Networks

Ask something
Discussion Locked

Router issue

0 helpful
7 replies

by d_unafraid

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

The scenario is, at home my users are having a single broadband connection
sharing with some router to 4 PCs. The 4 individual PCs are getting private
IP addresses(for Ex. 192.168.1.x) from the router DHCP. Other than this,
there is no other extra settings in the router. With this settings, my
users can go to Internet and but can't login to our E-mail Server through
VPN.

In other case, if the same user connects his PC after the router (to the
direct broadband cable), he can go to Internet and can login to our E-mail
Server through VPN without any problem. In this case, he is getting a
public IP address to his PC.

The conclusion is, CheckPoint VPN is working fine when the users are getting
a public IP to their PC and the VPN is not working when the user is getting
some private IP from the Router DHCP.

So, is there any way that, we can over come this VPN connection problem
through shared broadband?

7 replies

by cg it

depends upon the "some" router and its capabilities.

"Some" routers are VPN End Points meaning the router establishes and maintains the tunnel, users just pass data through it. Other "some" routers allow PPTP and L2TP traffic to pass through it and do not establish and maintain the tunnel. So without knowing what kind your "some" router is, difficult to suggest solutions to your senario.

If your "some" router has a firewall feature and it's turned on, then chances are its blocking the PPTP/L2TP traffic. It should have a configuration feature to allow you to "pass through" this traffic on port 1723 and GRE47.

give some more details on the type of router

by edlockett

Make sure you have latest patches / service packs for server and client VPN software. See if there is a firmware upgrade for your router.
If it is a really cheap router it may not have PPTP pass-through.

by sgt_shultz

we can help better if you post your os's.
this sounds like a dns problem to me. maybe you are not getting dns requests forwarded out to internet methinks. see if you can browse behind router when using address instead of url. ping url to get address. put that in browser address line. if you can surf then, it is dns problem.
put bosses laptop behind router (where it won't get on internet). open command prompt. ping your isp's dns servers. if you don't know how to do that, write back. if you can ping them then unlikely it is a firewall problem. more evidence for dns problem. you may have incorrect gateway setting on clients. or you may have not filled out dns settings on router. could be various stuff. do you have dns server on your network now. if you don't know, for our purposes you do not. whatever clients are using for gateway is not getting their dns requests handled. maybe just another setting in the router that is blank now and needs to get filled in with dns server info provided by your isp. can't checkpoint help with this. i would love to have real checkpoint sheesh.
do any of them work? use ipconfig or winipcfg to see what settings you have now.
2 cents: dhcp is fine for getting stuff working but i say you want static lan addresses for everybody. you can leave the service there for helping you get new computers on network and for occasional visitor but consider not using it as sop.

by mshavrov

1. CheckPoint VPN client uses UDP IPSec. When your "protected" packet goes through NAT (network address translation), it corrupts packet's checksum and invalidates packet. When your user is connected directly to the Interent, packet comes exactly as it leaves your PC. With Cisco VPN Client, for example, you may use standard IPSec (which works through UDP), and you may connect through TCP on port 10000. In first case it does not work through a router, in second case - works. There may be a 'Use Through NAT Transparency Mode', 'Use through Firewall', or similar setting in the client software; if so, select it.

2. Your router does not pass proper ports. You may configure (if you can), "virtual server" to forward ports 256, 564, and 500 to your PC.

Good luck. If you have more questions, just e-mail me.

Michael Shavrov
CCNP, CCDP, CCSP, Checkpoint CCSP, Security+, MCSE W2K, MCSE+I, etc...

This discussion is closed to new replies.