I have seen countless articles and howto’s on doing a PPTP Server from the MikroTik and connecting a Windows XP or Windows 7 client but with all the different options I still can’t connect. I usually get the Error 800.
I’m basically connecting a Windows 7 Client over the Internet and into the Router. So I use the routers PUBLIC IP on the client side and in the profile as you see for local address I have the routers internal IP of 192.168.1.1. The local network to the windows 7 client has an ip scheme of 192.168.10.0/24.
Here is what my config looks like. Please advise and thanks
I’m using PPTP specific setting on the windows 7 pro client instead of automatic. can there be a licensing issue here? I’m on level 4. It gives this error immediately also upon hitting connect on the windows 7 client. here is my issue after doing exactly what that article said. Also I enabled the logging for pptp and I don’t see any entries in the routers log file
I felt like I should add my ip setup as well. listed here. there is a voip subnet and a data subnet
Be sure to add PPTP logging as per my original post and try again then post the log
If you have done that already then no PPTP packets are hitting your router and the problem is elsewhere - perhaps disable ANY firewall Input rules and try again ?
Microsoft error codes doesn’t really tell you what’s wrong. A error code 807 typically is either the client or the server is behind a NAT device and does not pass through GRE protocol 47. If GRE protocol 47 isn’t pass through the NAT device you’ll get 807. you’ll also get 807 if port 1723 isn’t forwarded from the NAT device to the VPN server if the server is behind a NAT device. VPN servers usually have packet filters which restrict inbound connection to only PPTP or L2TP.
=================
Perhaps an IP Firewall Rule on the Input chain to log everything (placed at the top) to be sure the packets are arriving at the Mikrotik router ?
I do not see any actual PPTP entries in the log though.
We need to confirm the PPTP packets are arriving at the Mikrotik as the issue may be at the client side ?
Is the client a fixed IP ? If so add an Input rule with the necessary source address and action of LOG and a prefix of VPN (or W7VPN etc to identify the packets).
This should show the traffic from the host hitting the Mikrotik.
Also disable any logging that is not pertinent to what we need such as PPP and PPPoE
If that does not show anythinmg useful the perhaps disable all logging except PPTP then start a Packet Capture on ether1 then do the connection attempt and stop it and look at the packets to make sure you are getting through to the Mikrotik.
In winbox use Tool.Packet Sniffer for this.
We need to see that traffic arriving at the router
the strange thing is if I do a ping from the client I see his public static IP hitting the microtek under an ICMP packet. If I do a connection from the vpn client when it’s on automatic it trys to connect to port 500 on the microtek and eventually fails. when I actually set the client to PPTP tunneling it fails right away and there are no logs on the microtek. firewall is disabled on the client. no av software. I’ve tried this same procedure from a completely different network with a different PC/LAN subnet and had the same result as I just described. and this happens on xp and windows 7.
Another update. If the sniffer is on and I connect on my 192.168.0.0/24 network it will show entries for 1723 as the destination port. I will have to keep hitting redial in order for them to show up but they do show up. on the network that has subnet 192.168.10.0/24 the destination port 1723 packets never show up during the sniffing. this is when filtered to look at all traffic destined for the ether1 interface.
In Winbox, go into your firewall rules and place three rules right at the top.
One to allow all input
One to allow all output
One to allow all forwards.
Then you can “enable” or “disable” them for your test.
Enable them and try the PPTP connect.
If it works, then you have a firewall problem.
If they don’t, you have a problem elsewhere.
Once you’re sure it’s not a firewall problem, then we can look farther up the OSI layers to see what’s going on. But, IMO, it’s often something like this that causes the problem.
When it’s so easy to test for, it seems crazy not to spend the 3 minutes or so to create the rules and try it.
[In fact, often when something works differently than I expect, I’ll try this myself. It’s a terribly easy way to determine if there’s some rule you hadn’t considered that is borking you over. Once you know that, you can disable the “allow” rules and go searching.]
I enabled all of them but still can’t get in. what are the settings I should have on my client that are correct so I at least know that each end is setup the correct way? it’s crazy how fast it ends the session as well, it’s instant there isn’t even like a delay while it tries.
After further testing from within the same network as the microtik I was able to connect a client just fine. So I know the pptp server is setup correctly. what other WAN requirements are needed for this to work? there must be something missing on the microtik.
After further testing from within the same network as the microtik I was able to connect a client just fine.
Does this mean that you essentially put the client hanging off one of the WAN ports of the MicroTik - just via an ethernet cable. Gave both appropriate IP addresses and it worked. Correct?
