VPN doesn't work behind MT/Hotspot

RouterOS General
1

Hi,

we have set up a MT 2.9.2 Hotspot server with RADIUS authentification.
MT is behind a local Draytek Router.

The notebook behind the MT isn't able to establish VPN (PPTP) connections.
The TCP syn send appears in the ip/firewall/connections tab. Port 1723.

Are there any firewall setting enabled by default? Did no changes from default settings so far.

VPN connections on a second pc directly behind Draytek are working, so no problem with draytek.

Any hints? Thanks

seandsl

2

pptp uses both GRE (ip proto 47) and TCP port 1723.
Make sure GRE and PPTP helper ports are enabled and permitted in the firewall.
I dare say it’s the draytek that has the problem. I think i remember it having trouble with it, i’m thinking about the older 2200 version.

3

Hi sten,

draytek is working, otherwise the pc directly behind the draytek won't do vpn connections.

I reset the router and set up the hotspot server again, now it's working.
The difference is: Now I used the /ip hotspot setup .. tool.

Before I used the old export which is:

/ip hotspot add name="Demo_Hotel" interface=lan address-pool=dhcp-pool-1 profile=default \
    idle-timeout=5m keepalive-timeout=none addresses-per-mac=2 disabled=no
/ip hotspot profile set default name="default" hotspot-address=192.168.168.1 dns-name="login.hotspot.local" \
    html-directory=hotspot rate-limit="" http-proxy=0.0.0.0:0 \
    smtp-server=0.0.0.0 login-by=http-pap http-cookie-lifetime=3d \
    split-user-domain=no use-radius=yes radius-accounting=yes \
    radius-interim-update=2m nas-port-type=wireless-802.11

I thought that both will be the same .. seems to be something different.
Where is that "masquerade network" setting that apears during setup, if I want to change it afterwards ??

Thannks


seandsl

4

There seemed to be the masquerading rule missing.
Now ping is working, too.

I was confused that web browsing was working, even without masquerading. It seems that the hotspot proxy does it.

seandsl