Доброго времени суток.
Уже теряю веру в жизнь. И вот почему.
Есть 2 офиса офис1(О1) и офис 2 (О2). Задача прокинуть VPN от О2 к О1 для RDP. Схема следующая О1->dfl 260e<->интернет<->dsl 2540<-dfl 260E<-O2.
На обоих dfl прошивка 2.40.00.10-16821 oct 7 2011. На dsl Software Version ru_1.22, Bootloader Version 1.0.37-12.1 sep 9 2009. На FTP dlink лежит прошивка DSL_2540_old_stable_21_07_2011_v1.0.30_cfe_fs_kernel 17-Nov-2011 12:54 , пробовал ставить пишет upload failed image. Что меня удивило что версия ниже, а дата моложе. Хотя может это дата когда выложили файл.
НА DFL O1 поднят pptp сервер по инструкции
http://dlink.ru/ru/faq/85/479.html. К нему все отлично коннектиться, пробовал из 4 точек с разными условиями, белый и серый IP, Nat и напрямую, XP, Vista, 7, FreeBSD, DIR-820. В общем считаю, что работает. В О2 на XP создаю VPN соединение с разными VPN серверами, Freebsd, ISA, CISCO, win XP, 7 все работает. В общем считаю что работает. А вот с О1 не работает, виснит перед авторизации, висит проверка имени пользователя и пароля, пишет ошибка 619. Почему у них неприязнь друг к другу? Вчера весь форум перечитал по этой ошибки. С LCP игрался, правила все сделал, в общем Теряю Веру в Жизнь.
Если подскажите как настроить Pptp клиента на DFL, так чтобы инет работал не через O1, буду очень признателен.
Сейчас постараюсь как можно подробнее выложить все настройки и логи с обоих DFL. А пока может у кого-нибудь, что-нибудь родиться.
O2.
Dsl 2540u.
Device Info
BoardID: DSL-2540U
Software Version: RU_1.22
Bootloader (CFE) Version: 1.0.37-12.1
Release Date: Wed Sep 9 13:22:19 CST 2009
This information reflects the current status of your DSL connection.
Line Rate - Upstream (Kbps): 1036
Line Rate - Downstream (Kbps): 4096
LAN IPv4 Address: 192.168.0.1
MAC Address: x.x.x.x.x.x
Default Gateway: 188.x.x.ex
Primary DNS Server: 85.x.x.x
Secondary DNS Server: 85.x.x.x
WAN Info
Port/VPI/VCI Con. ID Category Service Interface Protocol IGMP QoS State Status IPv4 Address
0/8/81 1 UBR br_0_0_35 nas_0_8_81 MER Enabled Disabled Enabled Up 188.x.x.x
PPTP Info
IP Address Gateway
Device Info -- Route
Flags: U - up, ! - reject, G - gateway, H - host, R - reinstate
D - dynamic (redirect), M - modified (redirect).
Destination Gateway Subnet Mask Flag Metric Service Interface
188.x.x.x 0.0.0.0 255.255.255.0 U 0 br_0_0_35 nas_0_8_81
192.168.0.0 0.0.0.0 255.255.255.0 U 0 br0
0.0.0.0 188.x.x.x(wangw) 0.0.0.0 UG 0 br_0_0_35 nas_0_8_81
Outgoing IP Filtering Setup
Choose Add or Remove to configure outgoing IP filters.
Now default policy is ACCEPT
правил нет.
DFL 260e
Address Book
DHCPAddresses An address folder can be used to group related address objects for better overview.
# Name Address User Auth Groups Comments
1 lan_dhcpserver_range 192.168.100.80-192.168.100.100
2 lan_dhcpserver_netmask 255.255.255.0
3 lan_dhcpserver_gw 192.168.100.1
4 lan_dhcpserver_dns1 192.168.100.1
5 dns1 85.x.x.x
6 dns2 85.x.x.x
Interface
Addresses An address folder can be used to group related address objects for better overview.
