VPN HELP NEEDED

[MRMISSY]

HI
NEED OF GREAT HELP
I HAVE HOTSPOT SYSTEM (DHCP)
SOME OF MY CLIENTS USE VPN CONNECTION TO REMOTE SITE
THE PROBLEM THAT
ONCE THEY TRY TO DO VPN CONNECTION THEY ARE DISCONNECTED FROM THE NETWORK

this my firewall
please help

[admin@M1] /ip firewall> export

jul/21/2010 18:45:40 by RouterOS 4.10

/ip firewall layer7-protocol
add comment="" name=extentions regexp=
"|text/html|Content-type|\xff\xd8|gif8(7|9)a|x89PNG|png\r
\n"
/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s
tcp-close-wait-timeout=10s tcp-established-timeout=1d
tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s
tcp-syn-received-timeout=5s tcp-syn-sent-timeout=5s tcp-syncookie=yes
tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall filter
add action=passthrough chain=unused-hs-chain comment=
"place hotspot rules here" disabled=yes
add action=log chain=forward comment="" disabled=yes dst-port=8040-8060
log-prefix="HOTSPOT SHEILD" protocol=tcp
add action=accept chain=forward comment="" disabled=no dst-port=49000-50000
port=49000-50000 protocol=udp src-address-type=""
add action=accept chain=forward comment="" disabled=no dst-port=49000-50000
port=49000-50000 protocol=tcp src-address-type=""
add action=accept chain=forward comment="" disabled=no dst-port=8040-8060
protocol=udp src-address-type=""
add action=accept chain=forward comment="" disabled=no dst-port=443 protocol=
tcp
add action=accept chain=forward comment="" disabled=yes port=1723 protocol=
tcp
add action=accept chain=forward comment="" disabled=yes port=1723 protocol=
udp
add action=accept chain=forward comment="" disabled=yes port=47 protocol=tcp
add action=accept chain=forward comment="" disabled=yes port=47 protocol=udp
add action=accept chain=forward comment=""Block HotSpot Shield"" disabled=
yes dst-port=8040-8060 protocol=udp src-address-list="port scanners"
add action=passthrough chain=forward comment=""Block HotSpot Shield""
disabled=yes dst-port=8040-8060 protocol=tcp
add action=tarpit chain=input comment="block sit deauth" connection-limit=
3,32 disabled=yes protocol=tcp src-address-list=blocked-addr
add action=drop chain=forward comment="" disabled=yes dst-port=895 protocol=
udp
add action=drop chain=forward comment="" disabled=yes dst-port=895 protocol=
tcp
add action=accept chain=forward comment="" disabled=yes dst-port=1863
protocol=tcp
add action=add-dst-to-address-list address-list=torrentpreans
address-list-timeout=1h chain=forward comment=""TORRENT"" disabled=no
p2p=all-p2p
add action=drop chain=forward comment="windows update" content=
"windows update" disabled=no
add action=drop chain=forward comment="windows update" content=windowsupdate
disabled=no
add action=drop chain=virus comment="Drop Blaster Worm" disabled=no dst-port=
135-139 protocol=tcp
add action=drop chain=virus comment="Drop Messenger Worm" disabled=no
dst-port=135-139 protocol=udp
add action=drop chain=virus comment="Drop Blaster Worm" disabled=no dst-port=
445 protocol=tcp
add action=drop chain=virus comment="Drop Blaster Worm" disabled=no dst-port=
445 protocol=udp
add action=drop chain=virus comment=________ disabled=no dst-port=593
protocol=tcp
add action=drop chain=virus comment=________ disabled=no dst-port=1024-1030
protocol=tcp
add action=drop chain=virus comment="Drop MyDoom" disabled=no dst-port=1080
protocol=tcp
add action=drop chain=virus comment=________ disabled=no dst-port=1214
protocol=tcp
add action=drop chain=virus comment="ndm requester" disabled=no dst-port=1363
protocol=tcp
add action=drop chain=virus comment="ndm server" disabled=no dst-port=1364
protocol=tcp
add action=drop chain=virus comment="screen cast" disabled=no dst-port=1368
protocol=tcp
add action=drop chain=virus comment=hromgrafx disabled=no dst-port=1373
protocol=tcp
add action=drop chain=virus comment=cichlid disabled=no dst-port=1377
protocol=tcp
add action=drop chain=virus comment=Worm disabled=no dst-port=1433-1434
