I'm working in a building where you rent a room for the office work. We have our server in one of the rooms and other employees in other rooms. The problem is that server needs its own network (don't ask why. Too much to explain) so we set up a VPN on the Mikrotik router (RouterOS 6.48.1). While connecting from home works perfectly, doing that from other rooms does not work. I was searching a lot about firewall and NAT rules but I can't find anything that will help me. In the picture cut-out area is the external address. Let's say it's 2.2.2.2
So I want employees from other rooms to be able to connect to VPN from My room to 192.168.43.2 router so he/she will be able to connect to devices available there.
There are many ways by which you can do this. One of the easiest way is add a rule of allowing incoming and outgoing traffic of your subnet in firewall rules. Here allow 192.168.0.0 , 0.0 will work as wildcard so be careful while using it. Also if you have manually configured routing configuration on router for vpn add both the network address in route table to make them communicate.
Related
I got a bit of a problem lately. I want to access my home network from the internet using a VPN and DynDNS.
For DynDNS I registered a free domain name at TwoDNS. My router is also setup to tell the DNS server its current IP address once in a while.
But then I realized that the address shown at TwoDNS doesn't match the address my router has. This is due to the fact that I am living at a student residence that is connected to the network of our university.
So my local network probably lies behind multiple NAT-routers. Usually this would require a port forward but how if I am not in control of the routers.
Maybe an external server with a constant connection to my home network will do the trick. What do you think?
Is there some kind of dynamic NAT?
Thanks in advance for any help
The solution is simple and there is one specific service to enable just what I described: LogMeIn Hamachi
We are attempting to use a Cisco ASA as a VPN as well as forward traffic to two servers.
Our ISP has given us a range of IP addresses that are sequential.
154.223.252.146-149
default GW of 154.223.252.145, we're using netmask 255.255.255.240
We have the first of these, 154.223.252.146, assigned to the external interface on our ASA and it’s successfully hosting our VPN service. It works great.
The next and final goal is to have 154.223.252.147 forward https traffic to 10.1.90.40 and 154.223.252.148 forward https traffic to 10.1.94.40.
Our current blocker is our inability to get the outside interface of the asa to respond to these ip addresses.
We’ve been able to use 154.223.252.146 to forward https traffic correctly. So we know that works.
I’ve plugged my laptop into the switch from our ISP and have successfully manually assigned 154.223.252.147 and 154.223.252.148 with the default gw of 154.223.252.145 and was happily connected. So we know the IP’s are there and available, we just need to convince the ASA to respond to them and use them to forward https.
We’ve tried plugging cables from the switch into other interfaces on the firewall. This failed because the netmask overlaps with our first outside interface 154.223.252.146 255.255.255.240, Cisco hates this and doesn’t allow it.
We’ve read documentation and have heard that it’s possible to assign a range of IPs to the ouside interface by defining a vlan. We do not know how to successfully make this work and out attempts have failed.
What's the best way to accomplish this configuration with a Cisco ASA?
You don't need to assign multiple IPs from the same range to more than one interface. That doesn't work with Cisco. Instead try a static one to one NAT for your Web server and terminate your VPN traffic on the IP address assigned to the interface.
Watch this video for one to one NAT:
https://www.youtube.com/watch?v=cNaEsZSsxcg
Cisco has an active scanning technology that was enabled on this ASA. We were able to diagnose it by intermittent bad behavior. After troubleshooting long enough we realized that some of the behavior couldn't be consistent with the changes we were making. So we started looking for things that the firewall would be trying to do by itself. That ended up helping us narrow it down. Disabling active scanning allowed our external vlan configurations to work. Now moving on to tightening up the configs.
My friend wanted to connect to my computer using Remote Desktop Connection. But the problem is I am confused what my Ip address is.
My computer is connected to the internet via router via broadband internet network. My ip address is dynamic.
Here, my main purpose is not only the remote connection but also learning how dynamic ip connect to another pc.
I searched for ip address on Google. They show me an ip address. But I think it is not mine, it's related with the router or broadband network. I also find a WAN ip (it is different from that i found on google) on router settings. It did't work.
