can't get VPN to work behind Cayman dsl modem / router

RouterOS General
1

I can’t get L2TP to work with an RB750 behind an AT+T supplied Cayman 3220-H modem-router.
The RB750’s VPN settings are the same as my home RB133 that works fine.

I have tried Cayman’s pinhole settings to allow UDP port 500 traffic through, and setting their NAT server to the RB750’s WAN IP, but still get a Microsoft 789 error message.

For some reason the Cayman has a public IP scheme (/29) on the LAN side. Normally when I see these Caymans they have a 192.168.x.x scheme on the LAN side, I wasn’t involved when this client had their dsl installed, not sure if this is causing the problem. Winbox works fine through the 750’s public IP. Torch doesn’t show the client PC’s IP address at all when I try to connect with the client, windows 7.

At+t’s tech support (sounded like a script reader) wasn’t much help. When I asked about putting the Cayman in bridge mode I got the impression they didn’t know what the outcome would be, I’d hate to change it and take the client offline while experimenting to get this working.

The only forum search hit I got for Cayman didn’t have anything to do with VPNs.

2

Does Packet Sniffer (with filter on client IP) show any packets from client?
Do you use IPSec with L2TP? If not, AFAIK you should forward port 1701 and ensure that VPN gets encrypted.

3

Packet sniffer does show the XP client IP in the source column, 5 entries of the 30 seconds I had the sniffer running while trying the connection, port 500 UDP.

One thing I just found out is that my Win 7 netbook can connect to my L2TP VPN but not an XP client with the same settings in the client. I do have a preshared key in IPSEC.

4

Can you run Packet Sniffer on your home router to see what more ports/protocols L2TP VPN uses?
These may be UDP ports 1701 and 4500.

5

Port 500 was the only one being used. I exported both ipsec rules to post here and noticed that my peer address was 0.0.0.0 in the non working router, but 0.0.0.0/0 in the working one. Once I added the trailing zero it worked right away.

And to think all these years I thought a trailing zero to the right of a decimal point was insignificant…

6

And to think all these years I thought a trailing zero to the right of a decimal point was insignificant…

That’s funny.