Results 1 to 9 of 9
  1. #1
    Untanglit
    Join Date
    Oct 2007
    Posts
    27

    Default Site to site VPN questions

    Hello,
    I'm trying to setup site to site VPN with 2* Untangle 6

    Network:

    Main site network (VPN server):
    Internal network (192.168.10.0)
    UT Internal Bridge with external
    External static: 192.168.10.204
    Linksys router (192.168.10.10)
    DSL connection (dynamic IP with Dyndns)


    Remote Site (VPN Client)
    Cable connection - Linksys router (192.168.1.1)
    UT (192.168.1.100 on external static)
    Internal in Bridge mode - network (192.168.1.0)

    Config in server:
    Adress Pool: 172.16.17.0
    Network address : 192.168.1.100 (255.255.255.0)

    Exported hosts & networks:
    Name: External network: 192.168.1.0 (255.255.255.0)
    Name: Internal network: 192.168.10.0 (255.255.255.0)

    In the event log on the server I can see an active connection,
    12/23/08 active connection site1 84.123.43.32:33375 KB sent: 7.2 Kb received: 6.8
    In the event log of the client I see nothing?
    but status = connected to hostname.hopto.org from the server


    I cannot reach Ip's from internal network to site network or from site network to internal...
    Do I have to add some routings?
    Do I have to see something in the eventlog?
    Any other toughts?
    thanks

  2. #2
    Untangler
    Join Date
    Nov 2007
    Posts
    35

    Default

    Hi,

    Although some would disagree, I set the routing on the PC's I wish others to have access to.


    Pip Pip

  3. #3
    Untanglit
    Join Date
    Oct 2007
    Posts
    27

    Default

    yes but setting routings on a PC is not possible,

    The VPN would be used to connect a serial to lan interface between 2 locations. This to control a telephony system. Can I set extra routings in the Broadband routers?
    Is there a way to see the IP of the Client Untangle? or is this not important? (bridging?)

    Is port 443 needed for VPN, I thought only 1194?

    In my test setup port 443 is not blocked by the ISP but in the setup of the client it will be blocked...
    Last edited by speciall; 12-23-2008 at 05:17 AM.

  4. #4
    Master Untangler
    Join Date
    Aug 2008
    Posts
    939

    Default

    Quote Originally Posted by speciall View Post
    Hello,
    I'm trying to setup site to site VPN with 2* Untangle 6

    Network:

    Main site network (VPN server):
    Internal network (192.168.10.0)
    UT Internal Bridge with external
    External static: 192.168.10.204
    Linksys router (192.168.10.10)
    DSL connection (dynamic IP with Dyndns)


    Remote Site (VPN Client)
    Cable connection - Linksys router (192.168.1.1)
    UT (192.168.1.100 on external static)
    Internal in Bridge mode - network (192.168.1.0)

    Config in server:
    Adress Pool: 172.16.17.0
    Network address : 192.168.1.100 (255.255.255.0)

    Exported hosts & networks:
    Name: External network: 192.168.1.0 (255.255.255.0)
    Name: Internal network: 192.168.10.0 (255.255.255.0)

    In the event log on the server I can see an active connection,
    12/23/08 active connection site1 84.123.43.32:33375 KB sent: 7.2 Kb received: 6.8
    In the event log of the client I see nothing?
    but status = connected to hostname.hopto.org from the server


    I cannot reach Ip's from internal network to site network or from site network to internal...
    Do I have to add some routings?
    Do I have to see something in the eventlog?
    Any other toughts?
    thanks
    Since you have both sides in Bridge mode, you will need to add routes in the Linksys that point "back" to the untangle boxes for the VPN networks. With the way you have it setup now, it won't know where to route those subnets and just send the traffic to your ISP.

  5. #5
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    26,490

    Default

    Far is correct, the default gateway on all your clients is pointed at a device other than untangle. Only static routes in that default device for the networks on the other side of the tunnel will get you where you need to go.
    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

  6. #6
    Untanglit
    Join Date
    Oct 2007
    Posts
    27

    Default

    OK, thanks for the reply,
    Is it better then to setup one UT in router mode and one in bridge?
    or doesnt that matter?


    On a computer on the server side I can do this:
    tracert 192.168.1.1
    Tracing route to 192.168.1.1 over a maximum of 30 hops
    1 1 ms 1 ms 1 ms 192.168.10.204
    2 27 ms 22 ms 22 ms 172.16.17.5
    3 * * * Request timed out.

    so this one knows where to go
    On a computer on the client VPN side I see this:
    tracert 192.168.10.10
    Tracing route to 192.168.10.10 over a maximum of 30 hops

    1 <1 ms <1 ms <1 ms 192.168.1.1
    2 11 ms 11 ms 12 ms d54C422.access.dslt.be [84.197.224.12]
    3 * * * request time out.

    What do I have to setup in the route tables?

    client side: 192.168.10.0 via 192.168.1.100? Or via the 172.16.17.X?

    Server side: 192.168.1.0 via 192.168.10.204 or via the 172.16.17.5?

    thanks,

  7. #7
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    26,490

    Default

    All you should have to do is point the other network at your untangle's IP address.

    So on the 192.168.10.0 side you put a route in the router that says destination network 192.169.1.1 -> UT ip and it will handle the rest. Just flip it around for the other side.

    Oddly enough, it looks like your 192.168.1.1 side is working already, it's the return path that is broken.
    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

  8. #8
    Master Untangler
    Join Date
    Aug 2008
    Posts
    939

    Default

    On your main site Linksys: add a LAN side route of 192.168.1.0 255.255.255.0 gateway 192.168.10.204

    On your Remote site LInksys: add a LAN side route of 192.168.10.0 255.255.255.0 gateway 192.168.1.100.

    Everything will begin to work.

    P.S. It's fine to leave everything in Bridge mode. The settings I gave you above assumes bridge mode. If you decided to put both Untangle boxes in Router mode and get rid of the Linksys at each location, you wouldn't need to add these routes because the VPN engine would automatically add them for you.
    Last edited by far182; 12-23-2008 at 08:31 AM.

  9. #9
    Untanglit
    Join Date
    Oct 2007
    Posts
    27

    Default

    OK thanks guys,
    added the route on the client vpn router to 192.168.10.0 via 192.168.1.100
    and everything works, looks indeed like the return path did not work

    thanks!

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

SEO by vBSEO 3.6.0 PL2