Can't access VPN server, only other clients

I am having trouble with my L2TP VPN. I can connect to the VPN server just fine and connect to any other IP address on the network over the VPN connection except the server I am connecting to. The server's address is 192.168.1.1 with a mask of 255.255.255.0. The bottom half of the subnet is reserved for local devices with the upper half dynamically assigned to VPN clients. How can I get my VPN clients talking to the server itself (I want to use Screen Sharing with the server over the VPN)?

The DNS server address was wrong (not 127.0.0.1 but 192.168.10.1) on the en1 interface. I changed that, but it didn't do anything immediately. I flushed DNS caches, double checked changip (which was okay), the name of the server... Then I restarted. And :
"ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280
inet 192.168.10.101 --> 192.168.10.1 netmask 0xffffff00 "
(ifconfig from the client). Notice the change of the gateway. Before, it was the public IP, now it's the internal IP. Quite interesting, since I can now ping the server using this address and accessing its services through the VPN. I was very happy, the only thing that didn't work was the DNS. But I don't know whether it's good or not, and it seems to "change" : I tried to reconnect few minutes later and have been given again the public IP from the server as the gateway IP. Strange. I can't get it working again. I restarted again, flushed caches another time... I managed to get this config three times before the server returned to its previous settings.
Setting the gateway address of the client to 192.168.10.1 is maybe the key (I tried to force the change in the client network settings with no success). I'm going to read the logs and try to spot the differences between the two connections. I will then have to allow the server to answer to incoming DNS request, but, as you said, it's not so insecure...
Here are my firewall rules (Four keep-state rules, very general though) :
00001 allow udp from any 626 to any dst-port 626
00010 divert 8668 ip from any to any via en0
01000 allow ip from any to any via lo0
01030 deny log logamount 1000 ip from any to 127.0.0.0/8
01040 deny log logamount 1000 ip from 224.0.0.0/4 to any in
01050 deny log logamount 1000 tcp from any to 224.0.0.0/4 in
12300 allow tcp from any to any established
12301 allow tcp from any to any out
12302 allow tcp from any to any dst-port 22
12302 allow udp from any to any dst-port 22
*12303 allow udp from any to any out keep-state*
*12304 allow tcp from any to any dst-port 53 out keep-state* (DNS ?)
*12304 allow udp from any to any dst-port 53 out keep-state* (DNS ?)
12305 allow udp from any to any in frag
12306 allow tcp from any to any dst-port 311
12307 allow tcp from any to any dst-port 625
12308 allow icmp from any to any icmptypes 8
12309 allow icmp from any to any icmptypes 0
12310 allow igmp from any to any
*12311 allow udp from any to any in keep-state*
12312 allow icmp from any to any icmptypes 3,4,11,12
12313 allow icmp from any to any
12314 allow tcp from any to any dst-port 59850-59860
12314 allow udp from any to any dst-port 59850-59860
12315 allow tcp from any to any dst-port 25
12315 allow udp from any to any dst-port 25
12316 allow tcp from any to any dst-port 80
12317 allow tcp from any to any dst-port 143
12318 allow tcp from any to any dst-port 465
12319 allow tcp from any to any dst-port 587
12320 allow tcp from any to any dst-port 993
12321 allow tcp from any to any dst-port 443
12322 allow tcp from any to any dst-port 3283,5900
12322 allow udp from any to any dst-port 3283,5900
12323 allow tcp from any to any dst-port 5433
12324 allow tcp from any to any dst-port 5988,5989
12325 allow esp from any to any
12326 allow udp from any to any dst-port 1701
12327 allow udp from any to any dst-port 4500
12328 allow udp from any to any dst-port 500
12329 allow udp from any to any dst-port 5060
12330 allow tcp from any to any dst-port 20-21
12331 allow tcp from any to any dst-port 115
12332 allow tcp from any to any dst-port 53
12332 allow udp from any to any dst-port 53
12333 allow ip from 10.0.0.0/8 to any
12334 allow ip from 192.168.0.0/16 to any
65534 deny log logamount 1000 ip from any to any
65535 allow ip from any to any
I have 5 public IPs, and I can request my ISP to change PTR for me. But I think that this part is already okay (I made them change it two weeks ago to the name of the server for the primary interface). I will try to play a little with firewall rules, to see if it does something.
Thanks again for your help !