protocol=tcp
add action=drop chain=virus comment="Bagle Virus" disabled=no dst-port=2745
protocol=tcp
add action=drop chain=virus comment="Drop Dumaru.Y" disabled=no dst-port=2283
protocol=tcp
add action=drop chain=virus comment="Drop Beagle" disabled=no dst-port=2535
protocol=tcp
add action=drop chain=virus comment="Drop Beagle.C-K" disabled=no dst-port=
2745 protocol=tcp
add action=drop chain=virus comment="Drop MyDoom" disabled=no dst-port=
3127-3128 protocol=tcp
add action=drop chain=virus comment="Drop Backdoor OptixPro" disabled=no
dst-port=3410 protocol=tcp
add action=drop chain=virus comment=Worm disabled=no dst-port=4444 protocol=
tcp
add action=drop chain=virus comment=Worm disabled=no dst-port=4444 protocol=
udp
add action=drop chain=virus comment="Drop Sasser" disabled=no dst-port=5554
protocol=tcp
add action=drop chain=virus comment="Drop Beagle.B" disabled=no dst-port=8866
protocol=tcp
add action=drop chain=virus comment="Drop Dabber.A-B" disabled=no dst-port=
9898 protocol=tcp
add action=drop chain=virus comment="Drop Dumaru.Y" disabled=no dst-port=
10000 protocol=tcp
add action=drop chain=virus comment="Drop MyDoom.B" disabled=no dst-port=
10080 protocol=tcp
add action=drop chain=virus comment="Drop NetBus" disabled=no dst-port=12345
protocol=tcp
add action=drop chain=virus comment="Drop Kuang2" disabled=no dst-port=17300
protocol=tcp
add action=drop chain=virus comment="Drop SubSeven" disabled=no dst-port=
27374 protocol=tcp
add action=drop chain=virus comment="Drop PhatBot, Agobot, Gaobot" disabled=
no dst-port=65506 protocol=tcp
add action=jump chain=forward comment="jump to the virus chain" disabled=no
jump-target=virus
add action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w chain=input comment="Port scanners to list "
disabled=no protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w chain=input comment="NMAP FIN Stealth scan
\n" disabled=no protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w chain=input comment="" disabled=no protocol=tcp
tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w chain=input comment="SYN/FIN scan" disabled=no
protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w chain=input comment="SYN/RST scan" disabled=no
protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" disabled=
no protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w chain=input comment="ALL/ALL scan" disabled=no
protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w chain=input comment="NMAP NULL scan" disabled=no
protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=input comment="dropping port scanners" disabled=no
src-address-list="port scanners"
add action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w chain=forward comment="Port scanners to list "
disabled=no protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w chain=forward comment="NMAP FIN Stealth scan
\n" disabled=no protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w chain=forward comment="" disabled=no protocol=tcp
tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w chain=forward comment="SYN/FIN scan" disabled=no
protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w chain=forward comment="SYN/RST scan" disabled=no
protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w chain=forward comment="FIN/PSH/URG scan"
disabled=no protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w chain=forward comment="ALL/ALL scan" disabled=no
protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w chain=forward comment="NMAP NULL scan" disabled=
no protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=forward comment="dropping port scanners" disabled=no
src-address-list="port scanners"
add action=jump chain=forward comment="" disabled=no jump-target=restrict-tcp
protocol=tcp
add action=jump chain=forward comment="" disabled=no jump-target=restrict-udp
protocol=udp
