Smoothwall, adsl modem and VNC/Rem Desk in?

[contink]

EDIT: Topic changed (see 2nd post on)

 

Just thought I'd pass on some handy tips, keywords to use on the whole smoothwall experience if you plan on using an ADSL router like I did with a bridge function like the USRobotics model I had.

 

Turned out I was hitting problems because I hadn't chosen to "bridge" the connection rather than leaving it with the standard setup where the router handles the NAT, firewall, etc...

 

You don't need to select PPPoA for Nildram or a similar ISP to work either.. just make sure you've chosen PPPoE as the protocol for the Red NIC and you should be able to get it to work. You do of course have to fill out the PPP login information but one thing I found that needed to be unticked was the "persistant connection" tickbox with this particular modem... No idea why but it wouldn't work with that ticked.

 

At some point I'll update with the model of modem I was using but thought I'd share this as it caught me short for a bit.

[contink]

I was severely tempted to kill that last post as my travels in Smoothwall land have since made me aware how obvious most of the above already is...

 

But anyway I digress... I've changed the topic as I'm having something of a nightmare when it comes to trying to access anything past the smoothie via Remote Desktop or VNC.

 

In terms of setup I have a USR modem in full bridge mode being used to authenticate and connect to the Smoothie box with the Extended Defense plus homebrew version installed.

 

Outgoing connections and the proxy work fine so from the schools point of view it does the job wonderfully, however where I'm having problems is with the actual remote access.

 

 

To give a quick setup synopsis:

 

School LAN: 192.168.0.0 IP range

Smoothie Green on LAN range

Smoothie Red = DHCP from ISP/Nildram (we have a static IP as well but using DHCP)

 

Home Modem LAN side: 192.168.9.0

Home Modem Net side: DHCP from ISP/Nildram (Also a static IP but using DHCP)

Home LAN (Win2k3 as router): 192.168.10.0

 

All PC's are setup for Remote Desktop access for my user on the LAN.. Real VNC Enterprise setup on the server (display 1: port 5901) and doesn't require local validation.

 

FFC is installed as part of the Smoothie homebrew setup and has rules:

 

TCP [Home WAN IP] 5901:5920 -> [service LAN IP] 5901:5920

TCP [Home WAN IP] 3389 -> [service LAN IP] 3389

 

 

I've spent the past couple of weeks trying to figure out why I'm not getting to the actual server or any of the machines on the network so I'm finally admitting defeat of sorts and asking for ideas.

 

 

To date I've looked at:

- Problems with the FFC (full firewall control) and think they may be resolved

- Changing the IP range my end (was on 192.168.0.0 and 192.168.1.0)

... and various other bits.

 

Basically I'm wondering if I've missed something fundamental here so any pointers would be appreciated.

[SimpleSi]

I'd have somewhere setup (a mate perhaps) that you could check that your ability to connect RDP/VNC is not due to problem at home and then leave home setup alone

 

That should halve the problem

 

Why not use the StaticIP provided for the school end (or is the DHCP address sufficiently "static" enough to be used?

 

(Same for your end if smoothie needs IP for port mapping or is your home assigned IP sufficiently stable to be hard-coded into smoothie.)

 

Can you risk/try a quick test with the smoothie out of the loop?

 

regards

 

Simon

[Midget]

You DO have the gateway of the work server/other machines set as the smoothie machine right?

 

You can define several gateways under the tcp/ip advanced settings.

[tickmike]

Hi

I have a smoothie box at home protecting my network and I had lots of problems connecting to my Broadband router, because my router could not be put in bridge mode I ended up getting a set of public Ip's and using them to set it up to connect to my smooth box..

 

Go and join the forum at Smoothwall forum. They are very helpful .

 

Link to SW forum

 

 

Michael.

[contink]

I'd have somewhere setup (a mate perhaps) that you could check that your ability to connect RDP/VNC is not due to problem at home and then leave home setup alone

Thankfully I've already had another private client with VNC and remote desktop setup and working already so I know my end wasn't/isn't the problem.

 

Why not use the StaticIP provided for the school end (or is the DHCP address sufficiently "static" enough to be used?

