Re: Error 720 connecting to server via VPN

Hi Joe,

I think I understand.

I've checked the system log and found the following...

A connection between the VPN server and the VPN client XXX.110.88.173 has
been established, but the VPN connection cannot be completed. The most common
cause for this is that a firewall or router between the VPN server and the
VPN client is not configured to allow Generic Routing Encapsulation (GRE)
packets (protocol 47). Verify that the firewalls and routers between your VPN
server and the Internet allow GRE packets. Make sure the firewalls and
routers on the user's network are also configured to allow GRE packets. If
the problem persists, have the user contact the Internet service provider
(ISP) to determine whether the ISP might be blocking GRE packets.

So that clearly suggests the GRE is being blocked.

The problem is I don't know how to enable a protocol. The PPTP port is
open. Should I setup a firewall rules to allow port 47? But I think from
your last message, that's not the answer.

Thanks,

Craig

"Joe" wrote:

Craig Hughes wrote:
Hi Russ,

Port 1723 (PPTP) is allowed in my router for any WAN users to the server.

I've not got a rule for GRE (Port 43 I think) as I read it was a IP protocol
rather than TCP or UDP. My router only allows TCP, UDP or TCP/UDP. Should
I create a rule for port 43 as TCP/UDP?

My router is Netgear. I can't see any existing rule I can select for GRE or
port 43.


It's 47, it is a protocol and therefore has no connection with TCP or
UDP ports (most protocols don't use ports) and if you selected 'PPTP
Service' or similar on a Netgear machine then TCP/1723 and GRE are both
included. If you enable logging on that rule, you'll see (when the
system finally works) an initial TCP/1723 handshake followed by numerous
GRE packets, which carry the encrypted data.

> The Client I'm trying to connect is on the same subnet as the server,
> 255.255.255.0.

No, that's the netmask. That may or may not be the same, but the network
address, which is the IP address ANDed with the netmask (in this case
the first three octets of the IP address) must be different. This is
the most common cause of your particular problem. Your SBS has one of
the most common private network addresses (192.168.0.) and there's a
fair chance that the remote router also uses it. If so, one or the other
must change, and I'd recommend using the Change IP Address wizard on the
SBS to alter the LAN network address to something much higher, like
192.168.55. so it is unlikely to conflict with any default anywhere else.

Do you get any entry in the System event log on the SBS? If the TCP
connection works but GRE is blocked, then there will be a message to
that effect. Using the same network address at both ends produces
unpredictable errors, as there is confusion in routing, and some
messages will get through, some won't. Sometimes you'll get the System
message, sometimes not. Usually the process will fail during
authentication, when several pieces of data need to be exchanged and
some get dropped.


.

Relevant Pages

  • Re: ISA/VPN/Router
    ... I don't know how to enable IP GRE 47. ... after I forward port 47 to the SBS. ... I understand that when you try to establish a VPN ... >> a PPTP client and a PPTP server. ...
    (microsoft.public.windows.server.sbs)
  • Re: 1 NIC v. 2 NICS & remote access questions from beginner
    ... a remote user I would recommend using a secure VPN. ... VPN funcionality I`ll tend to use that, ... the firewall for each service to the SBS server. ... >> assigned to its LAN port. ...
    (microsoft.public.windows.server.sbs)
  • Re: Cant Telnet
    ... I have a SBS2000 server at my office with 2 nics, Zyxel prestige DSL modem, ... VPN Software to establish a VPN to my office. ... "Cannot open the VPN connection. ... > standard port for telnet, other service such SMTP VPN will use different ...
    (microsoft.public.windows.server.sbs)
  • Re: PC specific vpn issues
    ... You said you could run pptpclnt/pptpsrv successfully from the client...but just to be clear, pptpsrv needs to be run on the SERVER. ... the pptp ping tools only verify GRE. ... The fact that other machines are working and the same account works on other machines tells me a pretty blatant communications issue with the client, not the server. ... I tried connecting to another company's SBS vpn and have same issue. ...
    (microsoft.public.windows.server.sbs)
  • Re: VPN Client
    ... To allow VPN, you actually need to open outbound 1723 port on remote client ... Microsoft CSS Online Newsgroup Support ... | not just the server side. ...
    (microsoft.public.windows.server.sbs)