Networks

Ask something
Discussion Locked

Microsoft VPN (RRAS) through D-Link DIR-655 = ARGH!

0 helpful
16 replies

by chris 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi everyone. I'm absolutely stumped as to why I cannot make my VPN accessible from outside the network. Previously, I had a Linksys WRT54GS with the Thibor firmware. It worked like a dream. This new router is nothing short of amazing, but I can't get the VPN to pass through it.

I've tried just about everything. The problem seems to be GRE packets are not passing through the router. This is a testy subject, as GRE is neither TCP or UDP, so it's difficult to forward. I do, however, have PPTP and IPSec ticked in the Advanced > Firewall Settings > ALG Configuration.

Here's what I've forwarded (which is probably more than I need):

Port 47: Both TCP & UDP
Port 50: Both TCP & UDP
Port 1723: TCP
Port 500: UDP
Port 4500: UDP
Port 1701: UDP

...and as I said earlier, I have both PPTP and IPSec checked.

This is the error I'm getting:

A connection between the VPN server and the VPN client 67.*.*.* has been established, but the VPN connection cannot be completed. The most common cause for this is that a firewall or router between the VPN server and the VPN client is not configured to allow Generic Routing Encapsulation (GRE) packets (protocol 47). Verify that the firewalls and routers between your VPN server and the Internet allow GRE packets. Make sure the firewalls and routers on the user's network are also configured to allow GRE packets. If the problem persists, have the user contact the Internet service provider (ISP) to determine whether the ISP might be blocking GRE packets.

I also get a string of errors on the server from the printers from the outside network showing up in the event log of the VPN server (at least something is showing up...)

I'm completely at a loss. I don't know what to do. Oh yeah.... the error I get on the remote computer is Error 721, of course.

The last thing I can think of to try is to upgrade the firmware on the DIR-655. It's currently at 1.03, but 1.05 is out. I haven't tried this because I'm working the issue remotely. I'll be at the router this afternoon, so I'll try that then. I just figured I'd pick everyone's brain while I was waiting?

16 replies

by harry

Hello all,

Am getting the same error, on a Windows Server 2003, running behind a D-Link router. Any work arounds...?

Harry

by chris

Nope. I have no idea why it won't connect.

I'll try again today... I haven't messed with it for a few days, so maybe a fresh approach will help.

by jacoberdei

I came across this just a few weeks ago with a client. Spent a few hours trying to get a work around but was unable. If anyone has gotten it to work drop a line here.

by marcus.acb

Un-tick, yes un-tick PPTP and IPSec (VPN) in your firewall settings. I had similar issues with GRE and once I unchecked the above I could connect to a MS VPN server. Good luck.

Now if someone can help figure out how the hell to get something as simple as remote administration working, it would be appreciated.

by chris

I'm 99% sure I tried this before. I have since updated to the latest firmware, which takes aways these options. Not sure why, but the area they were at (under Firewall Settings) is gone.

This is on firmware version 1.05....

by marcus.acb

...sorry to hear that. Don't understand why that would be omited on 1.05. Glad I haven't updated, still running on 1.04. Maybe it's worth downloading the older firmware, I didn't see any usefull benefits with 1.05.

by joydyoung

Just to say that I have just had this same problem. Having no knowledge in this area I was absolutely stuck. Your solution worked and I can now access my works's lan

Thanks for taking the time to post the solution

by chris

From what I've been able to read, the ALG options are gone, but they are all automatically enabled.

I don't know if I believe that, because my Packet8 VOIP phone would not work until I unchecked the "SIP" box. I've upgraded to 1.05, and my phone still works. If it was reenabled, then it would stand to reason the phone would not work. Unless something was wrong with the SIP ALG on the 1.03 firmware....

Anyways, I still get the message in the event viewer regarding GRE packets. The VPN server "sees" the request, but can't make the connection.

by chris

In case anyone was still following this thread, it was not the router's fault.

The IT manager swore GRE packets were not being blocked. He was wrong. They were being blocked.

So if you're behind Cisco equipment, that is the most likely cause...

by nba2k1

Under Advanced and Virtual Sever setup two virtual servers.

The first virtual server should point to ip hosting your vpn connection. Set the protocol as "other" with traffic type # 47. This doesn't forward any ports but will allow GRE traffic.

The second virtual server should also point to the ip hosting your vpn connection. Public and Private ports sets to 1723. Set the protocol as TCP traffic type 6.

by biopsychmajor

Worked perfectly. FYI this automatically puts a tick back in the PPTP checkbox under Firewall Settings, and you may have to remove conflicting port forwarding, but it does work. I will now pull the fist-shaped dent out of the 655s plastic. THANKS!

by Former member

All this did not work for me. I am using a PPTP VPN and all the given sollutions have no result, though the problem is exactly the same...

by hq

Thanks. Was pulling my hair out (what's left) on this. Apparently, simple port forwarding for VPN doesn't work on DLink routers as it does on other brands. I did leave PPTP and IPSec passthrough checked on the Firewall Settings page, and made sure MS Chap v2 was enabled in RRAS configuration.

Cheers,
V

This discussion is closed to new replies.