Cisco Home Community

[SLC]

Trying to connect to VPN through the WRT54G2, but when I am connected through the router, it will not allow access to VPN (Error 619).  If I bypass the router and connect my computer directly to the modem, I can access the VPN.

Contacted technical support.  They tried to open port 1723 to allow for GRE protocol 47, but tech support came back and said that there must be another port number to allow access through the firewall as 1723 did not allow access. 

Any suggestions???

[gv]

Please describe the exact setup. You have a computer behind the WRT54G2 and you want to connect from that computer to some VPN server in the internet?

What VPN client do you use?
What VPN server?

Try to telnet to the VPN server, i.e. open a command prompt window and enter "telnet my.vpn.server.example.com 1723". Put in the host name of the VPN server. Do you get a connection? What happens exactly? Any error messages? Please post the exact error message if any.

Is your router directly connected to the internet, i.e. does it show your public IP address on the Status tab? Some modems are in fact routers, too.

[SLC]

GV,

I am trying to establish VPN connection to my remote workplace.

Using DSL line.  Modem connected to router, router connected to computer = internet access, but NO VPN connection

Modem connected to computer (bypass router) = internet access and VPN connection.

VPN client is Microsoft

VPN server is Microsoft routing and remote access

My IT group informed me we do not have telnet access.

Thanks for the help.

[gv]

I did not ask you to telnet to the telnet service on the server (which is not allowed) but to use telnet to establish a tcp connection to the pptp server to see whether this connection works or not. Please follow the instructions I have posted on the computer from which you want to connect and post the results. Your IT group has nothing to do with that. They cannot prevent this test.

Microsoft Windows has multiple VPN clients. I guess you mean the Microsoft PPTP VPN client here. Is that correct?

Does the VPN server have a public IP address or is it actually running behind a NAT firewall/router?

What are the current passthrough settings on the WRT? They are usually found somewhere on the Security tab. You should have three options there for IPSec, PPTP, and L2TP. Please also post the other (filtering) settings on the Security tab.

[WayneJH]

We are having the same problem with our WRT54G2 router.
Tried your advice about "telnet" and get the following:
"could not open connection to the host on port 1723"

Security - Firewall settings are:
X Block Anonymous Internet Requests
X Filter Multicast
Filter Internet NAT Redirection
X Filter IDENT(Port 113)

Security - VPN settings are:
IPSec Passthrough: Enable

PPTP Passthrough: Enable

L2TP Passthrough: Enable

Thanks,
Wayne

[WayneJH]

Tried again without putting the port number after the domain and it failed with "could not open connection to the host on port 23"

[gv]

"could not open connection to the host on port 1723"

The forwarding is not working at all. This is either you have set the forwarding incorrectly, the PPTP server is not running, or the firewall on the server machine does not accept the incoming connections from the internet.

What are the exact port forwarding settings on the router?
Does the router have a public IP address?

Is the PPTP server running?
Check with "netstat -an" that the server is listening on port 1723.

If in doubt, post the full output of "netstat -an" and "ipconfig /all" from the server.

You'll find a more extensive checklist for forwardings here. You may want to go through it to find out how to get the 1723 port forwarding working correctly.

As I have written before, the using telnet without the port number connects to the telnet server which is meaningless and won't work anyway.

Can you please explain again the exact setup? I am a little bit confused. Is the VPN server behind the router or not? Now reading your first post again it seems different although you set port forwarding which would be useless if the server is not behind the router.

If you setup is:

PC with VPN PPTP client connected to WRT connected to internet.
The VPN server is somewhere in the internet.

And you cannot connect with telnet to the server and you see the error message above then the PPTP server is not accessible. That would be either a problem on the server end or you run a overzealous firewall on the computer which blocks all traffic. The telnet connection must work.

Are you sure they run a PPTP server?

Message Edited by gv on 06-07-2008 09:51 AM

[jcve]

I'm having the same problem, except that I CAN connect to my VPN. I have good internet connection, the VPN connects, and in 2 or 3 minutes (when it sends the authentication packet), I get disconnected. I can reproduce this all day long. I tried discussing this with Linksys customer service and what I got was about 45 minutes of diversion. This is not a coincidence. There is something in the firmware on this router blocking the transfer of data across the VPN. Would love to hear from someone that found a workaround.

[SLC1]

My workaround was taking the router back and getting a D-Link router.  Had it set up in 10 minutes with the VPN working, and staying connected.  I agree, there is something with the firmware on the router.  Good luck!

[calmback]

I have the same problem: VPN client connects and is always disconnected in 2-3 mins. Client is PPTP on Vista. Router is WRT54G recently upgraded to v4.21.1. VPN works fine everywhere but this router. Gonna have to pitch it.