HI folks, I have been impressed with this forum and am seeking its help.
I have been reading various docs and searching these forums for the past few days looking for a parallel answer that would illuminate me but I am too dense, now I am turning to you all.
I have two WAN connections (eth0 and eth1), but I am only using one (eth 0) this moment while getting these things confirgured. I expect to bring up the other(eth1) one and direct some particular traffic (subnet) thriough it in the future, but it is disabled for now).
My LAN is eth2 (192.168.1.0).
I have two point to point IPSEC VPNs connecting successfully to the ER8.
I am now looking to configure an L2TP VPN connection to allow me to connect via RDP to a couple of machines on the primary network (192.168.1.0).
The L2TP connection is up and woprking, I am able to Ping and see www services through it to both the the Pt to PT VPN's (192,168.0.0 & 192.168.7.0 repsectively), I can aslo see the ER8 host(192.168.1.1).
I cannot ping machines on 192.168.1.0...
The two machines that I am seeking RDP with (192.168.1.14 and .7) reply with request timed out.
I tried to ping a couple fo printers (192.168.1.99 and 192.168.1.9 on that interface (192.168.1.0 eth2) and they provide destinantion host unreachable.
I assume this is a FW and or routing issue, but I do not know what to open up and where in the config to place the rule(s) to do so. As an relative newbie (I have successfully worked with Zywall USG50), I am inexperienced with the CLI and EdgeOS and my knowledge of routing is self taught by necessity ans therefore spotty and suspect. Managuing routing and firewall configuration is not my primary day job, but it is part of muy duty, so I am hoping you all will be able to point me to success.
TIA-
C
firewall {
all-ping enable
broadcast-ping disable
group {
network-group PRIVATE_NETS {
network 192.168.0.0/16
network 172.16.0.0/12
network 10.0.0.0/8
}
}
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians disable
modify balance {
rule 10 {
action modify
description "do NOT load balance lan to lan"
destination {
group {
network-group PRIVATE_NETS
}
}
modify {
table main
}
}
rule 20 {
action modify
description "do NOT load balance destination public address"
destination {
group {
address-group ADDRv4_eth0
}
}
modify {
table main
}
}
rule 30 {
action modify
description "do NOT load balance destination public address"
destination {
group {
address-group ADDRv4_eth1
}
}
modify {
table main
}
}
rule 110 {
action modify
modify {
lb-group G
}
}
}
name WAN_IN {
default-action drop
description "WAN to internal"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
name WAN_LOCAL {
default-action drop
description "WAN to router"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
rule 21 {
action accept
description RemAcER8
destination {
port 80,443,22
}
log enable
protocol tcp
}
rule 30 {
action accept
description ike
destination {
port 500
}
log disable
protocol udp
}
rule 40 {
action accept
description esp
log disable
protocol esp
}
rule 50 {
action accept
description nat-t
destination {
port 4500
}
log disable
protocol udp
}
rule 60 {
action accept
description l2tp
destination {
port 1701
}
ipsec {
match-ipsec
}
log disable
protocol udp
}
}
name Watch {
default-action accept
description "NAT for ******"
rule 1 {
action accept
description "***** NAT"
destination {
address *******
}
log disable
protocol tcp_udp
source {
group {
address-group ADDRv4_eth0
}
port ******
}
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
}
interfaces {
ethernet eth0 {
address 216.173.****
description WAN
duplex auto
firewall {
in {
name Watch
}
local {
name WAN_LOCAL
}
out {
}
}
speed auto
}
ethernet eth1 {
address 50.0.*****
description "WAN 2"
disable
duplex auto
firewall {
in {
name WAN_IN
}
local {
name WAN_LOCAL
}
}
speed auto
}
ethernet eth2 {
address 192.168.1.1/24
description Local
duplex auto
firewall {
local {
name Watch
}
}
speed auto
}
ethernet eth3 {
address 192.168.1.220/24
description "local 2"
duplex auto
speed auto
}
ethernet eth4 {
disable
duplex auto
speed auto
}
ethernet eth5 {
disable
duplex auto
speed auto
}
ethernet eth6 {
address 192.168.100.1/24
address 192.168.200.1/24
description wifi-Guest-snowcrash
duplex auto
speed auto
}
ethernet eth7 {
