Thread-topic: VPN--can connect but can't see server
User-agent: Microsoft-Entourage/12.1.0.080305
Mike:
This is really simple (but took me weeks to find) so might be worth a try
even if it doesn't fix your problem.
We have a somewhat similar setup w/ 10.5.2 clients connecting to an Intel
XServe running 10.5.2 Server via the included VPN (L2TP only; PPTP
disabled). However, we run a private subnet and our own internal DNS so we
CAN somewhat confirm at least whether ip routing is working when we connect
via VPN because we should get the internal private IP address when it is
working (I use Network Utility to test). The machine is also setup as an
Open Directory Master.
I've not been able to get our VPN setup to function since I first set it up
a couple weeks ago. I can connect fine via VPN but the connection doesn't
function. Up until today, over the VPN, I have only ever resolved to the
public ip address of any of our machines when testing one of our addresses,
I've never been able to get the VPN to resolve to our internal IP space
(192.168.x.x) which is what it ought to do.
Today I ran across a tip on some website (don't remember now) to go into
System Preferences->Network and select the "gear" icon below the list of
connections on the left. In this menu, select "Set Service Order" and in the
window that comes up, move the VPN connection to the top of the list.
Close, save, reconnect via VPN and retest. Hopefully this will solve your
problem.
As I said, I just discovered this today and I am hopeful that our folks in
Hong Kong will now be able to connect to our corporate net via VPN and
resolve to our internal IP space. I'll know once it is late enough here that
they are at work (around 9PM this evening).
Regarding a couple other items you mentioned...
- I've also seen the " Unsupported protocol 0x8057 received" error in the
log, don't know what that means either but it isn't unique to your setup
- I seem to remember reading somewhere in the last couple of weeks that at
least one network routing definition setup for the VPN to function so you
might want to confirm that
- When we connect with our setup we also see the "router" of the VPN
connection is the IP of the XServe running the VPN. I think this is normal
but again it is, at least, not specific to your setup.
Good luck ... e
Eric Morrison
Insigniam Performance
Catalyzing Breakthrough Results
www.insigniam.com
On 3/12/2008 8:25 PM, "Mike Matthews" <email@hidden> wrote:
> On Mar 12, 2008, at 3:38 PM, David Colville wrote:
>
>> On 13/03/2008, at 4:58 AM, Mike Matthews wrote:
>>
>>> Hi:
>>>
>>> I've set up our XServe with MacOS X Server 10.5.2 to do AFP and VPN
>>> (L2TP only; PPTP is disabled). The XServe is a standalone server,
>>> not connected to any other direstory server.
>>>
>>> I can connect to the XServe's AFP server from my Mac over our wired
>>> and wireless network. The AFP server shows up in the sidebar of
>>> Finder windows. So far, so good.
>>>
>>> I am able to successfully connect to our network via the VPN with
>>> Mac OS X 10.5.2 client (on two different machines) using L2TP
>>> through our network's firewall (on a Netopia T1 router; UDF ports
>>> 500 and 4500 and IP Protocol 50 and 51 are open) using a shared
>>> secret.
>>>
>>> But I cannot connect to the XServe itself to use Server Admin or
>>> AFP (using afp://server.company.com or afp://xxx.xxx.xxx.xxx via
>>> the Go > Connect to Server command).
>>
>> Can you perform a TCPdump or similar packet trace on the server to
>> see if the response is actually getting through? Let me know if you
>> need assistance with this (and if this link doesn't help)-
>> http://docs.info.apple.com/article.html?artnum=107952
>>
>>> Other iChat users in my office also do not automatically show up in
>>> the Bonjour list when I connect to the network. Other computers on
>>> our network do not appear in the sidebar of a Finder window.
>>
>> These are to be expected, as Bonjour isn't supported (in the "local
>> area Bonjour" over a WAN link - it's purely a multicast feature on
>> the network in the office, and won't be routed across the VPN link.)
>>>
>>> Now, here's the odd part. There is a second server (v10.4.11) on
>>> our network running AFP. I can connect to it (using afp://server.company.com
>>> via the Go > Connect to Server command) and mount its various
>>> sharepoints via the VPN.
>>
>> When you are connected to the VPN, and perform a Network Utility
>> "lookup" command on the two servers - do you get similar responses
>> (ie both on the same IP range)? Are the servers on public or
>> private IPs?
>>
>>> The only thing I see in the VPN log that seems amiss is this (but I
>>> have no idea what it means):
>>> Tue Mar 11 23:09:27 2008 : Unsupported protocol 0x8057 received
>>>
>>> --Both the 10.5.2 and the 10.4.11 servers have DNS properly
>>> configured (though our ISP; we're not running our own DNS).
>>
>> I'm assuming there's NAT involved here? Is the ISP responding with
>> the private or public IPs of your servers?
>>
>>> --Any user can access any service.
>>
>>> --No network routing definitions have been set up.
>>
>> This would makes sense to set these up if you hope to tunnel only
>> the data for the office through the VPN.
>>
>>> --In essence, I've followed the steps on Pages 141-142 of the
>>> Networks Services Admin Guide.
>>>
>>> I'm hoping I don't need to have the XServe run DNS as an internal
>>> LAN DNS server.... And I'm not sure why I would have to if I can
>>> already successfully connect to the 10.4.11 AFP server .
>>
>> Maybe...
>
> ---
> I'll work on the TCP dump idea.
> Both servers and the client have the public IP range and have the
> same subnet mask. Network Utility confirms this while connected to the
> VPN.
> NAT is not running. The ISP is responding with public IPs for the
> servers
> I will set up network routing definitions once I can solve this
> problem.
>
> The error I get while connecting to the 10.5.2 AFP server is Some data
> in apf://server.mycompany.com could not be read or written (Error Code
> -36 ). I saw this error associated with a SMB problem in 10.4.x, but
> SMB is not running.
>
> One other note: After I connect, the Network Preferences > VPN >
> Advanced > TCP/IP window shows the IP address for the client just fine
> (assigned from the VPN pool), but lists the router as having the IP
> address of the XServe (rather than the router on the network).
>
> Still, it just seems odd that the connection is fine, and I can see
> one file server, but not another (the one I'm connected to).
> ---
> mm
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Macos-x-server mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/macos-x-server/email@hidden
This email sent to email@hidden