More than anything else because I only changed to getting a static IP recently and didn't want to change anything else that was working. The DHCP for Nildram gives me the static IP anyway but obviously hands off DNS, etc.. at the same time so if it ain't broke...

 

(Same for your end if smoothie needs IP for port mapping or is your home assigned IP sufficiently stable to be hard-coded into smoothie.)

 

Can you risk/try a quick test with the smoothie out of the loop?

My problem there is that I can't find a knowledgeable friend at the home end to test and whilst my other half is ok, it can result in arguments

[contink]

You DO have the gateway of the work server/other machines set as the smoothie machine right?

 

You can define several gateways under the tcp/ip advanced settings.

Oh lord... I think you may have nailed the problem.

 

Because the server machine is the primary router at school (at the moment) and the smoothie is the test machine I've not changed the setup to use the ADSL connection as the gateway. Instead it still points to the LEA broadband router.

 

In truth it also hadn't occured to me that you could have more than one gateway on the same NIC connection. :oops: Having looked at the settings now though I could just set the win2k3 servers WAN gateway settings to use the smoothie gateway as well as the LEA one. I will have to move the patch connection from the smoothie to the router so the same NIC can reach both gateways. Not ideal but it should work fine for testing purposes.

 

Thinking this through though I suspect I may have problem in that I need to ensure the school workstations aren't picking up and using the wrong gateway for net connections. IIRC that should be settable via the DHCP service on the school win2k3 server. But, if anything could screw things up this is probably going to be it (Minasi book time I reckon)

 

I guess it's something for me to try on Monday when I go in but if it's really that daft I think I'll just go brain myself on the nearest wall... :oops: 8O

 

 

Thanks for the input guys... keep it coming if you think of anything else..

[contink]

...I had lots of problems connecting to my Broadband router, because my router could not be put in bridge mode

Thankfully that isn't affecting my current setup so I'm lucky there.

 

Go and join the forum at Smoothwall forum. They are very helpful .

Already done.. I've just been loath to open a thread there as the policy is very much one of "post on the thread of each of your mods" which is dis-ingenious and the reason there's so much confusion on the forums. I figured people here would at least be more aware of the scenario I've got and it looks like I was right.

 

They are helpful though, definitely...

[tom_newton]

I'll have a chat with Darren (who's one of our main forum contributors/mods round here) and see if theres anything that can be done to improve the forum's layout.

[contink]

Right... bearing in mind I'm a bear with a sore head and not necessarily thinking straight I've made a few changes and now have the following setup:

 

School LAN: 192.168.0.0 IP range

School WAN: Now setup with TWO IP's

10.x.x.5 (LEA IP Range)

192.168.1.1

 

Smoothie Green: 192.168.1.2

Smoothie Red = DHCP from ISP/Nildram (we have a static IP as well but using DHCP)

 

Gateway set on School WAN NIC:

10.x.x.1 (LEA Gateway) - Default

192.168.1.2 (Smoothie)

 

 

Wiring has been altered for a short time so I can retain the existing connection for the LEA broadband whilst testing. Ultimately though I can ping the connections from the Smoothie and can also reach the smoothie box fine.

 

The port forwarding rules have been updated to point to the new 192.168.1.1 IP on the server but nothing from outside the smoothie (ie: the net) gets through...

 

 

Home side hasn't changed at all...

 

 

Is the problem simply that I'm trying to use two incoming connections and should only use one? or am I just going about this completely wrong?

[contink]

I can finally report some good news on this..

 

Thanks to a few suggestions from, of all people, my father, I tried tunnelling via putty to prove that it couldn't be done... only to find that it did in fact work after all (Note to self: must try to prove parents wrong more often! ).

 

... as a result I suspect I'm dealing with a problem version of Smoothwall that doesn't handle port forwarding properly (despite a lot of work on this).

 

.. so I reckon I'll be rebuilding the smoothie from scratch with just those mods that I need.. Whoever said the shortcut was the easiest eh?

 

Anyways, figured I'd report back so someone else can try the tunnelling approach to confirm or discount forwarding problems as an issue (Obviously you need the SSH port open on your smoothie for this to work).

Ref: http://martybugs.net/smoothwall/puttyvnc.cgi