Similar Messages

Can't access VPN on OS X Server

At work we have a Mac Mini server with VPN setup for L2TP and PPTP access to the files stored on it.
We have just installed a new router (Draytek Vigor2860) and now can't access the server when working remotely, from home etc...
We have a static IP address for the server (10.0.XX.X) and the following open ports on the router: 1723, 1701, 47, and 500. These ports are also redirected to the server's static IP address. There's also a preshared key which is used in the VPN connection on my machine.
Despite this anytime I try to connect via VPN I'm still getting error 800 messages, does anyone know where I'm going wrong on this?
Many thanks in advance for any help you can provide.

Do you know where I get the server log from? I had a look in Server admin but it didn't have any information on an attempted VPN connection, just users in the office connecting.
This is the report from my laptop trying to connect:
Details about network adapter diagnosis:
Network adapter Wireless Network Connection driver information:
   Description . . . . . . . . . . : Dell Wireless 1901 802.11a/b/g/n (2.4GHz and 5GHz)
   Manufacturer . . . . . . . . . : Atheros Communications Inc.
   Provider . . . . . . . . . . . : Atheros Communications Inc.
   Version   . . . . . . . . . . . : 10.0.0.31
   Inf File Name . . . . . . . . . : C:\Windows\INF\oem5.inf
   Inf File Date . . . . . . . . . : 08 February 2012 04:16:58
   Section Name . . . . . . . . . : ATHR_DEV_OS61_946x.ndi
   Hardware ID . . . . . . . . . . : pci\ven_168c&dev_0034&subsys_020a1028
   Instance Status Flags . . . . . : 0x180200a
   Device Manager Status Code . . : 0
   IfType . . . . . . . . . . . . : 71
   Physical Media Type . . . . . . : 9
InformationalDiagnostics Information (Wireless Connectivity)
Details about wireless connectivity diagnosis:
Information for connection being diagnosed
Interface GUID: 49b428b9-f545-46b7-b6b0-da6219156bd1
Interface name: Dell Wireless 1901 802.11a/b/g/n (2.4GHz and 5GHz)
Interface type: Native WiFi
Connection incident diagnosed
Auto Configuration ID: 3
Connection ID: 6
Connection status summary
Connection started at: 2015-01-09 09:47:36-038
Profile match: Success
Pre-Association: Success
Association: Success
Security and Authentication: Success
Information for Connection ID 6
Connection started at: 2015-01-09 09:47:36-038
Auto Configuration ID: 3
Profile: WLAN909
SSID: WLAN909
SSID length: 7
Connection mode: Infra
Security: Yes
Pre-Association and Association
   Connectivity settings provided by hardware manufacturer (IHV): No
   Security settings provided by hardware manufacturer (IHV): No
   Profile matches network requirements: Success
   Pre-association status: Success
   Association status: Success
    Last AP: 50-67-f0-37-78-bf
Security and Authentication
   Configured security type: WPA2-PSK
   Configured encryption type: CCMP(AES)
   802.1X protocol: No
   Key exchange initiated: Yes
    Unicast key received: Yes
    Multicast key received: Yes
   Number of security packets received: 0
   Number of security packets sent: 0
   Security attempt status: Success
Connectivity
   Packet statistics
    Ndis Rx: 933
    Ndis Tx: 923
    Unicast decrypt success: 64
    Multicast decrypt success: 0
    Unicast decrypt failure: 0
    Multicast decrypt failure: 0
    Rx success: 127
    Rx failure: 674
    Tx success: 167
    Tx failure: 0
    Tx retry: 15
    Tx multiple retry: 0
    Tx max lifetime exceeded: 0
    Tx ACK failure: 561
   Roaming history: 0 item(s)
InformationalDiagnostics Information (Wireless Connectivity)
Details about wireless connectivity diagnosis:
For complete information about this session see the wireless connectivity information event.
Helper Class: Auto Configuration
Initialize status: Success
Information for connection being diagnosed
Interface GUID: 49b428b9-f545-46b7-b6b0-da6219156bd1
Interface name: Dell Wireless 1901 802.11a/b/g/n (2.4GHz and 5GHz)
Interface type: Native WiFi
Result of diagnosis: There may be problem

How can i access dmz server via public ip from inside?

hi all !
As shown in Figure，how can i access the server in dmz zone via public？
i can access it via private ip 192.168.1.1 now,but i can't access it via 101.100.1.2.
who can help me ?
thank you !

