I'm trying to implement an RRAS-configured Windows 2000 server to permit incoming client VPN connections over PPTP and Layer 2 Tunneling Protocol (L2TP). The server is behind a firewall. What ports do I need to open on the firewall to permit the necessary types of traffic to access the server?
For PPTP VPN connections, you need to open TCP port 1723 for PPTP tunnel maintenance traffic and permit IP Type 47 Generic Routing Encapsulation (GRE) packets for PPTP tunnel data to pass to your RRAS server's IP address. If the PPTP-based RRAS server is the calling router on router-to-router VPN connections (i.e., VPN-based LAN-to-LAN connections to another RRAS server), you need to create an input filter (i.e., inbound rule) on your firewall to open TCP port 1723 as a source port to your RRAS server. For L2TP VPN connections, you need to open UDP port 500 for Internet Key Exchange (IKE) traffic and UDP port 1701 for L2TP traffic. If you restrict outbound traffic, be sure to open all these ports in that direction so that the VPN server can properly communicate with your remote VPN clients.
If VPN traffic is the only traffic you permit to your RRAS server, the best practice from a security standpoint is to deny all traffic except the types I listed in the previous paragraph. I also suggest that you place your RRAS server in a network demilitarized zone (DMZ) rather than on the internal LAN. Chapter 9 of the Microsoft Windows 2000 Server Resource Kit's "Internetworking Guide" volume provides information about properly configuring firewalls for this situation and other VPN server scenarios.
Reader Comments
I keep seeing the comment about permitting IP Protocol 47 (GRE). How is that done.
Mike Bartosh -May 15, 2002
*quotes Mike Bartosh* - How to set up a rule for IP Protocol Type 47 on a Router that only allows you to forward single ports?
Oliver Schneider -December 30, 2003
Sr, I´d like to find any program in order to download movie across a firewall of my company. P2P protocol is disabled. Where can I read some about it?. Thanks
Einar Montero -April 23, 2004
I am trying to establish VPN Traffic through a router, no firewall. I have configured Port 1723 to forward to the server IP address. This is still not allowing me to pass through. How do I configure a rule for IP Type 47 on a Router.
Jeff Levy -May 14, 2004
Folks, how can i know what ports are available to use? I have Kazaa but i don't know in which port i have to use
Pablo Guzmán -May 18, 2004
I opened all the ports listed as required on the router...including 1723. When I try to connect - I get a "did not respond" error. If I switch the machine to a local DMZ...boom...I get right thru and the VPN works as it should. I don't want to leave the server wide open in the DMZ however.
I can't seem to find the 'missing' port forward.
Can anyone help?
Here are the ports that are forwarded: 47, 1700-1750, 445.
Rob -June 18, 2004
Firstly, PPTP (VPN) is ENTIRELY different to PTP (Kazaa, etc) If you don't know the difference do some research and stop downloading rubbish illegally!
Second, You need to allow Protocol 47, not port 47 for this to work! There IS a difference!
Anonymous User -December 07, 2004
well what is protocol 47, i am using a linksys router, it gives me the options of TCP and UDP to forward....
Anonymous User -January 06, 2005
protocol 47 is not TCP and not UDP! It ist a protocol like TCP and UDP. A lot of routers do not permit to forward this protocol. The cisco 800 series does
Anonymous User -January 13, 2005
On a linksys router, you can set it to allow pptp passthrough. Depending on your Linksys router, it would be on the VPN Passthrough page under Security. Then route port 1723 traffic to your RAS server on the port range forwarding page. If you are using a firewall, you enable protocol 47 by using "gre" like so...
access-list acl_in permit gre any any
Hope this helps!
Anonymous User -January 14, 2005
If you 'd like to do a good test, try the VPN connection from an other site (physicaly) :
the Client must'nt be on the same local area as the vpn server (client can't pass through the same router as the server) . It coulds help
Anonymous User -February 18, 2005
If you're running your firewall on a unix
box, then you can use pptproxy:
http://www.mgix.com/pptpproxy
Anonymous User -July 09, 2005
Open port 47 as well.
http://compnetworking.about.com/od/vpn/l/bl012101a11.htm
Let me know if that works out for you.
Free CDs Offer Fundamental Content for IT Pros Are you up to speed on the latest technologies and solutions? Don't miss out on your chance to get up to speed quickly on fundamental, in-depth information on some of the hottest topics in our library of content.
Let Your Users Reset Their Own Passwords: Free Download Try a 30 day free trial of Desktop Authority Password Self-Service – it provides an easy-to-use, robust system for allowing users to reset their own forgotten passwords or locked accounts.
Get Windows IT Pro & Mark Minasi’s Favorite Power Tools Guide Order Windows IT Pro now and get "More of Mark Minasi's Favorite Power Tools"--a in-depth guide to the most useful Windows commands --FREE with your paid order! Subscribe today, and save 58% off the cover price!
Deep Dive into VMware vSphere, eLearning Series Join John Savill to explore the major functionality capabilities of the vSphere virtualization platform, including identification of the changes from ESX 3.5.
Register
