Reassurance regarding VPN issue

[Guest Guest]

I've recently deployed a new VPN Server as our current isn't up to scratch in terms of ciphers etc which were being used. I got our provider (Exa via Link2ICT) to forward the necessary ports (500 and 4500 UDP) and everything was working fine for about a day. However, I'm no longer able to connect to the service using my personal broadband as there is no response from the VPN Server, when connecting via my mobile everything works fine. When I ping the server from my home broadband I get "destination net unreachable" however when going via my mobile when not connected to the VPN I get the expected "Request timed out". I was in contact with Link2ICT and "nothing is being blocked and the issue must be with my provider" at first this was believable as I suspect there are issues with my ISP so I put it down to that. My broadband contract is up so I'm changing provider, I thought that would resolve the issue. After much back and forth with Link2ICT this were very dismissive and are adamant that it's not there issue and they won't be providing any more support regarding this as "we're not using the supported VPN (Exa's Fortigate VPN)"

 

However, today I had a complaint from a user that the VPN wasn't connecting. After remoting onto her laptop it appears that she is experiencing the exact same issue. When pinging the server "Destination net unreachable". This user is with a different provider to my self (she's with Sky and I'm with Vispa). I contacted Link2ICT, again their response was as were not using the provided VPN so they won't support us

 

I'm no networking expert so my knowledge in these areas is pretty limited. After some Googling it seems that "Destination net unreachable" is usually indicative of either routing issues or the connection somehow being blocked. Both of which they deny are causing the issue

 

I'm planning on ruling out a VPN issue by sticking iperf on the vpn server and trying to connect via my laptop remotely.

 

Am I being an idiot or is this likely to be an issue on their side?

This ticket has been open with them for over 17 days and I'm getting nowhere, I don't how much longer I can put up my their c**p

[3s-gtech]

Sky has Broadband Shield, which will block VPNs. Those ports will probably be blocked.

 

Not sure with your ISP, but again I suspect you have a firewall ‘helping to protect’ you.

 

We went through this recently!

[Guest Guest]

I dont believe it is an issue with my connection though as the old server is still in place an uses the same ports and this works fine

[3s-gtech]

These sort of intelligent firewall can be a bit unpredictable. What works on one IP may not on another. Do you have a control panel to log in to, to see if there’s anything happening?

[Guest Guest]

I have no access to the firewall what so ever. When I ping from an effected device I get destination net unreachable, doesn't that indicate that something else is going on? Ports 500 or 4500 being blocked wouldn't cause that surely? Sorry if these are stupid questions, I just don't wanna look like an idiot if I kick up a stink with Link2ICT

[Steve21]

Is it just her/you or everyone that's got the problem? The fact it's working on mobile data but not any normal connections could also suggest DNS issues (possibly internal) if the phones using ipv6 while you're on ipv4 etc.

 

Happy to have a test on it from my end if you wanted to drop an IP in a PM etc to see what we get on another connection

 

Steve

[Guest Guest]

I've only moved the two of us across with the intention of migrating everybody else once everything is working OK. We have nothing internal DNS wise, just a single A record in our public DNS pointing to the public IP of the VPN Server. I did notice when pinging the server address via my phone that I got an IPv6 address but as far as I'm aware we don't have any IPv6 addressing what so ever and when doing an AAAA lookup no records are returned?? I'll PM you

 

Many thanks

[FN-GM]

This isn't uncommon. Many ISP block the ports. I have face this issue in the UK and Australia. SSL VPN is a good way to get around this.

[Steve21]

I've only moved the two of us across with the intention of migrating everybody else once everything is working OK. We have nothing internal DNS wise, just a single A record in our public DNS pointing to the public IP of the VPN Server. I did notice when pinging the server address via my phone that I got an IPv6 address but as far as I'm aware we don't have any IPv6 addressing what so ever and when doing an AAAA lookup no records are returned?? I'll PM you

 

Many thanks

 

Just tried it on mine, and I'm getting what looks like a good connection. Ping wise it'll timeout as guessing firewall as you said rather than unreachable, but can add the connection and get as far as a login box for credentials.

 

This is on Virgin currently (I do have IPSec allowed on my firewall by default for other VPNs) so will have a play later to see if that might be why and take it off (Will drop some details across in PM later)

 

Steve

[Guest Guest]

Just span up a VM in Linode and when pinging the new server destination net unreachable and the old pings fine

[Guest Guest]

Turns out it was a routing issue.

 

Link2ICT refused any support as it's an "unsupported application", so I went direct to Exa and spoke to a really helpful engineer who had the issue resolved within the hour