Re: VPN Client (PPtP) behind OpenBSD 3.0 doing NAT..

["Michael Erdely" <mike@erdelynet.com>]

> I think it is a problem with the pf program
> which just hasn't matured enough yet

Not true.

This thread may shed some light:
http://www.monkey.org/openbsd/archive/misc/0201/msg00823.html

But, the problem is with -release and -stable's pf not supporting
non-tcp/udp/icmp protocols.  -current's does.  I just downloaded the
appropriate files and rebuilt pfctl.  I made a tar file of the files
needed to change at
ftp://ftp.erdelynet.com/mike/openbsd/pf-gre-patch-v4.tgz.  I hope that
helps.

-ME

-----Original Message-----
From: owner-misc@openbsd.org [mailto:owner-misc@openbsd.org] On Behalf
Of Gary S MacKay
Sent: Thursday, March 14, 2002 12:34 PM
To: Alex Slok
Cc: misc@openbsd.org
Subject: Re: VPN Client (PPtP) behind OpenBSD 3.0 doing NAT..


         I fought this for a few days too. I finally went back to
OpenBSD 
2.9 which worked just fine. Maybe a future 3.x version will work, don't 
know. I think it is a problem with the pf program which just hasn't
matured 
enough yet. I do know that I liked the 3.0 version alot better and swear
it 
was faster. Unforturnately, I have to have the vpn working for my
clients.

If you get 3.0 working, please let me know how.

- Gary



At 05:01 PM 3/14/2002 +0100, you wrote:
>Maybe this question has been wandering around this list, I'm not sure.
I'll
>still ask this one.
>
>I'm running an OpenBSD 3.0 machine, doing NAT for my local lan. Now I'm
>trying to set up a VPN connection to my company that is running a
Windows NT
>4.0 PPtP server from one of my clients..
>
>The VPN client (Windows XP) on my Local LAN isn't working properly and
hangs
>with 'verifying username and password' Connecting with a client (also
>Windows) that is directly connected to the internet works fine though,
thus
>it must be something with the NAT machine.
>
>Now Í've read some articles on this subject, but the problem is that
they
>vary with solutions ... Is there a way to redirect the PPtP traffic
from my
>local client to the VPN server. Routing GRE traffic isn't possible
within my
>/etc/nat.conf (or is it ?). Maybe in a way like the ftp-proxy ???
>
>Is there a way to overcome this one ??
>
>Greetz,
>
>Alex

Edison Information Technologies                 www.EdisonInfo.com
P.O. Box 554                                    Gary@EdisonInfo.com
Milan, OH 44846-0554                               419.499.7040