Internet, see this blog post.

View in context
25 replies
Question marked as Best reply
User profile for user: Linc Davis
Linc Davis
User level: Level 10
209,541 points

Jul 11, 2014 8:29 AM in response to chee1987

To run a public VPN server behind an NAT gateway, you need to do the following:

1. Give the gateway either a static external address or a dynamic DNS name. The latter must be a DNS record on a public DNS registrar, not on the server itself. Also in the latter case, you must run a background process to keep the DNS record up to date when your IP address changes.

2. Give the VPN server a static address on the local network, and a hostname that is not in the top-level domain "local" (which is reserved for Bonjour.)

3. Forward external UDP ports 500, 1701, and 4500 (for L2TP) and TCP port 1723 (for PPTP) to the corresponding ports on the VPN server.

If your router is an Apple device, select the Network tab in AirPort Utility and click Network Options. In the sheet that opens, check the box marked

Allow incoming IPSec authentication

if it's not already checked, and save the change.

With a third-party router, there may be a similar setting.

4. Configure any firewall in use to pass this traffic.

5. Each client must have an address on a netblock that doesn't overlap the one assigned by the VPN endpoint. For example, if the endpoint assigns addresses in the 10.0.0.0/24 range, and the client has an address on a local network in the 10.0.1.0/24 range, that's OK, but if the local network is 10.0.1.0/16, there will be a conflict. To lessen the chance of such conflicts, it's best to assign addresses in a random sub-block of 10.0.0.0./0 with a 24-bit netmask.

6. "Back to My Mac" is incompatible with the VPN service. It must be disabled both on the server and on an AirPort router, if applicable.

If the server is directly connected to the Internet, see this blog post.

Reply
User profile for user: chee1987
chee1987 Author
User level: Level 1
0 points

Jul 14, 2014 2:45 AM in response to Loner T

Hi Loner T,


Is this the interface that you are referring to? Please do let me know if I am attaching something entirely wrong.


User uploaded file

192.168.1.112 is the ip that I have reserved for my server.


I do not have Wireshark - I did a port check using canyouseeme.org. I realised that only port 1723 is open. Apologies for my lack of knowledge, initially I thought I setting up port forwarding on 500, 1701, and 4500 would automatically mean that I am allowed to use them. So if they are not opened, does it mean that I do not actually have access to these ports despite being able to set them for port forwarding?

Reply
User profile for user: chee1987
chee1987 Author
User level: Level 1
0 points

Jul 14, 2014 2:57 AM in response to Linc Davis

Hi Linc Davis,


I have been trying to connect while connected to the same wireless network transmitted by the same router where my server is wired to. However, I could not get it to connect. I am currently using the ukisl.ddns.net -> I registered this with noip.com and have their noip DUC running on the MAC. I tried changing my server setting to use <servername>.private and reconnect but no luck too.


By the way, I am using a Windows laptop, does that affect what I am doing?


Thank you.

Reply
User profile for user: Loner T
Loner T
User level: Level 9
59,471 points

Jul 14, 2014 5:30 AM in response to chee1987

If nslookup (or dig) of <myname>.ddns.net matches the WAN IP of the BT Hub Router, then one simple test would be telnet <myname>.ddns.net 1723. It should connect.


One simple way to find your WAN IP is using whatismyip.com


You can download Wireshark from www.wireshark.org for free. It is very nice tool and also has command-line utilities. If you have the ability to port-mirror on the LAN side on your BT Hub, it should make this a bit better to debug.

Reply
User profile for user: chee1987
chee1987 Author
User level: Level 1
0 points

Jul 14, 2014 6:03 AM in response to Loner T

Hi Loner T,


I did as what you said: nslookup and was returned Non-authoritative answer with name and address matching what I've got.


Then, I tried telnet <myserver>.ddns.net 1723 - I got it to connect. It says Connected to <myserver>.ddns.net


Then, I tried again with telnet <myserver>.ddns.net 1701 - It says connection refused. Unable to connect to remote host.


So, I guess this mean that the port is not opened?


Thank you.

Reply
User profile for user: Loner T
Loner T
User level: Level 9
59,471 points

Jul 14, 2014 6:29 AM in response to chee1987

You are running telnet (TCP) on a port which is a UDP one. I would not expect a response. A better way is to use something like iPerf which can be configured as a UDP or TCP listener on an arbitrary port. When you run telnet do you see packets cross your BT hub and get to the Lan side? A port-mirror would be really useful at this point.

Reply
User profile for user: chee1987
chee1987 Author
User level: Level 1
0 points

Jul 14, 2014 6:42 AM in response to Loner T

I am not entirely sure about that. This is what I got when I did the telnet


Trying 192.168.1.112...

Connected to <myserver>.ddns.net.

Escape character is '^]'.

^]

Connection closed by foreign host.


By the way, I have just got WireShark installed, if you could point me to some resources, perhaps I could try to perform some test, please?

Reply
User profile for user: Loner T
Loner T
User level: Level 9
59,471 points

Jul 14, 2014 9:02 AM in response to chee1987

You want to test the connection from the 'outside' as a check. If you are 'inside' your network, it may be confusing.


In Wireshark, you want to filter for the ports that you have opened, in front of the BT Hub (on the WAN side) and behind it (on your LAN side) and see if packets from your telnet arrive. The Telnet test can be done using Windows. Your phone is 'outside' via the 3g/4g radio, unless you connect to your WiFi AP from 'inside'.


You can look for man pages for the command line utilities of wireshark like tcpdump or tshark and set up an appropriate filter.

Reply

Setup VPN on Mac Mini Server running OSX through a BT Hub Router

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.
Learn more Sign up