# Name Address User Auth Groups Comments
1 wan_ip 192.168.0.2 IPAddress of interface wan
2 wannet 192.168.0.0/24 The network on interface wan
3 lan_ip 192.168.100.1 IPAddress of interface lan
4 lannet 192.168.100.0/24 The network on interface lan
5 dmz_ip 172.17.100.254 IPAddress of interface dmz
6 dmznet 172.17.100.0/24 The network on interface dmz
7 wan_gw 192.168.0.1 Default gateway for interface wan
8 wan_dns1 83.x.x.x Primary DNS server for interface wan
9 wan_dns2 83.x.x.x Secondary DNS server for interface wan
10 Vpn_ip 0.0.0.0 IP address received from L2TP/PPTP client Vpn_TSO.
11 Vpn_dns1 0.0.0.0 Primary DNS server received from L2TP/PPTP client ...
12 Vpn_dns2 0.0.0.0 Secondary DNS server received from L2TP/PPTP clien...
vpn_tso An address folder can be used to group related address objects for better overview.
# Name Address User Auth Groups Comments
1 vpn_server 195.x.x.x
2 vpn_net 195.x.x.0/24
IP Rules
IP rules are used to filter IP-based network traffic. In addition, they provide means for address translation as well as Server Load Balancing.
Add
# Name Action Src If Src Net Dest If Dest Net Service
1 ping_fw Allow lan lannet core lan_ip ping-inbound
lan_to_wan
An IP Rule Folder can be used to group IP Rules into logical groups for better overview and simplified management.
# Name Action Source interface Source network Destination interface Destination network Service
1 Nat_to_vpn NAT lan lannet any all-nets gre-encap
2 Nat_to_vpn NAT lan lannet any all-nets pptp-ctl
3 drop_smb-all Drop lan lannet wan all-nets smb-all
4 allow_ping-outbound NAT lan lannet wan all-nets ping-outbound
5 allow_ftp-passthrough_av NAT lan lannet wan all-nets ftp-passthrough-av
6 allow_standard NAT lan lannet wan all-nets all_tcpudpicmp
В all_tcpudpicmp добавлен pptp suite. В all icmp стоит галка Pass returned ICMP error messages from destination.
PPTP/L2TP Clients
PPTP/L2TP (Point-to-Point Tunneling Protocol / Layer 2 Tunneling Protocol) clients are used for establishing VPN tunnels by connecting to remote PPTP/L2TP servers.
# Name Tunnel protocol Remote endpoint Remote network Username Dial-on-demand Comments
1 Vpn PPTP vpn_server vpn_net vpn No
main
The system has a predefined main routing table. Alternate routing tables can be defined by the user.
# Type Interface Network Gateway LocalIP Metric Monitor this route Comments
1 Route wan wannet 100 No Direct route for network wannet over interface wan...
2 Route wan all-nets wan_gw 100 No Default route over interface wan.
3 Route dmz dmznet 100 No Direct route for network dmznet over interface dmz...
4 Route lan lannet 100 No Direct route for network lannet over interface lan...
5 Route Vpn vpn_net 90 No Direct route for network vpn_net over interface Vp...
Лог при подключении.
Date Severity Category/ID Rule Proto Src/DstIf Src/DstIP Src/DstPort Event/Action
2012-04-17 Info CONN Nat_to_vpn TCP lan 192.168.100.80 4194 conn_close_natsat
10:58:59 600005 wan 195.x.x.x 1723
conn=close connnewsrcip=192.168.0.2 connnewsrcport=24253 connnewdestip=195.x.x.x connnewdestport=1723 origsent=732 termsent=836 conntime=90
2012-04-17 Info CONN Nat_to_vpn TCP lan 192.168.100.80 4191 conn_close_natsat
10:57:50 600005 wan 195.x.x.x 1723 close
conn=close connnewsrcip=192.168.0.2 connnewsrcport=4944 connnewdestip=195.x.x.x connnewdestport=1723 origsent=612 termsent=756 conntime=108
2012-04-17 Info CONN Nat_to_vpn TCP lan 192.168.100.80 4194 conn_open_natsat
10:57:29 600004 wan 195.x.x.x 1723
conn=open connnewsrcip=192.168.0.2 connnewsrcport=24253 connnewdestip=195.x.x.x connnewdestport=1723
2012-04-17 Info CONN Nat_to_vpn GRE lan 192.168.100.80 conn_open_natsat
10:57:29 600004 wan 195.x.x.x
conn=open connsrcid=0 conndestid=0 connnewsrcip=192.168.0.2 connnewsrcid=0 connnewdestip=195.x.x.x connnewdestid=0
Вход
Регистрация
FAQ
Поиск
