- This topic has 8 replies, 6 voices, and was last updated 16 years, 8 months ago by
.
-
Posts
-
Hello,
I am doing a clean install of Snow Leopard Server on a 2008 Xserve and am having problems with setup that I don’t fully understand. The machine sits in a data center with some other servers and I want to make this machine the primary way to access those machines using VPN via an internal network I have all the machines using ethernet port 2. The internal network uses just a simple switch (non-managed) to connect all the machines together. Also, I want to use the VPN to also safely access other services that are hosted on the machine that provides the VPN service. The WAN ethernet port 1 of the machine I am installing Snow Leopard Server on uses a public IP address that has reverse DNS setup and external DNS setup for the domain name to point to the IP address.
The first time configuring the machine I simply setup the IP addresses of the WAN and the LAN ports. The server correctly recognized what name it should be from the reverse DNS. Everything was super simple and setup VPN using a shared secret. I then went to test the VPN from an external connection and here’s where my problem and question lies… I can make the VPN connection just fine from a Leopard client machine. I can ping other machines on the internal network of which the VPN uses IP addresses in the 172.22.8.0/24 range. However, when I try to ping or access the server that I’m connected to via VPN I get nothing… no ping results nor can I connect to any services.
So I noticed during the install that there was a ‘gateway’ option for install/setup that automatically sets up the server as a NAT gateway for internal machines… if there was a simple way to set this up and make sure it works I figured that was the option. So I wiped the drive and reinstalled. This time I used the gateway setup option in the installer, even though it doesn’t let me chose an internal IP scheme I figured it would at least be a good test… Again everything was setup and I tried again to access the VPN from the outside. Again I connected without a problem… and again I could not ping the server I was connected to or access it in any way.
I tried to verify what I thought were the easy things including totally turning the firewall off but it didn’t help at all. I wonder if Apple’s new source based routing is causing the problems…
So after all that, what might I be doing wrong? What can I do to make this work? Any help would be greatly appreciated.
Thanks,
MichaelI have the same problem. Were you ever able to find a way to allow vpn clients to access services on the VPN Gateway?
A little more description: The problem seems to be that there is a 15 second delay making any TCP connection to the Gateway (and only to the Gateway) when you are a vpn client. This delay is too long for most DNS clients and so one just sees failures. You can see the more general case by telnet’ing or ssh’ing to the gateway… presto 15 second delay and then connection.
Same problem here. The strange thing: it was working before the upgrade to Snow Leopard, i.e. we could connect via VPN and access services on the VPN gateway (we could also ping the server/VPN gateway). I could swear it was working before the update to 10.6.2 but I can’t be entirely sure about that.
The server/VPN gateway’s internal interface IP is 192.168.40.1. The external interface is a public IP address.
I’ve tried L2TP and PPTP connections and neither one can ping the server once connected. Interestingly enough, there is a VMWare Windows virtual machine running on the server/VPN gateway. The virtual machine has an IP address of 192.168.40.11. I can ping this server just fine and access services on it. I can ping and access everything on the subnet but the server/VPN gateway. BTW, I tried the VPN before installing VMware just to make sure VMWare wasn’t messing with the network interfaces, but still no luck.
In fairness, we can actually access services on the VPN gateway but it is super-slow. For example, if you try to pull up a webpage running on the web server, it takes a good 15-30 seconds to load. Connecting to AFP shares also works but it takes 15-30 seconds to get the authentication box to pop up. It’s like the packets aren’t routing correctly.
Pinging 192.168.40.1 does not work. DNS queries do not resolve either – even for DNS entries that are outside our network, e.g. our public website on MediaTemple and custom URLs for applications on Google (BTW, these never load when connected via VPN).
I even tried doing a clean install of SLS since the server had been upgraded from Tiger to Leopard to Snow Leopard, which I figured had left a lot of detritus along the way. At least everything else on the server is running well now!
