PPTP & Routing

[rvdvalk]

@mducharme

@rvdvalk

I’ve added a route at the office to 192.168.88.0/24 using the L2TP connection as a gateway.
I’m able to acces the router at the office now, 192.168.2.1 but not the server or printer.

Two possibilities:

1. if your server and printer think they are on the same subnet as you, they will send an arp request instead of trying to route the traffic, and nothing will respond. Enabling proxy-arp on your bridge at the office (the bridge that connects to the server and printer subnet) would fix that if that is the case
2. a firewall rule may be blocking this traffic[/quote]

Don’t know how to enable proxy-arp though.

I’ve tested the connection the other way around, from the office to my laptop and the router is able to ping my laptop, the server isn’t.

[mducharme]

@rvdvalk

Don’t know how to enable proxy-arp though.

I’ve tested the connection the other way around, from the office to my laptop and the router is able to ping my laptop, the server isn’t.

In your office, double click on the ‘bridge’ interface (it will be named that unless you have changed it), and change the ARP setting from ‘enabled’ to ‘proxy-arp’

[rvdvalk]

@mducharme

@rvdvalk

Don’t know how to enable proxy-arp though.

I’ve tested the connection the other way around, from the office to my laptop and the router is able to ping my laptop, the server isn’t.

In your office, double click on the ‘bridge’ interface (it will be named that unless you have changed it), and change the ARP setting from ‘enabled’ to ‘proxy-arp’

Proxy-arp was already active. So the firewall remains.

[mducharme]

@rvdvalk

@mducharme

@rvdvalk

Don’t know how to enable proxy-arp though.

I’ve tested the connection the other way around, from the office to my laptop and the router is able to ping my laptop, the server isn’t.

In your office, double click on the ‘bridge’ interface (it will be named that unless you have changed it), and change the ARP setting from ‘enabled’ to ‘proxy-arp’

Proxy-arp was already active. So the firewall remains.

Try creating ‘accept’ rules in the forward chain between subnets with src-address 192.168.2.0/24 and dst-address 192.168.88.0/24 (and vice versa) on both sides, move them above any drop rules.

[rvdvalk]

@mducharme

@rvdvalk

@mducharme

@rvdvalk

Don’t know how to enable proxy-arp though.

I’ve tested the connection the other way around, from the office to my laptop and the router is able to ping my laptop, the server isn’t.

In your office, double click on the ‘bridge’ interface (it will be named that unless you have changed it), and change the ARP setting from ‘enabled’ to ‘proxy-arp’

Proxy-arp was already active. So the firewall remains.

Try creating ‘accept’ rules in the forward chain between subnets with src-address 192.168.2.0/24 and dst-address 192.168.88.0/24 (and vice versa) on both sides, move them above any drop rules.

I did, no success.

[mducharme]

@rvdvalk

@mducharme

@rvdvalk

@mducharme

@rvdvalk

Don’t know how to enable proxy-arp though.

I’ve tested the connection the other way around, from the office to my laptop and the router is able to ping my laptop, the server isn’t.

In your office, double click on the ‘bridge’ interface (it will be named that unless you have changed it), and change the ARP setting from ‘enabled’ to ‘proxy-arp’

Proxy-arp was already active. So the firewall remains.

Try creating ‘accept’ rules in the forward chain between subnets with src-address 192.168.2.0/24 and dst-address 192.168.88.0/24 (and vice versa) on both sides, move them above any drop rules.

I did, no success.
Clipboard02.jpg

Not just one rule on the router- two rules, going in both directions. Do this both on your end and on the office side, so four rules total.

[mducharme]

Also get rid of any masquerade rule you have for the l2tp interface, because it sounds like you want to be able to have connectivity in both directions rather than just the spoke access to the hub.

[rvdvalk]

@mducharme

Not just one rule on the router- two rules, going in both directions. Do this both on your end and on the office side, so four rules total.

Looks like I’ve had every possibility, still no success.
I created both rules like a mirrorred version of itself on both devices.

[mducharme]

@rvdvalk

@mducharme

Not just one rule on the router- two rules, going in both directions. Do this both on your end and on the office side, so four rules total.

Looks like I’ve had every possibility, still no success.
I created both rules like a mirrorred version of itself on both devices.
Clipboard01.jpg

Do you have a bridge interface? or just ether2-master? if ether2-master is a port of bridge ‘bridge’ then proxy-arp should have been turned on by turning it on bridge. But if ‘bridge’ has no ports, proxy-arp would need to be enabled on ether2-master on the office side.

