MK VPN & windows client

RouterOS General
1

I have a mikrotik 2.9rc10 on a DSL account. Regular Static IP routed DSL, no pppoe or anthing.

I am the ISP

I am trying to setup a VPN connection for the cleint to get into his network.

I set up it pretty much default with no encrytion. I can connect perfect from inside our network, which is where the DSL terminates in our redback.

I cannot however connect from anywhere else. I always get error 651

here is what the logs show on the MK


07:32:34 pptp,info TCP connection established from 66.151.140.236
07:32:34 pptp,ppp,debug <66.151.140.236>: PPP started
07:32:34 pptp,ppp,info : waiting for call…
07:32:34 pptp,debug,packet rcvd Start-Control-Connection-Request from 66.151.140.236
07:32:34 pptp,debug,packet protocol-version=0x0100
07:32:34 pptp,debug,packet framing-capabilities=1
07:32:34 pptp,debug,packet bearer-capabilities=1
07:32:34 pptp,debug,packet maximum-channels=0
07:32:34 pptp,debug,packet firmware-revision=2195
07:32:34 pptp,debug,packet host-name=
07:32:34 pptp,debug,packet vendor-name=Microsoft Windows NT
07:32:34 pptp,debug,packet sent Start-Control-Connection-Reply to 66.151.140.236
07:32:34 pptp,debug,packet protocol-version=0x0100
07:32:34 pptp,debug,packet result-code=1
07:32:34 pptp,debug,packet error-code=0
07:32:34 pptp,debug,packet framing-capabilities=2
07:32:34 pptp,debug,packet bearer-capabilities=0
07:32:34 pptp,debug,packet maximum-channels=0
07:32:34 pptp,debug,packet firmware-revision=1
07:32:34 pptp,debug,packet host-name=MikroTik
07:32:34 pptp,debug,packet vendor-name=MikroTik
07:32:34 pptp,debug,packet rcvd Outgoing-Call-Request from 66.151.140.236
07:32:34 pptp,debug,packet call-id=3448
07:32:34 pptp,debug,packet call-serial-number=42859
07:32:34 pptp,debug,packet minimum-bps=300
07:32:34 pptp,debug,packet maximum-bps=100000000
07:32:34 pptp,debug,packet bearer-type=3
07:32:34 pptp,debug,packet framing-type=3
07:32:34 pptp,debug,packet packet-recv-window-size=64
07:32:34 pptp,debug,packet packet-processing-delay=0
07:32:34 pptp,debug,packet phone-number-length=0
07:32:34 pptp,debug,packet phone-number=
07:32:34 pptp,debug,packet subaddress=
07:32:34 pptp,ppp,debug <66.151.140.236>: PPP connected
07:32:34 pptp,ppp,debug <66.151.140.236>: LCP lowerup
07:32:34 pptp,ppp,debug <66.151.140.236>: LCP open
07:32:34 pptp,debug,packet sent Outgoing-Call-Reply to 66.151.140.236
07:32:34 pptp,debug,packet call-id=30
07:32:34 pptp,debug,packet peers-call-id=3448
07:32:34 pptp,debug,packet result-code=1
07:32:34 pptp,debug,packet error-code=0
07:32:34 pptp,debug,packet cause-code=0
07:32:34 pptp,debug,packet connect-speed=100000
07:32:34 pptp,debug,packet packet-recv-window-size=100
07:32:34 pptp,debug,packet packet-processing-delay=0
07:32:34 pptp,debug,packet physical-channel-id=0
07:32:35 pptp,ppp,debug <66.151.140.236>: LCP timer
07:32:35 pptp,ppp,debug,packet <66.151.140.236>: sent LCP ConfReq id=0x1
07:32:35 pptp,ppp,debug,packet <mru 1460>
07:32:35 pptp,ppp,debug,packet <magic 0x3f6ab60f>
07:32:35 pptp,ppp,debug,packet
07:32:36 pptp,ppp,debug <66.151.140.236>: LCP timer
07:32:36 pptp,ppp,debug <66.151.140.236>: LCP timeout waiting initial data
07:32:36 pptp,ppp,debug <66.151.140.236>: LCP lowerdown
07:32:36 pptp,ppp,info : terminating…
07:32:36 pptp,ppp,debug <66.151.140.236>: PPP disconnected <>
07:32:36 pptp,ppp,debug <66.151.140.236>: PPP destroy
07:32:36 pptp,ppp,debug <66.151.140.236>: PPP stopped
07:32:36 pptp,ppp,info : disconnected
07:32:36 pptp,ppp,debug <66.151.140.236>: CCP lowerdown
07:32:36 pptp,ppp,debug <66.151.140.236>: CCP down event in initial state
07:32:36 pptp,ppp,debug <66.151.140.236>: IPCP lowerdown
07:32:36 pptp,ppp,debug <66.151.140.236>: IPCP down event in initial state

any ideas?

2

do you have any firewall rules that could be blocking GRE packets and/or TCP port 1723? Are you NATing your subscribers? Or do they have publically routed IP addresses?

3

I am not blocking anthing via firewall, although I am behind behind another MK doing NAT

4

Have you arranged for the TCP control connection (port 1723) and the GRE protocol to make it through your NATing MikroTik to your VPN gateway?

5

How do I arrange for the TCP control connection (port 1723) and the GRE protocol to make it through your NATing MikroTik?


I thought that it would normally pass these, as many of our existing clients use VPN to their work.

6

Hmm, perhaps I misunderstood you.

If you are behind a NAT device doing OUTGOING NAT, you should be fairly OK. You should check that the gre NAT helper is active (“/ip firewall service-port print”) - which it is by default.

I thought you have the VPN server behind a natting device - then you would have to use dst-nat to forward tcp port 1723 and protocol GRE to your VPN server…

7

I see those service ports.. when I enable them, should I add a port?, or leave it blank.

here is the port status on the VPN server MK.

[admin@MikroTik] ip firewall service-port> print
Flags: X - disabled, I - invalid

NAME PORTS

0 ftp 21
1 tftp 69
2 irc 6667
3 X h323
4 quake3
5 mms
6 gre
7 pptp

8

that’s ok. if your a behind a MASQUERADING nat device (i.e. the PPTP client is natted, not the server), things should work…

9

answer to my own question… I had my own internal routing issues with the mk - mk pptpt link, but at the clients house I found this to be the problem.

it was the firmware in the cleints netgear router. After that upgrade, it worked perfectly.