Hi! Does anybody know how to force to work Norton Secure VPN on mikrotik router?
I can`t connect to Norton VPN
Their support told me that because my 500 and 4500 UDP ports closed.
I have tried to check my ports by this site https://www.yougetsignal.com/tools/open-ports/ and 4500 and 500 returned me ‘Port 4500 is closed on ’ and ‘Port 500 is closed on ’
From the outside they are closed. That is how a statefull firewall works you can only open a window in the firewall from the inside.
Check if port 500 and 4500 UDP (ipsec) are allowed to open such a window.
And how properly I have to open them?
I have tried steps from here http://forum.mikrotik.com/t/open-firewall-port/75304/1
But when I again was trying to check ports - see 0 in counters and services returns me ‘port is closed’
A bit of theory. A port is a sub-address, allowing to choose the right destination process (application) at the machine which receives the packet. So in a typical communication flow between two endpoint devices, the port at each endpoint device is not related to the port used for the same communication flow on the other device. In a client-server communication, the server (the responder for incoming connections) normally listens at a “well-known” port, while the client (initiator of the communication) uses a different port on its side for each connection to that server (e.g. if you open two browser windows towards the same server).
When you use the Norton VPN, you also act as a client, and the port on your side may be any; your firewall must allow outgoing connections towards the remote server’s address and UDP ports (500 and 4500). But with the default firewall rules doesn’t need to be specially set - devices at LAN side are free to initiate connections anywhere. So either you’ve modified the default firewall settings, or the problem is not your firewall.
The topic you’ve linked to would be applicable if you wanted to run your own IPsec server on your LAN and make it accessible it via WAN, but that doesn’t seem to be your case.
I’ve seen cases here on the forum where a large certificate was used, causing the initial information exchange between the IPsec client and the IPsec server to fail due to fragmentation and failing reassembly at the receiving end.
So post your configuration export (see my automatic signature right below for anonymisation hints), so that we could have a look whether there is something unusual there before venturing into debugging connectivity issues.
Understood, thank you for your time. Just in case I asked my internet provider and they told me that they never blocked any ports.
My export file (don`t know how to correct post it, so decided to use https://drive.google.com/open?id=19Eg8kEL9aNtG5SsvBu6W9yP_2aip9rgB)
Just a quick look by me and you create a list “Port Scanners” and make sure that the source address of Symantec server is not on that list.
/ip firewall filter
add action=add-src-to-address-list address-list="Port Scanners" address-list-timeout=6h chain=input comment="Port Scanners" in-interface-list=WAN protocol=tcp psd=21,3s,3,1
/ip firewall raw
add action=drop chain=prerouting src-address-list="Port Scanners"
Also you have disabled the ipsec-policy at the first line in /ip firewall nat and that line that opens the window to the outside for ipsec traffic.
I turned off ‘Port scanner’ rule when was trying to use VPN and clean up address list. Ipsec turned off today when was trying different experiments.
By the way, I solved issue and found reason of error: not related to firewall, its my local Hyper-V adapter, I switched to Virtual box a few weeks ago, but after removing Hyper-V adapter was left, I didnt pay attention because it didn`t affect my work, so I just removed a few minutes ago it manually (device manager, network adapters, right click and uninstall) and VPN works.
Sorry for wasting your time, topic can be removed.
Good that you find the cause of not being able to connect to the VPN. You can mark your own post (above) solved.