address 192.168.50.2/24
description phones
duplex auto
firewall {
in {
}
out {
}
}
speed auto
}
loopback lo {
}
}
load-balance {
group G {
interface eth0 {
}
interface eth1 {
}
lb-local enable
lb-local-metric-change disable
}
}
port-forward {
auto-firewall enable
hairpin-nat enable
lan-interface eth2
rule 1 {
description Frankie
forward-to {
address ********
port 80
}
original-port *******
protocol tcp_udp
}
rule 2 {
description Main
forward-to {
address*******
port 80
}
original-port *******
protocol tcp_udp
}
rule 3 {
description Comp
forward-to {
address *******
port *******
}
original-port *******
protocol tcp_udp
}
rule 4 {
description Batch
forward-to {
address *******
port *******
}
original-port *******
protocol tcp_udp
}
rule 5 {
description comp.2
forward-to {
address *******
port *******
}
original-port *******
protocol tcp_udp
}
wan-interface eth0
}
protocols {
static {
route 0.0.0.0/0 {
next-hop 50.0.******* {
}
next-hop 216.173******* {
description GWonPOE
distance 1
}
next-hop 216.173.******* {
disable
}
}
}
}
service {
dhcp-server {
disabled false
hostfile-update disable
shared-network-name MICPHdhcp {
authoritative disable
subnet 192.168.50.0/24 {
default-router 192.168.50.2
dns-server 208.*******
dns-server 208.*******
lease 86400
start 192.168.50.10 {
stop 192.168.50.60
}<bunch of phones>
}
}
}
shared-network-name MNETDHCP {
authoritative disable
subnet 192.168.1.0/24 {
default-router 192.168.1.1
dns-server 208.*******
dns-server 192.168.1.1
domain-name mnet
lease 86400
start 192.168.1.100 {
stop 192.168.1.179
}<bunch of hosts>
}
}
}
shared-network-name Snowcrash {
authoritative disable
subnet 192.168.100.0/24 {
default-router 192.168.100.1
dns-server 192.168.1.1
dns-server 208.201.224.11
lease 86400
start 192.168.100.100 {
stop 192.168.100.149
}
}
}
static-arp disable
use-dnsmasq disable
}
dns {
forwarding {
cache-size 750
listen-on eth2
listen-on eth3
listen-on eth4
listen-on eth5
listen-on eth6
listen-on eth7
name-server 192.168.1.7
name-server 208.*******
name-server 208.*******
name-server 208.*******
name-server 208.*******
name-server 8.8.8.8
}
}
gui {
http-port 80
https-port 443
older-ciphers enable
}
nat {
rule 5000 {
description "masquerade for WAN"
outbound-interface eth0
type masquerade
}
rule 5002 {
description "masquerade for WAN 2"
outbound-interface eth1
type masquerade
}
}
ssh {
port 22
protocol-version v2
}
unms {
disable
}
}
system {
conntrack {
expect-table-size 4096
hash-size 4096
table-size 32768
tcp {
half-open-connections 512
loose enable
max-retrans 3
}
timeout {
udp {
other 30
stream 300
}
}
}
host-name ubntER8
login {
user ******* {
authentication {
encrypted-password ****************
}
level admin
}
}
name-server 208.67.222.222
ntp {
server 0.ubnt.pool.ntp.org {
}
server 1.ubnt.pool.ntp.org {
}
server 2.ubnt.pool.ntp.org {
}
server 3.ubnt.pool.ntp.org {
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone America/Los_Angeles
}
vpn {
ipsec {
auto-firewall-nat-exclude enable
esp-group FOO0 {
proposal 1 {
encryption 3des
hash sha1
}
}
esp-group FOO1 {
proposal 1 {
encryption 3des
hash sha1
}
}
ike-group FOO0 {
proposal 1 {
dh-group 2
encryption 3des
hash sha1
}
}
ike-group FOO1 {
proposal 1 {
dh-group 2
encryption 3des
hash sha1
}
}
ipsec-interfaces {
interface eth0
}
site-to-site {
peer 63.249.70.2 {
authentication {
mode pre-shared-secret
pre-shared-secret ****************
}
connection-type initiate
description 1020OCEAN
ike-group FOO0
local-address 216.173.*******
tunnel 1 {
esp-group FOO0
local {
prefix 192.168.1.0/24
}
remote {
prefix 192.168.0.0/24
}
}
}
peer 67.180.160.57 {
authentication {
mode pre-shared-secret
pre-shared-secret ****************
}
connection-type initiate
description Seacliff_PH2
ike-group FOO1
local-address 216.173.*******
tunnel 1 {
esp-group FOO1
local {
prefix 192.168.1.0/24
}
remote {
prefix 192.168.7.0/24
}
}
}
}
}
l2tp {
remote-access {
authentication {
local-users {
username ******* {
password ****************
}
username ******* {
password ****************
}
}
mode local
}
client-ip-pool {
start 192.168.1.250
stop 192.168.1.251
}
dns-servers {
server-1 192.168.1.1
server-2 192.168.1.7
}
ipsec-settings {
authentication {
mode pre-shared-secret
pre-shared-secret ****************
}
}
mtu 1450
outside-address 216.173.*******
}
}
}