Unfortunately, buying another server to act solely as a VPN is just not feasible for our small company. I wish we could get his working because the server hosts a critical business application with a MySQL backend and connecting through VPN makes working on that app painfully slow. Any other ideas on solving this would be most welcome. I’ve tried just about everything I can think of.
I am having this exact same problem. I am guessing it has to do with changing the subnet from 192.168.1.X as I have had success with that configuration previously. I would love to find a solution…
Oh, I’m not alone… I’ve got the same problem on a new Xserve with SLS (10.6.2, I did not try to see if the problem is due to the update to 10.6.2 or if it’s still don’t work on 10.6.”0″) installed and configured on it (DNS, NAT, Firewall…). Everything is working if I access to the services while I’m physically connected on the internal network. But when I try to reach the server services (or to ping the server itself) from a computer connected through VPN (L2TP or PPTP, both connect without complaining), I just can’t contact the server. However, clients on the same subnet (Server is 192.168.1.1, and clients use 192.168.1.x) are available (I can use ARD to remote control them for example), answer to ping request, but the server doesn’t want to do so…
I tried almost everything : I formatted and reinstalled the system 5 or 6 times (I stopped counting, thanks to the DNS service which, like the VPN one, contains a lot of bugs), tried various configurations, about 4 modems (using PPPoE, or direct connect…), changing subnets, accessing through my iPhone. It just never connects. Or rather it connects but it’s desperately slow : once the connection is established (IMAP or ARD for example, which are persistent connections), “no” problem, I can do what I want. But I had to wait almost 30 seconds before the connection goes up : far too long to be usable, and causes every DNS lookup to timeout.
So, anyone found a solution ? Should I (we ?) call Apple and ask them to fix it ?…
PS : I’m french, please excuse me if my english is not very good :D.
I tried to get Apple to admit this problem. I was told by the tech a dozen things and then he started talking about how Server “wants” things this way or that. Once people start talking about what the computer “Likes” or “Wants” you know you have wandered out of knowledge and into voodoo. I was never able to get farther then Server not wanting to have the firewall/vpn on the service machine, and I shouldn’t want it either. Very frustrating.
Addressing an earlier post. I have tried this with 192.168.1.x, 192.168.1.32.X, 10.0.20.x, and 172.16.32.x over the many many reinstalls… They all fail the same way.
I wish you much better luck.
Okay, I called AppleCare today and someone – very nice 😉 – handled my call. Despite the fact that the problem is not solved yet, he gathered many informations, and I sent him a bunch of logs via an Apple software he made me downloading. So, now, I’m waiting. Maybe a solution will come… Anyway, happy new year from France !
Hi !
I maybe found a “solution” : I realized that (for an unknown reason, I didn’t make any change on the server configuration) the gateway (or router, I don’t know how it’s translated in english, on Windows, it’s gateway, on OS X it’s router I think. Anyway, the address I’m talking about is the one located on the client computer, in the TCP-IP tab, in System Preferences, under the subnet mask) address suddenly switched to “10.64.64.64”, replacing the old one, which was the WAN IP of the server !?
And… if I change the DNS address to this one and try to access to server’s services using this strange 10.64.64.64 IP, it works, without delay !? Quite strange.
Give it a try 😉 !
I’ve seen a slightly different behavior, and have found a workaround.
I have a 10.6.2 Server installation, and I find that when I connect via VPN and then try to connect to the server (ssh, server admin, etc.) the connection works for a little while and then fails. Tcpdumping the snot out of things reveals that the individual TCP connections work until a DNS request arrives from the VPN client and the server responds. From that point the TCP connection (that ssh session, for instance) is dead. This is reproducible.
The workaround is to configure VPN clients to get a DNS server *other* than the VPN server – everything works fine after that. This is not optimal, as you no longer get ‘internal’ DNS resolution, but it does work.
I have no idea what is going on in OS X Server to cause this to happen, but perhaps this information is useful just the same.
A.
- You must be logged in to reply to this topic.