L2TP VPN and DNS

theloon
New Member

Posts: 6

L2TP VPN and DNS Jan 17, 2019 1:51:05 GMT

Quote

Post by theloon on Jan 17, 2019 1:51:05 GMT

I have a SmallWall configured for L2TP VPN but DNS queries to the SmallWall DNS server are failing.

LAN IP/Subnet: 192.168.100.1/24
L2TP Server IP: 192.168.100.201
L2TP Client IP/Subnet: 192.168.100.96/28

I am able to ping servers on the LAN (e.g. 192.168.100.2) but not the LAN IP from a connected client.

I have a rule on L2TP VPN to allow traffic:

System log shows the DNS request, but the response reports network unreachable:

Jan 17 11:44:20 dnsmasq[6475]: failed to send packet: Network is unreachable

Jan 17 11:44:20 dnsmasq[6475]: reply ping.citrix.com is 23.29.105.232

Jan 17 11:44:20 dnsmasq[6475]: forwarded ping.citrix.com to 8.8.8.8

Jan 17 11:44:20 dnsmasq[6475]: query ping.citrix.com from 192.168.100.96

Corresponded block recorded in firewall log:

X 11:44:20.796432 L2TP 192.168.100.1, port 53 192.168.100.96, port 53198 UDP

Any help you can offer is appreciated.

Lee Sharp Administrator Posts: 522	L2TP VPN and DNS Jan 17, 2019 3:28:30 GMT Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by Lee Sharp on Jan 17, 2019 3:28:30 GMT Try setting up the L2TP address range outside the subnet. I know it sounds odd, but seems to work.

theloon
New Member

Posts: 6

L2TP VPN and DNS Jan 21, 2019 10:47:03 GMT

Quote

Post by theloon on Jan 21, 2019 10:47:03 GMT

Hi Lee,

Thanks for the comment, I've tried this but it didn't make any difference.

I set the address range to 172.29.100.96/28 and, after connecting, confirmed the client was using an address in the range. Pinging a server on the LAN at 192.168.100.2 succeeds, but pinging the SmallWall LAN IP address at 192.168.100.1 times out.

DNS requests also fail. Looking in the firewall log the responses (UPD port 53 to the L2TP client IP address) are being blocked, so the request is getting to the firewall but it cannot get the response out.

Thanks
Alun

Lee Sharp Administrator Posts: 522	L2TP VPN and DNS Jan 21, 2019 21:23:43 GMT Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by Lee Sharp on Jan 21, 2019 21:23:43 GMT Check your PMs.

Post by theloon on Jan 17, 2019 1:51:05 GMT

Post by Lee Sharp on Jan 17, 2019 3:28:30 GMT

Post by theloon on Jan 21, 2019 10:47:03 GMT

Post by Lee Sharp on Jan 21, 2019 21:23:43 GMT

Quick Reply