Comments on: Cannot connect to VPN and do not know why

Question: Cannot connect to VPN and do not know why

criticman — Fri, 15 Sep 2006 06:13:00 -0800

Why can I not VPN in consistently to work?

It DOES work on WinXP Pro w/ Windows Firewall on:
-directly plugged into Comcast Cable modem
-unsecured WiFi connection downtown
-using Verizon Wireless phone as modem for DUN

It DOES NOT work on WinXP Pro w/ or w/o Windows Firewall on:
-behind Linksys WRT54G wireless router, either plugged into it or using wireless connection, even when all VPN, IPSEC options are set to enable pass through and the firewall on the device is disabled
-plugged into a port on my alma mater's network

When it does not work, it just says connecting to (IP ADDRESS)... and eventually times out after several minutes.

I have looked all over the internet and not found a solution that makes sense since this happens on networks without the Linksys device. No other user has this issue, other than my boss (also new to company) and he has tried the same attempt methods, other than the college's connection.

Please help! Much appreciated!

By: sohcahtoa

sohcahtoa — Fri, 15 Sep 2006 06:37:25 -0800

What kind of VPN? I've got more experience with Checkpoint, older versions of that can be a real beast. Normally make sure you're using the newest version of the VPN client, unless your IT group says to use an older version for compatiblity (Hello, Checkpoint pre-NG!).

Make sure the linksys is at the most recent firmware. Try to dial down the MTU on the system (I've had problems where an ISP was silently dropping large ipsec packets) - but don't leave that setting if it doesn't help. Try to change the private IP range of your linksys to something unusual (99% will be set up for 192.168.1.0/24, change yours to 192.168.187.0/24 or 10.4.5.0/24 for example - older Checkpoint VPNs that don't use Office Mode get confused by multiple connections from the same NAT space, or if your private network is the same range as the corprate network).

When testing with the linksys, concentrate on when you're plugged in so as to not muddy the waters. I wouldn't concentrate on the connection from the university since that might be prohibited by policy.

By: chuma

chuma — Fri, 15 Sep 2006 06:57:25 -0800

Is UPnP port forwarding enabled on your WRT54G? Windows XP will try to open the appropriate VPN port(s) on your router using UPnP (assuming you are using the standard Windows VPN connection type, also known as PPTP).

Ditto what sohcahtoa said about the university connection: they probably have stuff locked down enough that it won't work from there no matter what you do.

By: paulsc

paulsc — Fri, 15 Sep 2006 08:27:45 -0800

VPN clients and servers are not all interchangeable. Speculating on possible causes without knowing what VPN client you are using, and with what VPN server you are trying to connect isn't likely to be helpful. So:

1) What VPN client are you using?
2) What VPN server is your company using?
3) What corporate firewall are you going through?
4) What revision of your WRT54G firmware are you running?

I agree with chuma about forgetting VPN from a uni network.

By: Leech

Leech — Fri, 15 Sep 2006 11:31:46 -0800

Maybe it doesn't apply to your architecture but when I get stuck in those networking on windows, I use Hamachi and problem solved.

By: criticman

criticman — Sat, 16 Sep 2006 12:26:27 -0800

Client: Windows XP Pro, setup through the "Create a new network connection wizard, connect to work network, VPN, etc"
Server: Windows NT
Corporate Firewall: A Cisco device
WRT54G: Latest firmware revision updated last week from their site

By: paulsc

paulsc — Sun, 17 Sep 2006 12:09:48 -0800

If your servers are still Windows NT, you're probably trying to establish a VPN connection only to the corporate firewall, which you list as a Cisco device. Using the Windows VPN client, you get some default behaviors introduced with Windows XP SP2 that may be hanging you up. You may have better luck through your corporate site, if they can get you a copy of the Cisco VPN client, if you are actually making the VPN connection to the Cisco router.

By: criticman

criticman — Mon, 18 Sep 2006 13:58:03 -0800

The VPN connection is to the Win NT box, not the firewall. The firewall is set to pass requests on that IP and that port to the box, where accounts are setup.