If so, there’s nothing wrong with either setup - client or server.
If you didn’t plug it into the same WAN port you’d use to connect to your ISP, then you likely have a misconfiguration of the MikroTik
If you did, then there’s something wrong with your ISP, or some filtering that is occurring in the middle somewhere.
If you’re using a Comcast modem, they have “filtering” options that will bork IPSec and PPTP, IIRC. Turn those off.
If you have DSL, is there a DSL router in the middle doing NAT?
You didn’t show the IP address of the WAN interface [which I understand] but without it, I’m not sure if there’s NAT going on in the middle of your connection. [Outside the MTK]
I haven’t reviewed your post super carefully, but if you’ve followed the Wiki, or Sowell’s walk-through - I’m pretty sure it’s right and you need to start looking outside the MTK/Windows client for problems. [I’ve setup many using the Wiki setup, and I know it works.]
Oh, and don’t use CHAP1 it’s very insecure, IMO. MS-CHAP2 is much better.
I got the client to work that was already on the LAN subnet of the mikrotik (192.168.1.0/24). So it wasn’t coming from the WAN side of the mikrotik. I did this just to see if the mikrotik was at fault and if it was WAN related. Since it worked I know there must be something wrong with the WAN side of the mikrotik. Cox Communications Cable is installed here and a static WAN ip is assigned to ether1 of the mikrotik. I can ping the interface and I have also setup a Terminal Services 3389 forward which works great, so I know that it’s hitting the mikrotik directly. This is why I’m at a dead end as to why clients from different sites can’t connect.
do you know if there are any other pptp clients to try out besides the built in windows one?
Well guys I’ll be honest and say that it doesn’t seem like the clients are even hitting the router when performing the pptp connection. This really baffles me because I have this router on the edge connected to cox’s modem with a static IP from Cox. When I ping the WAN ip and have the packet sniffer running I do see the icmp requests arrive, so I know that traffic is hitting it directly. so it just doesn’t compute why these pptp connections wouldn’t even show up in the sniffer or through the mikrotik logs.
any more ideas would be very welcome. could this be a bug in version 5.6 of the mikrotik? otherwise I could do vpn passthrough and setup RRAS on my 2008 server. What would be required on the router for this?
If you connected via the LAN [another port on the RB] then it’s one of two things.
Something in the MTK is blocking connections to the WAN port. Firewall rule is a prime example here.
Something in the path is blocking PPTP connections.
I’ve given you some hints on #1 - but I’m not sure how you tried to evaluate that.
#2 is a known issue with some cable modems.
[I’m in comcast territory and these options wreak havok on VPN’s.]
Here’s how they appear in some of the devices I’ve seen:
-Disable “Firewall for True Static IP Subnet Only”
-Disable “Gateway Smart Packet Detection”
So, I’d probably try a couple of things.
#1. Disable all firewall rules. This should allow all traffic to flow. [This is much like the three allow rules I gave above, but I’m not convinced you have correctly applied that suggestion.]
Assuming PPTP really IS configured properly [and there’s not some other conflicting issue, if you don’t see a connect or traffic, then you have a problem in option #2.
–It’s not a BUG in MTK, not if you can connect PPTP via an alternate port. [i.e. Eth 1,2,3 instead of eth0]
–It’s not a problem with the Windows client, if you can connect in one way. [Unless you’ve got a windows/software firewall that filters differently in one situation vs another. You’re not using something like Norton 360 are you? (forbid!)]
I seriously doubt there is a bug, and the RB sees every port, essentially the same. There’s no difference between one port and another.
So, if it connects on eth2, and not on eth0, then you must have something configured on eth0 that’s different than eth2.
Start really tearing into things that are different on the two ports. [Most of the time, you don’t need to delete them, just disable them.]
(And I’d feel better if you connected the laptop to the WAN port, and static assigned an IP there. Set the gateway to be the RB and the RB’s gateway to be the laptop. Then try to connect. If that doesn’t work, then there’s a config on the RB that’s the problem.
If it does work, then you know it’s not the RB.)
Usual culprits are firewall rules.
NAT and or Mangle could impact things too, depending on what’s happening.
If you have log rules in the FW looking for PPTP packets (TCP 1723 and GRE protocol 47) - if you’re not seeing anything hit those then, I’m not sure what’s wrong. I could probably tear things down more, but I simply don’t have time right at the moment.
But start looking at what’s different in your config between the working PPTP connect port and the one that doesn’t.
