VPN server behind router that performs NAT

[Egbert Nierop \(MVP for IIS\)]

Hi,

Is it possible, to serve a VPN connection to external access through the
internet, while my router (a adsl router in fact) does not support to
'forward' IP protocol 47 (as the KB says)?
I only can port-forward port 1723 (I have a SiteCom modem)...

(The modem supports NAT/NAPT and dynamic NAPT)...

 

[Bill Grant]

You will not be able to use PPTP through a router which cannot handle GRE
(IP protocol 47). PPTP (tcp port 1723) only sets up and maintains the
tunnel. The actual encrypted data travels as the payload of packets with a
GRE headers.

If anything in the path (router, firewall etc) blocks GRE, the
connection will soon time out because no data is transferred.

 

[Egbert Nierop \(MVP for IIS\)]

You will not be able to use PPTP through a router which cannot handle GRE
(IP protocol 47). PPTP (tcp port 1723) only sets up and maintains the
tunnel. The actual encrypted data travels as the payload of packets with a
GRE headers.

If anything in the path (router, firewall etc) blocks GRE, the
connection will soon time out because no data is transferred.

Ok clear

If I enable 'bridge filtering' on that modem,
I have the following
forward destination mac:[my mac address of W2k server] MAC type: 002f
(hexedecimal for 47).
Would that do the trick?

Thanks...

 

[Bill Grant]

I doubt if that is what is required. GRE is a protocol, not a port. It
isn't forwarded, it is just allowed, permitted or enabled (depending on the
router manufacturer's terminology).Microsoft RRAS uses allow, Cisco uses
permit and so on.

You will not be able to use PPTP through a router which cannot handle GRE
(IP protocol 47). PPTP (tcp port 1723) only sets up and maintains the
tunnel. The actual encrypted data travels as the payload of packets

with

a
GRE headers.

If anything in the path (router, firewall etc) blocks GRE, the
connection will soon time out because no data is transferred.

Ok clear

If I enable 'bridge filtering' on that modem,
I have the following
forward destination mac:[my mac address of W2k server] MAC type: 002f
(hexedecimal for 47).
Would that do the trick?

Thanks...

 

[Egbert Nierop \(MVP for IIS\)]

Hi Bill,

I did not say that GRE was a port. I know about the types of protocols...
But my modem uses the terminlogie as stated (such as MAC type)... in a menu
called 'bridging'

I suspect that MAC type is the same as 'protocol'. What do you think?

I doubt if that is what is required. GRE is a protocol, not a port. It
isn't forwarded, it is just allowed, permitted or enabled (depending on the
router manufacturer's terminology).Microsoft RRAS uses allow, Cisco uses
permit and so on.

You will not be able to use PPTP through a router which cannot

handle
GRE

(IP protocol 47). PPTP (tcp port 1723) only sets up and maintains the
tunnel. The actual encrypted data travels as the payload of packets

with

a
GRE headers.

If anything in the path (router, firewall etc) blocks GRE, the
connection will soon time out because no data is transferred.

Ok clear

If I enable 'bridge filtering' on that modem,
I have the following
forward destination mac:[my mac address of W2k server] MAC type: 002f
(hexedecimal for 47).
Would that do the trick?

Thanks...

 

[Bill Grant]

I don't think that has anything to do with it, to be frank. That all
sounds like forwarding details.

If you can't find anything about GRE by name or by IP protocol number,
look for things like PPTP pass-through or even VPN pass-through mode. They
all seem to be used by various manufacturers to describe allowing GRE.

Hi Bill,

I did not say that GRE was a port. I know about the types of protocols...
But my modem uses the terminlogie as stated (such as MAC type)... in a menu
called 'bridging'

I suspect that MAC type is the same as 'protocol'. What do you think?

I doubt if that is what is required. GRE is a protocol, not a port. It
isn't forwarded, it is just allowed, permitted or enabled (depending on the
router manufacturer's terminology).Microsoft RRAS uses allow, Cisco uses
permit and so on.

You will not be able to use PPTP through a router which cannot handle
GRE
(IP protocol 47). PPTP (tcp port 1723) only sets up and maintains the
tunnel. The actual encrypted data travels as the payload of packets with
a
GRE headers.

If anything in the path (router, firewall etc) blocks GRE, the
connection will soon time out because no data is transferred.

Ok clear

If I enable 'bridge filtering' on that modem,
I have the following
forward destination mac:[my mac address of W2k server] MAC type: 002f
(hexedecimal for 47).
Would that do the trick?

Thanks...