Re: NAT rules for VPN only allowing one user?

[Gregory Carter <gcarter@aesgi.com>]

That is correct.

Please use the latest in stream kernel for your distro, or build the 
latest one from kernel.org.
-gc

Martijn Lievaart wrote:

> Neil Aggarwal wrote:
>
> > Hello:
> >
> > I have a Linux machine acting as a firewall for my
> > network.  I have a couple of remote users that need
> > access to the internal network, so I put a Linksys
> > RV042 VPN Router on my internal switch.
> >
> > On the Linux box, I set these iptables rules (Line breaks
> > added for readability):
> >
> > /sbin/iptables -t nat -A PREROUTING -p tcp     -i eth0 -d $ETH0_IP 
> >     --sport 1024: --dport 1723     -j DNAT --to $LINKSYS_VPN_IP:1723
> > /sbin/iptables -A FORWARD -i eth0 -o eth1     -d $LINKSYS_VPN_IP -p 
> > tcp     --sport 1024: --dport 1723     -m state --state 
> > NEW,ESTABLISHED -j ACCEPT
> > /sbin/iptables -t nat -A POSTROUTING -o eth1     -d $LINKSYS_VPN_IP 
> > -p tcp --dport 1723     -j SNAT --to-source $ETH1_IP
> > /sbin/iptables -t nat -A PREROUTING -p gre -i eth0     -j DNAT --to 
> > $LINKSYS_VPN_IP
> > /sbin/iptables -A FORWARD -i eth0 -o eth1     -d $LINKSYS_VPN_IP -p 
> > gre -j ACCEPT
> > /sbin/iptables -t nat -A POSTROUTING -o eth1     -d $LINKSYS_VPN_IP 
> > -p gre -j SNAT --to-source $ETH1_IP
> > /sbin/iptables -t nat -A PREROUTING -s $LINKSYS_VPN_IP     -d 
> > $ETH1_IP -p gre -j ACCEPT
> > /sbin/iptables -A FORWARD -i eth1 -o eth0     -s $LINKSYS_VPN_IP -p 
> > gre -j ACCEPT
> > Either one of my remote users can connect to the VPN using
> > the Windows XP VPN client.  But, if one of them is connected
> > and the other tries to connect, the second person gets to
> > the verifying username and password screen and then
> > gets an Error 619 that they are not able to connect.
> >
> > I think somehow the existing connection is mis-routing
> > the login for the second connection.
> >   
>
> IIRC, for this to work a helper must be loaded to fixup the GRE 
> stream. And older implementations only allowed one connection. I might 
> be totally of on this one, but maybe a newer kernel will fix your 
> problem.
> You might ask in the netfilter-devel list where there is more 
> expertise on this.
> HTH,
> M4