Neil Aggarwal wrote:
Hello:
I have a Linux machine acting as a firewall for my
network. I have a couple of remote users that need
access to the internal network, so I put a Linksys
RV042 VPN Router on my internal switch.
On the Linux box, I set these iptables rules (Line breaks
added for readability):
/sbin/iptables -t nat -A PREROUTING -p tcp
-i eth0 -d $ETH0_IP
--sport 1024: --dport 1723
-j DNAT --to $LINKSYS_VPN_IP:1723
/sbin/iptables -A FORWARD -i eth0 -o eth1
-d $LINKSYS_VPN_IP -p tcp
--sport 1024: --dport 1723
-m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -t nat -A POSTROUTING -o eth1
-d $LINKSYS_VPN_IP -p tcp --dport 1723
-j SNAT --to-source $ETH1_IP
/sbin/iptables -t nat -A PREROUTING -p gre -i eth0
-j DNAT --to $LINKSYS_VPN_IP
/sbin/iptables -A FORWARD -i eth0 -o eth1
-d $LINKSYS_VPN_IP -p gre -j ACCEPT
/sbin/iptables -t nat -A POSTROUTING -o eth1
-d $LINKSYS_VPN_IP -p gre -j SNAT --to-source $ETH1_IP
/sbin/iptables -t nat -A PREROUTING -s $LINKSYS_VPN_IP
-d $ETH1_IP -p gre -j ACCEPT
/sbin/iptables -A FORWARD -i eth1 -o eth0
-s $LINKSYS_VPN_IP -p gre -j ACCEPT
Either one of my remote users can connect to the VPN using
the Windows XP VPN client. But, if one of them is connected
and the other tries to connect, the second person gets to
the verifying username and password screen and then
gets an Error 619 that they are not able to connect.
I think somehow the existing connection is mis-routing
the login for the second connection.
IIRC, for this to work a helper must be loaded to fixup the GRE stream.
And older implementations only allowed one connection. I might be
totally of on this one, but maybe a newer kernel will fix your problem.
You might ask in the netfilter-devel list where there is more expertise
on this.
HTH,
M4