Hi,
You would have to configure Static NAT from DMZ to INSIDE for the server in the same way you have done for DMZ to OUTSIDE.
Basically in the following way for example
object network DMZ-WEB
host 192.168.1.1
nat (dmz,inside) static 101.100.1.2
This would enable your users on the "inside" to access the "dmz" server with the public IP address. And naturally only with the public IP address after this NAT.
Hope this helps
Please do remember to mark a reply as the correct answer if it answered your question.
Feel free to ask more if needed
- Jouni

SSRS 2005 why some users can't access report server.

There is one user who can't access report server by clicking a link to a report. A window will pop up asking for login. Even he enters login, the window will keep coming back. I have set the user for that report and assigned the 'Browser' role to the user.
Other users don't have this problem. E.g. for another user I also set him up for the report and assigned 'Browser' role but he can access the same report no problem.

Hi thotwielder,
As per my understanding, I think this issue can be caused by the following two reasons:
The report server can be blocked by Firewall. If Windows Firewall is turned on, the port that the report server is configured to use is most likely closed. Indications that a port might be closed are the appearance of a blank Web page after requesting a
report, or a blank page when you attempt to open Report Manager from a remote client computer. In this scenario, we can try to open port 80 in Windows Firewall on both report server and client computers.
The report server can be blocked by browser. We should ass the report server URL to trusted site in the browser.
We can also grant the user access to site-wide operations with system-level row in report manager to check the issue again.
Please double-check we have been grand the user the browser role on the report. We can navigate to Security property of the report to check the issue.
Reference:
Configure a Firewall for Report Server Access
Configure a Native Mode Report Server for Local Administration (SSRS)
Grant User Access to a Report Server (Report Manager)
Thanks,
Katherine Xiong
Katherine Xiong
TechNet Community Support

I deleted my cookies and now i can't access gmail facebook and other sites

i deleted my cookies and now i can't access gmail facebook and other sites

Thanks, but I tried that and was directed to set up a new password which I did. But, it still wouldn't let me go to my existing Gmail. I was asked to set up Gmail account. I also tried accessing my Gmail from Yahoo. Failed. Someone suggested setting up another Gmail address so that when you logged on it would ask you which Gmail to open. This didn't work and only made the problem worse. Google Help is no help. I guess the only way to access Gmail is with my iPad, but it just isn't right!

Can i get the time capsule to automatically back up my file from my Mac Book Air but have certain files which are only stored on the time capsule and not the computer? Then can i access these files only on the time capsule without connecting it?

Can i get the time capsule to automatically back up my file from my Mac Book Air but have certain files which are only stored on the time capsule and not the computer? Then can i access these files only on the time capsule without connecting it?

igonneau wrote:
Can i get the time capsule to automatically back up my file from my Mac Book Air but have certain files which are only stored on the time capsule and not the computer?
You can, but how are you going to back up those other files? When (not if) your Time Capsule fails, you risk losing them. See #Q3 in Using Time Machine with a Time Capsule for details.
Then can i access these files only on the time capsule without connecting it?
Not sure what you mean. You have to connect a computer, either via Ethernet cable or wirelessly, to read or write to the disk.

Can't Access the Server RootDSE

Hi All,
I am working on Windows platform and trying to create a directory instance in Sun Directory Server 6.0 using its commandline utility dsadmin by executing the following command:
dsadm create - h localhost -p 2389 -P 1064 D:\Temp\SUNDS_TEMPthen strat the instance as:
dsadm start D:\Temp\SUNDS_TEMPThe instance gets created successfully but when I try to access the instance using an LDAP browset it gives me error:
Can't Access the Server RootDSE
Error Code: 32
Error Message: No Such Object
I am creating this instance to use as Access Manager configuration store. Is anybody aware of this issue?
Thanks,
Tariq Chauhdary

Thank you very much all. I was able to resolve this issue.
I did not create the Suffix and LDAP browser and that was the reason for LDAP browser to raise RootDSE error.

