allow vpn clients to connect to internal vpn server

[Dang.Johnny]

You will also need the gre protocol.

Also on the WAN side you will need to allow both in and out of tcp 1723 and
gre.

I hope this help.

JD
-----Original Message-----
From: Belov V. [mailto:vit at volia.com] 
Sent: Tuesday, April 15, 2003 8:54 AM
To: freebsd-ipfw at freebsd.org
Subject: allow vpn clients to connect to internal vpn server


Hi
My privat net is 192.168.0.0/24 and has Win VPN server in it. Natd has
redirection: redirect_port tcp 192.168.0.1:1723 1723 What should be added to
allow external vpn clients to connect to my internal vpn server?

My current BSD router has the following ipfw rules:

add allow ip from any to any via lo0
add deny all from any to 127.0.0.0/8
add deny all from 127.0.0.0/8 to any
add deny all from 192.168.0.0/24 to any in recv de0
add deny all from any to 10.0.0.0/8 via de0
add deny all from any to 172.16.0.0/12 via de0
add deny all from any to 192.168.0.0/16 via de0
add deny all from any to 0.0.0.0/8 via de0
add deny all from any to 169.254.0.0/16 via de0
add deny all from any to 192.0.2.0/24 via de0
add deny all from any to 224.0.0.0/4 via de0
add deny all from any to 240.0.0.0/4 via de0
add deny tcp from any to any 137-139 via de0
add deny tcp from any to any 137-139 via de0
add fwd 192.168.0.10,3128 tcp from 192.168.0.0/24 to any 80
add divert 8668 all from any to any via de0
add pass tcp from any to any established
add pass ip from any to any frag
add pass tcp from any to ip_of_external_interface 25 setup
add pass tcp from any to any 1723 setup
add pass tcp from any to any 4899 setup
add pass tcp from any to ip_of_external_interface 53 setup
add pass udp from any to ip_of_external_interface 53
add pass udp from ip_of_external_interface 53 to any
add deny log tcp from any to any in via de0 setup
add pass tcp from any to any setup
add pass udp from any to any 53 keep-state


_______________________________________________
freebsd-ipfw at freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe at freebsd.org"

-------------- next part --------------
A non-text attachment was scrubbed...
Name: Dang, Johnny (johnny.dang at johnnydang.net).vcf
Type: application/octet-stream
Size: 573 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-ipfw/attachments/20030415/18a6815d/DangJohnnyjohnny.dangjohnnydang.net.obj