Which ports to unblock for VPN traffic to pass-through?
Little Background: Microsoft RRAS server and VPN client supports L2TP/IPSec and PPTP based VPN connection. L2TP tunnel traffic is carried over IPSec transport mode and IPSec protocol internally has a control path through IKE and data path over ESP. Whereas PPTP control path is over TCP and data path over GRE.
So now coming back to original question. There are multiple scenarios:
1) If RRAS based VPN server is behind a firewall (i.e. a firewall is placed between Internet and RRAS server), then following ports need to be opened (bidirectional) on this firewall to allow VPN traffic to pass through: -
- For PPTP:
- IP Protocol=TCP, TCP Port number=1723 <- Used by PPTP control path
- IP Protocol=GRE (value 47) <- Used by PPTP data path
- For L2TP:
- IP Protocol Type=UDP, UDP Port Number=500 <- Used by IKE (IPSec control path)
- IP Protocol Type=UDP, UDP Port Number=4500 <- Used by IKE (IPSec control path)
- IP Protocol Type=ESP (value 50) <- Used by IPSec data path
- For SSTP:
- IP Protocol=TCP, TCP Port number=443 <- Used by SSTP control and data path
2) If RRAS server is directly connected to Internet, then you need to protect RRAS server from the Internet side (i.e. only allow access to the services on the public interface that isaccessible from the Internet side). This can be done using RRAS static filters or running Windows Firewall on the public interface (or the interface towards the Internet side). In this scenario following ports need to be opened (bidirectional) on RRAS box to allow VPN traffic to pass through
- For PPTP:
- IP Protocol=TCP, TCP Port number=1723 <- Used by PPTP control path
- IP Protocol=GRE (value 47) <- Used by PPTP data path
- For L2TP:
- IP Protocol Type=UDP, UDP Port Number=500 <- Used by IKE (IPSec control path)
- IP Protocol Type=UDP, UDP Port Number=4500 <- Used by IKE (IPSec control path)
- IP Protocol Type=UDP, UDP Port Number=1701 <- Used by L2TP control/data path
- Note: As filters are applied on the RRAS box after it is decrypted, you don't need ESP filters, but instead L2TP port number which is 1701.
- For SSTP:
- IP Protocol=TCP, TCP Port number=443 <- Used by SSTP control and data path
Note: Please do not use RRAS static filters if you are running that server as a NAT router also.
Do not forget: If you enable Windows firewall or RRAS static filters on the public interface and only enable VPN traffic to pass-through, then all the other traffic may be dropped. For example, if the same server is running as a mail server facing internet or a DNS server or a reverse web proxy server, then you need to enable the ports used by those services explicitly.
For more info on this entire topic:
http://technet2.microsoft.com/WindowsServer/en/Library/ac14405b-3802-4ae0-bcd5-5c33bb7db5311033.mspx?mfr=true
Samir Jain
Lead Program Manager
RRAS, Windows Enterprise Networking
[This posting is provided "AS IS" with no warranties, and confers no rights.]