I can not accessed J2EE Server because i dont know username and password

I set username and password as tutorials but not successful.
and after that i can't access J2EE server with localhost:4848.
please tell me the way access J2EE server.Or Default username and password of it.
Thanks your help!

Hi,
Can you please send more infomation on exactly what is failing? Are you trying to execute asadmin commands?
Also, which platform are you running the appserver on? Does the appserver show up in the list of currently running processes?
I believe that the default username is "admin" and the password is "adminadmin".
Thanks,
Kyle

What is the "other" - & how can I access or get into "other"?

What is this thing called "OTHER". It's taking up all my gbs. & I can not access the files in "OTHER" to clear them or just to access them. So does anybody know what "OTHER" is? I do know that some of this "OTHER" is used by contact's, calendar, games & other settings etc. But - what about the rest of it? PLEASE PLEASE PLEASE if someone knows - PLEASE reply to me.

Other can be Album Artwork, Notes, Contacts, Firmware etc. or files that are on there if you are using the iPod as a removable storage device. If you feel that Other is being incorrectly reported then try restoring your iPod. Restoring will erase the iPod's hard drive, reload the software and put it back to default settings. Once the restore is complete follow the on screen instructions and it should connect to iTunes and give you a prompt to automatically update your library onto the fresh installation. If you want to update manually or using selected playlists choose no and it will default to manual mode and you can choose whatever setting you like: Restoring iPod to factory settings with iTunes 7

Can connect via VPN, but can't access AFP server on same Xserve

Hi:
I've set up our XServe with MacOS X Server 10.5.2 to do AFP and VPN (L2TP only; PPTP is disabled). The XServe is a standalone server, not connected to any other direstory server.
I can connect to the XServe's AFP server from my Mac over our wired and wireless network. The AFP server shows up in the sidebar of Finder windows. So far, so good.
I am able to successfully connect to our network via the VPN with Mac OS X 10.5.2 client (on two different machines) using L2TP through our network's firewall (on a Netopia T1 router; UDF ports 500 and 4500 and IP Protocol 50 and 51 are open) using a shared secret.
But I cannot connect to the XServe itself to use Server Admin or AFP (using afp://server.company.com or afp://xxx.xxx.xxx.xxx via the Go > Connect to Server command).
The error I get while connecting to the 10.5.2 AFP server is Some data in apf://server.mycompany.com could not be read or written (Error Code -36 ). I saw this error associated with a SMB problem in 10.4.x, but SMB is not running.
Other iChat users in my office also do not automatically show up in the Bonjour list when I connect to the network. Other computers on our network do not appear in the sidebar of a Finder window. (I'm told these are to be expected, as Bonjour isn't supported (in the "local area Bonjour" over a WAN link - it's purely a multicast feature on the network in the office, and won't be routed across the VPN link. True?)
Now, here's the odd part. There is a second server (v10.4.11) on our network running AFP. I can connect to it (using afp://server.company.com via the Go > Connect to Server command) and mount its various sharepoints via the VPN.
The only thing I see in the VPN log that seems amiss is this (but I have no idea what it means):
Tue Mar 11 23:09:27 2008 : Unsupported protocol 0x8057 received
--Both the 10.5.2 and the 10.4.11 servers have DNS properly configured (though our ISP; we're not running our own DNS).
--Both servers and the client have public IP addresses and have the same subnet mask. Network Utility confirms this while connected to the VPN.
--NAT is not running. The ISP is responding with public IPs for the servers.
--The firewall for the 10.5.2 server is not running (but will be once I get this all working).
--The IP address range for the VPN server doesn't overlap our DHCP pool (which also currently uses public IP addresses).
--Any user can access any service.
--No network routing definitions have been set up.
--In essence, I've followed the steps on Pages 141-142 of the Network Services Admin Guide.
One other note: After I connect, the Network Preferences > VPN > Advanced > TCP/IP window shows the IP address for the client just fine (assigned from the VPN pool), but lists the router as having the IP address of the XServe (rather than the router on the network). Is that normal?
I'm hoping I don't need to have the XServe run DNS as an internal LAN DNS server.... And I'm not sure why I would have to if I can already successfully connect to the 10.4.11 AFP server .
What simple step am I missing?
TIA,
mm

