Mikrotik and PPTP VPN passthrough headache

[The_Librarian]

As the title says.

I have a PPTP VPN server (win2k8) on 192.168.1.2 (static). I'm trying to get PPTP VPN passthrough to work, but no luck.

Internet browsing/access is 100% from the PC behind the Mikrotik.

As it is, my firewall configuration is as follows :

/ip firewall filter add chain=input protocol=tcp src-port=1723 src-address="0.0.0.0" action=accept comment="Allow IN PPTP/TCP1723" disabled=no
/ip firewall filter add chain=output protocol=tcp dst-port=1723 dst-address="192.168.1.2" action=accept comment="Allow OUT PPTP/TCP1723" disabled=no
/ip firewall filter add chain=input protocol=gre action=accept comment="Allow IN PPTP/GRE" disabled=no
/ip firewall filter add chain=output protocol=gre action=accept comment="Allow OUT PPTP/GRE" disabled=no

Any clues from the guys who managed to get it to work?

FWIW the ADSL account do allow for incoming PPTP VPN - I have had a Smoothwall in front of said PC, and it worked, so the ADSL account is not at fault here.

TIA

Ook

 

[PsyWulf]

Am I misreading or are you forwarding the Outgoing 1723,instead of the incoming 1723

 

[The_Librarian]

Am I misreading or are you forwarding the Outgoing 1723,instead of the incoming 1723

No, you do not.

I'm using an internal PPTP VPN server (Server2008), not the Mikrotik itself.

Or is there a mistake in the rules if it is the case?

 

[Mal1ce]

1st rule... change it to destination port not source port.
3rd rule is fine.

2nd and 4th rules are not necessary right now as you should have filter rules allowing established/related traffic and dropping invalid.


EDIT: I should have read more, you need rules to NAT the PPTP traffic to the W2K8 box as well.

 

[The_Librarian]

Thanks guys, will try again on the morrow.

 

[Sinbad]

gre doesn't nat well...

 

[The_Librarian]

gre doesn't nat well...

yeah...

will play around with the gre rules if it start biting my butt...