Re: Confused by pptp and gre, what is the true way to do it?

------=_Part_330_11204174.1289474275428
Content-Type: multipart/alternative; 
	boundary="----=_Part_331_1090100.1289474275428"

------=_Part_331_1090100.1289474275428
Content-type: text/plain
Content-Transfer-Encoding: 7bit

Hello, I investigated further the problem.
Using 2 snoops, one on each ethernet card (public and private), I can see traffic on 1732 started
by my internal win machine, the I can see the reply on that port coming to my wan, then to my lan
up to the win machine.
After, I just can see packets coming from the remote machine (stated as IP, but probably gre),
getting into the firewall and going into the lan up to the win machine.
No packet is going from the win machine on any destination.
Maybe the gre traffic is not correctly natted? Does ipfilter do masquerading on gre?
Gabriele.
-= Mail sent through WebTop2 =-
Da:
Gabriele Bulfon
A:
[email protected]
Data:
10 novembre 2010 17.02.22 CET
Oggetto:
Confused by pptp and gre, what is the true way to do it?
Hello, I've read around about how to make windows pptp vpn work behind ipfilter, but I've seen
a lot of confusion...(to me, at least).
My windows machine is in the LAN, passing through a solaris machine with ipfilter 4.1.9.
What are the general rules to let Windows pass the NAT and run the handshake?
Some talks about proxy / pptp rules mappings, some talks about just opening the ports...
I tried this but it doesn't work:
ipnat:
#NAT rules
map igb1 mylan/24 -mypubip/32 proxy port ftp ftp/tcp
map igb1 mylan/24 -mypubip/32 portmap tcp/udp 10000:40000
map igb1 mylan/24 -mypubip/32
#redirect gre to my windows machine
rdr igb1 mypubip/32 -winlanip gre
ipf:
#NAT windows machine
pass out quick on igb1 from mywinip/32 to any keep state
#Let gre enter the firewall
pass in quick on igb1 proto gre from any to mypubip/32
#Let gre pass the rdr
pass in quick on igb1 proto gre from any to winlanip/32
-= Mail sent through WebTop2 =-

------=_Part_331_1090100.1289474275428
Content-type: text/html
Content-Transfer-Encoding: quoted-printable

<div style=3D"font-family: Verdana; font-size: 12px;">Hello, I investigated=
 further the problem.<br>Using 2 snoops, one on each ethernet card (public =
and private), I can see traffic on 1732 started<br>by my internal win machi=
ne, the I can see the reply on that port coming to my wan, then to my lan<b=
r>up to the win machine.<br>After, I just can see packets coming from the r=
emote machine (stated as IP, but probably gre),<br>getting into the firewal=
l and going into the lan up to the win machine.<br>No packet is going from =
the win machine on any destination.<br>Maybe the gre traffic is not correct=
ly natted? Does ipfilter do masquerading on gre?<br><br><br>Gabriele.<br><d=
iv><br><font size=3D"1">                 -=3D Mail sent through WebTop2 =3D=
-</font>
</div><br><hr><br><br><font face=3D"Arial, Helvetica, sans-serif" size=3D"2=
"><b>Da:</b> Gabriele Bulfon &lt;[email protected]&gt;<br><b>A:</b> ipfil=
[email protected] <br><b>Data:</b> 10 novembre 2010 17.02.22 CET<br><b>=
Oggetto:</b> Confused by pptp and gre, what is the true way to do it?<br></=
font><br><br><blockquote style=3D"border-left: 2px solid rgb(0, 0, 128); ma=
rgin-left: 5px; padding-left: 5px;"><div style=3D"font-family: Verdana; fon=
t-size: 12px;">Hello, I&#39;ve read around about how to make windows pptp v=
pn work behind ipfilter, but I&#39;ve seen<br>a lot of confusion...(to me, =
at least).<br><br>My windows machine is in the LAN, passing through a solar=
is machine with ipfilter 4.1.9.<br>What are the general rules to let Window=
s pass the NAT and run the handshake?<br>Some talks about proxy / pptp rule=
s mappings, some talks about just opening the ports...<br><br>I tried this =
but it doesn&#39;t work:<br><br>ipnat:<br><br>#NAT rules<br>map igb1 mylan/=
24 -&gt; mypubip/32 proxy port ftp ftp/tcp<br>map igb1 mylan/24 -&gt; mypub=
ip/32 portmap tcp/udp 10000:40000<br>map igb1 mylan/24 -&gt; mypubip/32<br>=
#redirect gre to my windows machine<br>rdr igb1 mypubip/32 -&gt; winlanip g=
re<br><br>ipf:<br>#NAT windows machine<br>pass out quick on igb1 from mywin=
ip/32 to any keep state<br>#Let gre enter the firewall<br>pass in quick on =
igb1 proto gre from any to mypubip/32<br>#Let gre pass the rdr<br>pass in q=
uick on igb1 proto gre from any to winlanip/32<br><div><br><font size=3D"1"=
>                 -=3D Mail sent through WebTop2 =3D-</font>
</div></div>

</blockquote></div>

------=_Part_331_1090100.1289474275428--

------=_Part_330_11204174.1289474275428--