[rvdvalk]

@mducharme

@rvdvalk

@mducharme

Not just one rule on the router- two rules, going in both directions. Do this both on your end and on the office side, so four rules total.

Looks like I’ve had every possibility, still no success.
I created both rules like a mirrorred version of itself on both devices.
Clipboard01.jpg

Do you have a bridge interface? or just ether2-master? if ether2-master is a port of bridge ‘bridge’ then proxy-arp should have been turned on by turning it on bridge. But if ‘bridge’ has no ports, proxy-arp would need to be enabled on ether2-master on the office side.

These are the Interfaces.

[mducharme]

@rvdvalk

These are the Interfaces.

Is proxy-arp enabled on ether2-master?

[rvdvalk]

@mducharme

@rvdvalk

These are the Interfaces.

Is proxy-arp enabled on ether2-master?

Yes it is.

[mducharme]

@rvdvalk

Yes it is.

Is ‘add default route’ checked in l2tp client interface on your home router?

[rvdvalk]

@mducharme

@rvdvalk

Yes it is.

Is ‘add default route’ checked in l2tp client interface on your home router?

No it wasn’t but after enabling it nothing changed.

[idlemind]

Proxy-ARP should only be used if the L2TP client is being given an IP that would otherwise normally reside on the LAN of the server.

[rvdvalk]

@idlemind

Proxy-ARP should only be used if the L2TP client is being given an IP that would otherwise normally reside on the LAN of the server.

The client is getting an IP in the range 192.168.2.250-254, we only have a few clients.
The rest of the network is operating in the range 192.168.2.1-100

If I use a L2TP connection on my laptop and connect to the office I’m able to connect to the server by IP, not DNS.

I’d prefer to have both routers to be connected by L2TP. Connecting the laptops to the router is my last option.

[idlemind]

@rvdvalk

@idlemind

Proxy-ARP should only be used if the L2TP client is being given an IP that would otherwise normally reside on the LAN of the server.

The client is getting an IP in the range 192.168.2.250-254, we only have a few clients.
The rest of the network is operating in the range 192.168.2.1-100

If I use a L2TP connection on my laptop and connect to the office I’m able to connect to the server by IP, not DNS.

I’d prefer to have both routers to be connected by L2TP. Connecting the laptops to the router is my last option.

Please post both router configs. You can use hide-sensitive or simply modify any values like password or IP.

[rvdvalk]

@idlemind

Please post both router configs. You can use hide-sensitive or simply modify any values like password or IP.

As requested.
Client.txt (2.63 KB)
Office.txt (4.73 KB)

[mducharme]

@rvdvalk

@idlemind

Please post both router configs. You can use hide-sensitive or simply modify any values like password or IP.

As requested.
Office.txt
Client.txt

Why do you have a bridge-nat rule? It is ‘accept’ so theoretically it shouldn’t be causing an issue, but I still wouldn’t have it there if it is not needed.

Why do you have an ipsec policy on the office router with tunneling when you are using l2tp over ipsec? I worry this may interfere when you want the same client router to connect up simultaneously to one policy with l2tp over ipsec and with another policy to a pure ipsec tunnel. The simplest way to set up ipsec for l2tp is checking the ‘ipsec’ box in the l2tp configuration on client and server and specifying the secret you wish to use, then it creates dynamic ipsec policy config on both sides, then you do not need these static policies.

Also, this is not acting as the DHCP server for your office it appears - what is? Verify the ip, subnet mask, and gateway configured on the server you cannot access.

[rvdvalk]

@mducharme

Why do you have a bridge-nat rule? It is ‘accept’ so theoretically it shouldn’t be causing an issue, but I still wouldn’t have it there if it is not needed.

Might be a default setting? I’m not sure. Can’t remember setting this, but that doesn’t mean anything.

@mducharme

Why do you have an ipsec policy on the office router with tunneling when you are using l2tp over ipsec? I worry this may interfere when you want the same client router to connect up simultaneously to one policy with l2tp over ipsec and with another policy to a pure ipsec tunnel. The simplest way to set up ipsec for l2tp is checking the ‘ipsec’ box in the l2tp configuration on client and server and specifying the secret you wish to use, then it creates dynamic ipsec policy config on both sides, then you do not need these static policies.

I just used a guide from the web that made sence to me. I’ll reconfigure this setting.

@mducharme

Also, this is not acting as the DHCP server for your office it appears - what is? Verify the ip, subnet mask, and gateway configured on the server you cannot access.

The server (SBS2011) is DHCP server. IP settings are correct.