add action=jump chain=forward comment="" disabled=no jump-target=restrict-ip
add action=drop chain=restrict-tcp comment="" connection-mark=auth disabled=
no
add action=jump chain=restrict-tcp comment="anti-spam policy"
connection-mark=smtp disabled=no jump-target=smtp-first-drop
add action=add-src-to-address-list address-list=approved-smtp
address-list-timeout=5s chain=smtp-first-drop comment="" disabled=no
src-address-list=first-smtp
add action=return chain=smtp-first-drop comment="" disabled=no
src-address-list=approved-smtp
add action=add-src-to-address-list address-list=first-smtp
address-list-timeout=2s chain=smtp-first-drop comment="" disabled=no
add action=reject chain=smtp-first-drop comment="" disabled=no reject-with=
icmp-network-unreachable
add action=jump chain=restrict-tcp comment="" connection-mark=other-tcp
disabled=no jump-target=drop
add action=jump chain=restrict-udp comment="" connection-mark=other-udp
disabled=no jump-target=drop
add action=jump chain=restrict-ip comment="" connection-mark=other disabled=
no jump-target=drop
add action=accept chain=forward comment="" disabled=no dst-port=8040-8060
protocol=udp src-address-list="port scanners"
add action=accept chain=forward comment="" disabled=no dst-port=8040-8060
protocol=udp src-address-list="port scanners"
/ip firewall mangle
add action=set-priority chain=postrouting comment="" disabled=yes dst-port=
8040-8060 new-priority=1 passthrough=no protocol=udp src-address-list=
"port scanners"
add action=mark-packet chain=prerouting comment="" disabled=yes
new-packet-mark=ping_requests passthrough=yes protocol=icmp
add action=mark-packet chain=forward comment="" disabled=no hotspot=auth
layer7-protocol=extentions new-packet-mark="NET SURF OUT" passthrough=no
add action=mark-packet chain=output comment="" disabled=no dscp=4
new-packet-mark="CASH SPEED" out-interface=!A_IN passthrough=no
add action=mark-packet chain=prerouting comment="" disabled=no
new-packet-mark=all passthrough=no
add action=mark-packet chain=prerouting comment="" disabled=no
new-packet-mark=clinets passthrough=no
add action=mark-packet chain=forward comment="" disabled=no new-packet-mark=
torrentpreans p2p=all-p2p passthrough=no src-address-list=torrentpreans
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment=
"place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat comment="masquerade hotspot network"
disabled=no src-address=10.0.0.0/24
add action=masquerade chain=srcnat comment="masquerade hotspot network"
disabled=no src-address=10.0.0.0/24
add action=redirect chain=dstnat comment="" disabled=no dst-port=80 protocol=
tcp to-ports=8080
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no

[Feklar]

When you say “discontented from the network”, what do you mean? Do they have to sign in again, do they loose their connection to the AP or switch, or does their VPN just not successfully authenticate, and once it is done trying to negotiate the tunnel they are able to continue browsing after?

Are they trying to VPN into your hotspot box, or a remote site?

You seem to have a ton of drop rules for viruses and things, and it looks like things that you haven’t identified in your filter you automatically drop right? If so, I didn’t see any rules that will allow the router to forward the VPN tunnels. Have you tried entering in accept rules for them?

Here us a list of protocols and ports that most standards based VPNs will run over. This covers most of them, but there are more out there than this. Namely there are one or 2 Cisco flavors of VPNs that are not covered by these, but from what I can tell, they aren’t all that common.

dst-port=500 protocol=udp
dst-port=4500 protocol=udp
dst-port=1701 protocol=udp
dst-port=1701 protocol=tcp
dst-port=10000 protocol=udp src-port=!5060,5061
dst-port=10001 protocol=udp src-port=!5060,5061
dst-port=1723 protocol=tcp
protocol=gre
protocol=ipsec-esp
protocol=ipsec-ah