"I am able to successfully connect to our network via the VPN with Mac OS X 10.5.2 client (on two different machines) using L2TP through our network's firewall (on a Netopia T1 router; UDF ports 500 and 4500 and IP Protocol 50 and 51 are open) using a shared secret."
I suspect you mean UDP ports and you might need UDP port 1701 open too.
You only need IP protocol 50 (ESP), protocol 51 (AH) isn't used. And ESP is only used when client and server isn't behind NAT (when NAT is used only the UDP ports are used).
"Unsupported protocol 0x8057 received"
This is usually seen when you can't get GRE through but since you don't use PPTP I can't be sure why this is registered in the logs. Sometimes when connecting using PPTP you have to disconnect and then reconnect for everything to work - you might try this for L2TP too.
But if you already can reach services on any LAN nodes through the VPN I wouldn't bother with it.
As you have a firewall in front of the server you need a second alias IP on the server that you can use to get at the services running on the server through the VPN. The firewall blocks all ports protocols not opened - that's why you can't use the server main IP even if the VPN is up.
The netmask is used by all nodes to determine how big your subnet is: what part of the IP number is the network number and what range the node number is in => really: should traffic be directed to a node on the same LAN or sent directly to the gw/router for forwarding.
What you can't do is connect from a NATed network to another NATed network that both are using the same network number. (That's why people should stay away from using the "default" 192.168.0.0/24 and 192.168.1.0/24 networks for VPN server LANs).
Try your settings at http://www.jodies.de/ipcalc to see what I mean.
"...lists the router as having the IP address of the XServe (rather than the router on the network). Is that normal?"
Yes. The VPN server is the VPN gw/router.
"The firewall for the 10.5.2 server is not running (but will be once I get this all working)."
If you already have a firewall in front of your servers that is a bit redundant.
"--No network routing definitions have been set up."
"I'm hoping I don't need to have the XServe run DNS as an internal LAN DNS server"
You need routing definitions if you want to setup a split tunnel VPN or all traffic is routed through the VPN when connected. The VPN becomes the default gw.
Without ipforwarding ON in the server you can only reach nodes on the server LAN - not Internet.
DNS is needed for your servers forward and reverse names/IPs for advanced services but doesn't need to run in any of your own servers.
If you decide to do a split tunnel VPN config (adding public and private routing definitions) a reachable DNS IP for VPN clients (in VPN config on server) is needed for VPN clients or they can't use names to find anything. To reach this DNS IP if public/not on your server LAN, you need your server to forward IP DNS lookups and have a routing definition for it.
A split tunnel VPN only send traffic for your server LAN through the VPN and all other traffic directly to the local gw/router (Internet).

L2TP VPN Server only accepts one client at a time

We have an ISA570 on Site 1 with the following Network Config:
192.168.100.XXX
255.255.255.0
192.168.100.254 (GW)
ISA570
ISP Modem in Bridge Mode
So let us call my location right now as site 2. Although the network setup does not matter, let me just state it.
192.168.101.XXX
255.255.255.0
192.168.101.254 (GW)
Cisco RV042
ISP Modem in Bridge Mode
L2TP Client Network Pool:
192.168.103.100 - 192.168.100.200
255.255.255.0
DNS1 192.168.100.254
=======================================================================================
So here comes the situation
Client 1 with IP address of 192.168.101.24 connects to Site 1 via L2TP. He uses this VPN Tunnel for a desktop application which is hosted at site 1.
Client 2 with IP address of 192.168.101.17 connects to Site 1 via L2TP but is unsuccessful. Screen1.jpg below shows the Windows VPN Error.
Screen1.jpg
I can not post my configs as of now because the WAN1 of site 1 is very congested. For now I will post the guides which I followed.
http://www.cisco.com/en/US/docs/security/small_business_security/isa500/administration/guide/ISA500_VPN.html#wp1393916
http://www.cisco.com/en/US/docs/security/small_business_security/isa500/administration/guide/ISA500_VPN.html#wp1479596
What am I missing here?

