I'm trying to VPN using GPRS to several networks which I have access to but I can't seem to be able to VPN them with my PDA2K. I can VPN them easily with no special configuration with my XP.
My i-mate keeps trying "Connectioning XX VPN..." and then aborts after about half a minute saying to check the username and password. The username and password are correct.
I called my cellular provider and they said that I should be able to connect to a VPN only if 'UDP Encapsulation' is defined on the VPN server?!?!? Well.. What is this thing? I'm trying to connect to big corp VPN, they wouldn't even listen to 'special requests'. I tried to connect to 4 different VPNs and I could not connect to any single one of them!
I really need that VPN connection via GPRS with my PDA2K. Any help would be more than appreciated. Maybe a different client than the built in VPN client of the WM2003SE ?
Thanks in advance.
Sorci
anyone?
bump for help. this gotta be a common prob.
Your GPRS connection will be subject to some form of NAT (Network Adress Translation) through your provider. VPNs don't get along well with NAT as the firewall doing the address translation modifies the packet header after it has had it's hash value calculated by the client (in this case your PDA). The receiving firewall will reject the packet as the hash values for the (now modified) packet don't match.
UDP encapsulation gets around this by encapsulating the encrypted and authenticated (secure) packet in a UDP packet which will be happily modified by the NAT'ing firewall. The receiving firewall will decapsulate(is that even a word?) the UDP packet and process secure packet inside as normal.
James
Thanks a lot Jamz for the thorough detailed info. I appreciate it.
So what's the fix? I tried several other VPNs and was unable to access them as well.. I can't just call all these providers and make some strange requests for a 'one guy with a pda2k and a gprs connection' that wants them to change their VPNs, enabling or disabling protocols or port.
Any other solution?
sorci said:
Any other solution?
Click to expand...
Click to collapse
Are you sure you're using the built-in VPN client in Windows, and not something like a Cisco VPN client?
You could try something like the Movian VPN client (not sure this is still made). I've used this previously with a Cisco VPN and it is fully configurable to handle multiple VPN types.
I've got a similar problem. Am trying to set up a temporary GPRS connection into my work LAN (I work for myself but 2nd child due shortly so want to be able to connect in from home for a couple of weeks only). I've got MS Win2000 Server set up to accept incoming VPN connections and it works fine on a dial-up connection but refuses to authenticate my username/pasword whenever I try to get the GPRS working.
As it's only going to be used for a short period of time, I'm loathe to spend out on any specific hardware/software but if anyone's got any suggestions, I'd be grateful.
If it helps, the LAN is behind a Netgear DG834GT ADSL modem/router/firewall and VPN PPTP and IPSEC are allowing in and out on it. The server is on a static IP address in the range 192.168.99.x.
GPRS Connections and VPN
With O2 you have to aks for VON connectivity to be enabled and connect to vpn.o2.co.uk instead of mobile.o2.co.uk. (by the way you can't access the web whilst connected to the vpn.o2.co.uk AP)
I suspect that most providers have simalair requirements
Dave
I have recently moved on from an XDA II to the IIs model to test at work and have so far gone through hell with O2 trying to get to the bottom of using the Wi-Fi connection and VPN. So far I have been told that a number of services had to be enabled on my SIM but still nothing!!!
But the latest being there is a Wireless network service that needs enabling and this service is £30 a month.... please tell me this isnt true?
When I connect through GPRS and use my VPN connection it works fine so I know the configuration is ok.
But when I swap to Wi-Fi it picks my companies network up and I can access the internet but then when I try to connect through VPN it does nothing.
I would love to know if anybody has been able to get this working, and if perhaps Im missing some settings? I have emailed O2 Data support but may have been better off talking to my nan!!!
ROM version: 1.12.62 WWE
ROM date: 10/04/04
Radio version: 1.02.00
Protocol version: 1337.32
ExtROM version: 1.12.178 WWE
many thanks
Peter Jones
O2 data support are indeed a waste of space. I wish I had not bothered with O2. How did you get the VPN over GPRS working? Did you need to get and additional service enabled or use a different GPRS APN? I am using mobile.o2.co.uk. The option to add a VPN only appears under the work profile, if after connecting GPRS I try and connect VPN it fails. I know that the VPN works since I can connect to it from my laptop thats connected to the phone via bluetooth in order to dialup via GPRS.