I used Team Viewer. It worked perfectly. But I want to do that manually because I am going to make a multiplayer game on GM8.
It will helpful if someone explain about ip and port forwarding.
Teamviewer is a great tool, but uses different techniques than what you plan to do. Teamviewer always uses an outgoing connection and use a mediator on the Internet to connect you and the other PC.
You should ask your Internet provider if he technically enables you to be reachable from the outside Internet. Often this is not possible at all, even if you configure your router the correct way.
When you ask this you can ask him if you have a static IP.
It seems you are not aware of basics of IP networking, so I'd strongly advise against trying this on your router as wrong settings would render it useless. But here's for your information how port forwarding and IP Address and dynamic DNS can be used to solve your problem.
Basically your ISP is likely to give you a router having an IP address. If this IP address is a global IP address, it is possible to connect to this IP from outside. How do you find out whether your IP address is global? Look for your WAN IP address setting. If it is in 10.x.x.x or 192.168.x.x range, it's unlikely to be global and in that case it might not be possible to connect to your computer from outside - without help of a third server (some kind of a registration server, where you connect and register your application). The Registration server would determine your globally visible IP address and then convey it to another Application who is interested in connecting to it. This is somewhat complicated to make it work (but if you intend to make a game - this is something you'd have to do regardless). This is mostly how software like TeamViewer would work.
If you have a global IP address - it means it can technically be reached from anywhere in the world. In that case you could use port forwarding to make things work for you. Port forwarding works basically as follows - You expose a certain port (on TCP) to external world - say 8000 and then you make a setting like following on your router.
<TCP>-<RouterIP>-8000 --> <TCP>-<Your LAN IP><Your application Port>
(You can find you lan ip using ipconfig on windows or ifconfig on Linux).
Now all connections coming to port 8000 would be directed to your application. You might want to do it on UDP as well and the protocol above would change. That is how you 'open' a few ports to be accessible from outside, configure them on your router and then run corresponding applications on your network.
There's another thing called dynamic DNS, where the IP address you use if it is dynamic (and global) can be registered with a Dynamic DNS server so that you don't have to know and remember the current WAN IP Address. But that can be for later.
Hope that helps.
I installed Veency Server on my old Iphone 3GS. I can connect to it from my other devices in local network, using its 192.168.2.xxx adress, but i cant connect from another network. I know that my router uses NAT so i tried port forwarding for ports 5500,5900 and 5800, then i tried to forward all ports in range 0:7000 but none of them seemed to work. What can i do ?
Thanks a million in advance.
Shouldn't be too complicated.
Set a DHCP reservation in your router for the device.
Forward the VNC port (Usually 5900) to the IP you set.
If you don't have a static external IP, get something like No-IP or DynDNS so you can have an unchanging URL to connect to.
That's about it, it's no different than making any other service external.
You should know that this will not be secure, and very easy for a man in the middle attack to happen.
I an trying to setup a server system at home because I recently switched ISP's.
I own the vrakiver.net domain name through the register.com registrar.
My ISP provides a static IP to my DD-WRT router.
I have 2 computers setup with static IP's:
1st: "server" with IP 192.168.1.102
2nd: "g5" with IP 192.168.1.100
I from within the LAN I can connect to either with server.local or g5.local or at their respective IP's.
I Would Like to set up the system so that I can use g5.vrakiver.net from anywhere in the world to access "g5" and server.vrakiver.net to access "server"
Port forwarding isn't going to cut it, because I need access to all the ports of both devices. (But not necessarily at the same time)
I read something somewhere about some systems asking what domain the user was directed from and then deciding where to route based on that.
* I Think this should be physically posible, beacuse it would be so easy on IPv6, just set the domain record to each hosts publicly accessible IP.*
Thanks in advance for any advice on this you can give.
I'm afraid what you're trying to achieve is not possible.
Your clients will first resolve server.vrakiver.net or g5.vrakiver.net before contacting your router.
As the resolution yields the same IP adress, your router has no way to know which name has been used.