Hi Dan,
The site-to-site VPN tunnel should still work with those settings. For the IPSec VPN Client, we have the Cisco VPN Client that should work. There should be a copy of it on the CD that came with the ISA500.
Here is a link that has information on setting up the Remote Access VPN on the ISA500:
http://www.cisco.com/en/US/docs/security/small_business_security/isa500/technical_reference/vpn/Configuring_VPN_with_Cisco_ISA500_Series_Security_Appliances.pdf
The section 'Configuration Examples of EzVPN, SSLVPN and Site-to-Site Between Cisco ISA500 Appliances' has an example at the beginning.
Let me know if that helps.
Thanks,
Brandon

In a cafe, all internet connecti9ns work, but the email client is saying Timed Out, can't access the server. Rebooted. Problem persists.

All other internet connections work - but the Mozilla email client can't access the mail... Works in every other café. But not here. Thanks!

I'd suggest you check with the cafe owner which ports are allowed there.
If in doubt simply use webmail, which will most likely work.

I can't access the internet from my home wi-fi. It works on other wi-fi, and my wi fi is working on my h ome computer. I keep getting a message that says it can't access the server

I can't access the internet using my home wi-fi. My wi-fi is working on my home computer, and the itouch can access the internet at another person's home using their wi-fi. I've looked in the settings, and can't seem to see any differences.....i'm a techno dummy - so please respond in very basic info

Before resetting try restarting. Or you can go to Settings from the home screen > Wi-Fi > your network and scroll down to 'Renew Lease' and press that. When you do you should see a button labeled 'Renew Lease?' and another labeled 'Cancel'. Select 'Renew Lease'.
You can either back out of that screen back to the home screen or just use the return button to go back to the home screen. Then select Safari and see if you can hook in.
I have to go through that process every five or ten minutes or so when in the second story of our house - weak router signal up there.

VPN server only connected to a WAN

Hi,
I have configured a VPN server on a xserve directly connected to the Internet (public IP address on en0 interface). The server is not connected to a LAN (no cable on en1 interface).
The VPN clients ("roadwarriors" clients) are assigned a 10.0.0.x private IP address.
My question is: what is the correct setup to have a private IP on the server?
1/ Should I configure en1 interface with a 10.0.0.x IP address (the panel won't apply the settings because there is no cable plugged BUT I can do it with a simple "ifconfig en1 10.0.0.1 netmask 255.255.255.0 up" command in a terminal).
2/ Or should I create a virtual interface and assign a 10.0.0.x IP to it (ifconfig vlan0 create)?
And yes there is a logic to have such a setup (expose only the VPN service on the server from the Internet side, but open access to all other services only to VPN clients like for example mail. This is why I do need a private IP address for the server).
Note: I was using previously openvpn on a Linux server and did not have such problem as openvpn creates a tun0 interface on the server side with its own private address.

