PPTP VPN not working!

PPTP VPN is most simple and convenient way for remote users to connect to a network. For PPTP to work following are the requirement.

1. The VPN router has to have a public IP on it.
2. Port 1723 should be made open by ISP.
(or)
1. Port 1723 should be made open by ISP.
2. The modem should be configured to do port forwarding to VPN routers WAN side private IP, so whenever there is a VPN traffic comming in for port 1723 on the non VPN modem/router it will be forwarded to the VPN router on the LAN.

Note: Port forwarding is not a reliable solution. It is recommended to set the VPN router in such a way it gets the public IP.

Are you having trouble with Cisco Quick VPN?

Qucik VPN works on IPsec technology.

It is important you understand how Quick VPN works to see if all the requirements are met by your VPN router and the VPN user PC.

"QVPN may not work for reasons like -
1. The VPN router has a private range IP with port forwarding done from another gateway device like a ISP modem/router.
2. Security settings which includes firewall on the PC blocking the VPN connection.
3. No up to date Operating System with recent windows service packs.
4. No up to date router firmware.
5. No up to date QVPN client.
6. Pirated or cracked/patched Operating system.
7. ports 50, 51, 443, 60443, 500, 4500 required for QVPN to work are blocked/closed by ISP.
8. LAN IP range on the QVPN router and the remote PC are the same.

Please note that you may use Quick VPN only if the data sheet of the VPN router explicitly says it supports IPsec VPN via Quick VPN, if not you may use any compatible 3rd party VPN client software listed on the data sheet.

Unable to access resources on a subnet through VPN

Issue:-

After connecting through VPN to company network, users are not able to access resources on a specific subnet on their LAN. At the same time, they are able to access some other resources which are in a different subent on their company LAN.

Please find the below scenario:-

LAN subnet on VPN device         : 192.168.1.0/24
LAN interface IP of VPN device  : 192.168.1.1
Second subnet on LAN                : 192.168.2.0/24
Gateway of second subnet            : 192.168.2.1
IP pool for VPN                           : 10.10.10.0/24

Once a home user is connected through VPN to the device, they get an IP from 10.10.10.0/24 on their VPN adapter(for eg:10.10.10.1). After launching VPN, users are able to access only the resources on subnet 192.168.1.0/24 and other subnet(192.168.2.0/24) on their company LAN is not accessible through VPN. When they try to do a traceroute to any resources on 192.168.2.0/24, we will see first hop as 192.168.1.1 and then there won't be any response.

Solution:
This is because of a reverse route which needs to be configured for the VPN IP pool on the gateway interface of 192.168.2.0/24 subnet.

When a VPN user try to access a resource 192.168.2.10 from the machine with VPN adapter IP 10.10.10.1, below are the packet details

Source IP: 10.10.10.1
Destination IP: 192.168.2.10

Since the route table on the PC has a route to pass the traffic through VPN, it will reach the VPN device and the VPN device will forward it to the gateway of 192.168.2.0 subnet. Once the resource on the LAN respond back, then the packet will be as below,

Source IP: 192.168.2.10
Destination IP: 10.10.10.1

Since both source and destination are in different subnet, packet will be forwarded to it's gateway(192.168.2.1). Now that gateway should have a route for the VPN IP pool subnet(10.10.10.0/24) to pass the traffic to the VPN device( 192.168.1.1)

Add a static route with destination network : 10.10.10.0/24 and next hop as 192.168.1.1. Once the return traffic has reached on the VPN device, then the device forward it to VPN client.

Affected devices: Juniper SA/MAG VPN device, Cisco ASA firewall, Cisco ISA VPN device and all other VPN devices which uses SSL or IPsec VPN.

JT