Hello all,
First post here and hoping I can get this resolved. I’m having a heck of a time getting IOS devices to VPN into my Tik network behind a Verizon modem/router.
I have the RB3011 set in the Verizon DMZ. I’ve also tried adding port forwarding rules (UDP 500, 1701, 4500 any, GRE, ESP and AH) to the RB3011 on the Verizon as a “pass-through”, but still will not connect.
PPTP connections work without any issues connecting and have full access to the network.
Does Verizon block these ports or something??
I’ve also tried using L2TP or IPSec on the IOS devices and neither will work.
Does anyone have any input for me that I could maybe track down or research?? I’d really appreciate it!!
Thanks,
cmaney
January 15, 2018, 4:51pm
2
The easiest/best solution is to call Verizon and tell them you need the modem in Bridge mode. Depending on the model of modem, they sometimes have a setting called “Cascaded router” that can also work, but is a bit counterintuitive to setup. They should be able to either do it remotely and walk you through it in a few minutes (after you finally get them on the phone).
Basically, the Mikrotik is already a better firewall than their device, and by putting them in bridge mode, you know they’re not filtering anything to you. Plus, you avoid the double-NAT of the Mikrotik and their router/modem.
Good luck!
Thank you for the reply.
This is an option. But doesn’t this solution stop any of the Verizon apps, callerid, and STB Guide from functioning? My client would like to retain all of these.
The modem/router in question is the newer Actiontec MI, something or other. Can’t remember the model number off the top of my head.
Cmaney is correct. Bridge mode is the way to go here.
I just did this for a client. The Guide works by downloading the guide and other information and then sending it over the COAX cable to the boxes. All you have to do is plug the WAN port on the verizon router into an open port on the Mikrotik. Add that port to the bridge. Essentially, you are double NATTING the Verizon box, but that doesn’t matter. I would also turn off WiFi on the Verizon router since the Actiontek routers Verizon uses are basically worthless.
Ok, thanks for the reply. I guess really the only thing standing in the way is dealing with Verizon tech support to allow my Tik to plug into the ONT? Correct?
I’ll have some hurdles to get the required info but seems doable.
OK, hey guys, I need to re-hash this.
We have changed topology for this site as follows:
ONT Ethernet> Tik Ether 1 (Gateway)> Other local Lan equipment, including Verizon modem/router.
Verizon is receiving private IP from tik and the VOD, on-screen guide are working normally.
Client doesn’t care about fios app, as long as we get vpn from his iphone.
Here is my config that I set on the Tik. Still unable to connect. If anyone can see an issue, could you please point it out?? Much appreciated!!
/interface bridge
I didn’t check the whole config but for me this was important:
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha512,sha256,sha1
/interface l2tp-server server
set default-profile=vpn enabled=yes ipsec-secret=vpnsecret use-ipsec=yes
After that use L2TP VPN Type on the iOS device.
CZFan
January 31, 2018, 8:45pm
9
If by IOS you are referring to Apple devices and not Cisco, Apple have stopped support for PPTP on their devices for security reasons
Thanks, I tried that config before and it wouldn’t work. I’ll certainly try it again though.
Also well aware PPTP was dropped from iOS.
Thanks for the replies