setup macmini with public wan ip.
This is what i did and i have a firewall problem
I created a en1 interface with
sudo ifconfig en1 10.0.0.1 netmask 255.255.255.0 up
I enabled the pptp protocol in the vpn setup.
enable pptp
start ip 10.0.0.1
end ip 10.0.0.5
authentication mschap
in the client information
for the dns server I used opendns
208.67.222.222
208.67.220.220
network routing definition
10.0.0.0 255.255.255.0 private
I now goto the firewall settings
I check the box to allow for group ANY
vpn PPTP port 1723
i goto address group and create a group called vpn
I add the five ip's i have set the vpn server to assign to the clients. I choose allow All for this group.
I goto my mac book and setup the pptp connection. It lets me authenticate and I get an ip address of 10.0.0.2 from the server. however web, email and other services dont work.
I check the firewall log in the mac mini and sure nuff 10.0.0.2 is getting denied for lots of services.
Jan 3 21:04:38 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:5353 208.67.222.222:53 in via ppp0
Jan 3 21:04:38 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:49431 208.67.222.222:53 in via ppp0
Jan 3 21:04:41 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:5353 208.67.222.222:53 in via ppp0
Jan 3 21:04:44 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:5353 208.67.222.222:53 in via ppp0
Jan 3 21:04:46 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:49432 208.67.220.220:53 in via ppp0
Jan 3 21:04:53 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:5353 208.67.222.222:53 in via ppp0
Jan 3 21:04:53 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:49431 208.67.222.222:53 in via ppp0
Jan 3 21:04:56 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:5353 208.67.222.222:53 in via ppp0
Jan 3 21:05:01 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:49432 208.67.220.220:53 in via ppp0
Jan 3 21:05:08 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:5353 208.67.222.222:53 in via ppp0
Jan 3 21:05:08 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:49433 149.254.192.126:53 in via ppp0
Jan 3 21:05:11 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:5353 208.67.222.222:53 in via ppp0
Jan 3 21:05:17 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:5353 208.67.222.222:53 in via ppp0
4 Deny UDP 10.0.0.2:49433 149.254.192.126:53 in via ppp0
Jan 3 21:05:26 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:5353 208.67.222.222:53 in via ppp0
Jan 3 21:05:32 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:5353 208.67.222.222:53 in via ppp0
Jan 3 21:05:35 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:5353 208.67.222.222:53 in via ppp0
4 Deny UDP 10.0.0.2:5353 208.67.222.222:53 in via ppp0
an 3 21:05:46 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:49436 208.67.220.220:53 in via ppp0
Jan 3 21:05:53 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:49435 208.67.222.222:53 in via ppp0
Jan 3 21:05:56 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:5353 208.67.222.222:53 in via ppp0
Jan 3 21:05:59 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:5353 208.67.222.222:53 in via ppp0
Jan 3 21:06:01 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:49436 208.67.220.220:53 in via ppp0
n 3 21:06:05 mini ipfw[1158]: 65534 Deny UDP 10.0.0.2:5353 208.67.222.222:53 in via ppp0
I dont understand why 10.0.0.2 is being denied when I have setup a group including that IP and have allowed it to do anyting.
Can anyone help please?

Network Positioning of a Windows Server 2012 R2 Direct Access & VPN Server

Reposted moved from Windows Server Forums- Security
Hi
I'm in the process of creating a new active directory forest with a single domain using AD.Contoso.com to use the Microsoft example. The reason I have decided on AD.XXXXXXXXX.com is to get way from using split horizon (Split Brain) DNS. The requirements
for our new domain are :-
2012 R2 AD
Direct Access & VPN
Exchange 2013 OWA, Active Sync Outlook Anywhere (Possibly a Hybrid Config where we have on premises mailboxes and some exchange online mailboxes Office 365 etc)
Lync 2013 ?
SharePoint 2013 ?
Microsoft Active Directory Certificate Services
System Center Configuration Manager 2012 R2
Two way trusts between old forest and new to enable Transition/Migration
Ok so that's what I'm aiming for so now the question.
They are allowing me to purchase a next Generation Firewall may be a Barracuda NG firewall or a Cisco ASA X series so I need some advice on what type of network topology I should configure. I've read that using the two NIC configuration for
the 2012 R2 Direct Access Server is preferable, one nic on the internal network one on the perimeter. The problem I have with this is that it bridges the internal network and the perimeter bypassing the backend Firewall see image
The other alternative is to dispense with the perimeter network use the Direct Access server with a single NIC and setup the NG Firewall in a three-legged config with the DA server on the DMZ.
So all you security experts out there what would be your design for this simple domain? we don't need any HA or Load Balancing.
Thanks
Simon

Ok I'm not sure we are going to get any advice on this subject but one last effort. Our budget can only stretch to one next generation firewall so I'm considering the following three legged firewall design with a two NIC 2012 R2 Direct
Access server. If someone could validate this configuration or suggest an alternative then I would be grateful.

Can't access VPN server, only other clients

Similar Messages

Maybe you are looking for