SOLVED PPTP server not reachable from WAN

tmbc · January 19, 2014, 10:58pm

EDIT: I figured out that the order of my firewall rules were causing the issue. Problem solved.

I am attempting to configure the PPTP server on my 750GL. When I am connected to the LAN on my iPhone, I am able to connected quickly to the PPTP VPN using my WAN IP address. When I attempt to connect from my LTE connection, the connection times out and there doesn’t appear to be anything in the Mikrotik log.

I was able to connect to a PPTP VPN server on my Buffalo router via LTE, so I don’t think the ISP is blocking it.

Here are the configuration details:

ip pool add name=VPN-Pool ranges=192.168.0.190-192.168.0.199

# NAME           RANGES                         
0 default-dhcp   192.168.0.200-192.168.0.254    
1 VPN-Pool       192.168.0.190-192.168.0.199



ppp profile add name=VPN-Prof local-address=VPN-Pool remote-address=VPN-Pool dns-server=192.168.0.1 use-encryption=required change-tcp-mss=yes

Flags: * - default 
 0 * name="default" use-mpls=default use-compression=default use-vj-compression=default use-encryption=default 
     only-one=default change-tcp-mss=yes 

 1   name="VPN-Prof" local-address=192.168.0.1 remote-address=VPN-Pool use-mpls=default use-compression=default 
     use-vj-compression=default use-encryption=required only-one=default change-tcp-mss=yes dns-server=192.168.0.1 

 2 * name="default-encryption" use-mpls=default use-compression=default use-vj-compression=default use-encryption=yes 
     only-one=default change-tcp-mss=yes



ppp secret add name=tmbc password=***** service=pptp profile=VPN-Prof

#   NAME                  SERVICE CALLER-ID               PASSWORD               PROFILE               REMOTE-ADDRESS 
0   tmbc                  pptp                            *****                  VPN-Prof



interface pptp-server server set enabled=yes default-profile=VPN-Prof

	    enabled: yes
            max-mtu: 1460
            max-mru: 1460
               mrru: disabled
     authentication: mschap1,mschap2
  keepalive-timeout: 30
    default-profile: VPN-Prof



ip firewall filter add chain=input protocol=tcp dst-port=1723 action=accept
ip firewall filter add chain=input protocol=gre action=accept

 0   ;;; default configuration
     chain=input action=accept protocol=icmp 

 1   ;;; default configuration
     chain=input action=accept connection-state=established 

 2   ;;; default configuration
     chain=input action=accept connection-state=related 

 3   ;;; default configuration
     chain=input action=drop in-interface=ether1-gateway 

 4   chain=input action=accept protocol=tcp dst-port=1723 

 5   chain=input action=accept protocol=gre