Ports affecting the VPN connectivity

Securing the server running RRAS role after doing upgrade or fresh install of Windows server 2008

Routing and Remote Access Blog — Fri, 14 Mar 2008 08:44:50 GMT

Hello, As you know in Windows server 2008 (WS08) we have removed “Basic Firewall” functionality in RRAS

re: Ports affecting the VPN connectivity

Stefaan Pouseele — Thu, 14 Jun 2007 00:06:30 GMT

For L2TP/IPsec based VPN's, a firewall will only see IPsec traffic. In other words, the L2TP traffic (UDP Port 1701) is hidden. Thus, only UDP 500 (IKE), UDP 4500 (NAT-T) and IP protocol 50 (ESP) is needed.

re: Ports affecting the VPN connectivity

Sooner Al [MVP] — Wed, 13 Jun 2007 23:47:14 GMT

Users can run the test detailed in the PPTP Ping and VPN Traffic sections in this Cable Guy article to troubleshoot PPTP VPN connection problems.

http://www.microsoft.com/technet/community/columns/cableguy/cg0105.mspx

These tools, ie. pptpsrv and pptpclnt, also run on Vista machines for home users setting up a PPTP VPN server on a Vista PC at home and/or use a remote Vista client.

http://theillustratednetwork.mvps.org/Vista/PPTP/PPTPVPN.html

Many consumer grade routers have issues passing GRE Protocol 47 traffic.

re: Ports affecting the VPN connectivity

anon — Wed, 13 Jun 2007 20:26:56 GMT

What about IPsec NAT-T on 4500/udp? We currently rely on this functionality for Windows 2000 clients connecting to a Windows 2003 Server. If this functionality is changing because of TCP encapsulation solutions like SSTP, then it would be great to know.

Thanks