Any idea's?
I too have been unable to get the VPN to work while connected via wifi, I am not even sure that it supports this.
Nigel
I bet this is nothing to do with O2 I bet this is a network issue, correct me if I am wrong but the wifi you are on is useing a NAT firewall either at the WiFi router or AP, or it could be a gateway firewall such as a unix box. If you are useing a VNP from inside a NAT firewall and you are useing PPTP or L2TP to connect, you need to make sure the firewall will alow you to make outgoing connections on TCP port 1723, and you also need to enable IP protocol 47 (GRE). this is the tricky one, it is not a TCP or UDP port. TCP is a suite of protocols that include FTP, HTTP, DNS, etc. you will notice all these protocols pass data of some sort. that is because they work at the session layer.
OSI Network Model (this is a standard, basic network knoledge)
Layer 7 Application
Layer 6 Presentation
Layer 5 Session
Layer 4 Transport
Layer 3 Network
Layer 2 Data link
Layer 1 Physical
when you see TCP/IP the reason there is a slash is to show you that TCP carrys the data and IP makes sure it gets there, this is why we have IP addresses. So TCP port 1723 is what is carrying the data (if you are useing PPTP) so port 1723 is just like port 80 (http) it is used for a protocol at the session layer, because it is a session. TCP its self is at the transport layer, because it is the one that is acctualy moveing the data. and IP is at the network layer bucause it is actualy finding the hosts on the internet, where the data is going and comeing from. Just like TCP has sub protocols like http, IP has sub protocols like GRE or protocol 47 (they are the same thing) you need to make sure your firewall can open this up. Some routers can, but alot of cheap ones cant. I couldn't speak for AP's coz i barely use them. But a good hardware firewall. unix box or software like MS ISA Server should let you do it easy.
remeber that IP protocol 47 GRE IS NOT TCP port 47 (or UDP) and that you need to be able to open it on your firewall
I am trying to establish a VPN connection but cannot get the connection to work.
I am using the built in MS VPN client of Win Mobile v5.0 (5.1.1700 build 14352.0.1.0)
I have tried both PPTP and L2PT
When L2TP, I was authenticating with a preshared key
Firewall logs show PPTP negotiation successful, and issues a VPN IP address to the device
It can ping the firewall external interface, but times-out trying to reach an internal address
The VPN session is established, but the firewall logs don't register either deny or allow traffic for each internal ping request, rather the firewall packet error count increments for each failed attempt.
Any help is greatly appreciated.
Has anyone had any success with L2TP/IPSec VPNs and Windows Mobile 5 or 6? I have no problems with getting PPTP to work but have NEVER had any success with L2TP/IPSec. I have valid Client & Server Certificates but I have never been able to get a connection; in fact the HTC Wizard I have never even attempts to make a connection (I have a sniffer on the Ethernet port my Wireless AP is connected to). I have tried using Certificates & Pre-Shared Keys but the results are the same - The Wizard never attempts to connect, with PPTP it works every time.
The Server I am using is a Windows 2003 RRAS server and I have verified with a Windows XP Client that L2TP/IPSec works.
I have asked the question before but have not had any helpful replies. I would be grateful if anyone who has set this up successfully can let me know and maybe give me a run-down of the steps you used. I am not interested in any 3rd party VPN clients, it must be the built-in one.
Thanks
Andy
Hi
Yes I have had the same issue with both the wizard and now hermes tried wm5 and wm6. I think it maybe related to NAT-T translation as am unsure from my reading weather MS supports NAT-T on the mobile end. If data session is being NATed by your provider then this may be the cause. Probably need to check the ip packets comming from the phone to see what it is sending out. Is that what you did or is the sniffer at the other end.
sebjepb said:
Hi
Yes I have had the same issue with both the wizard and now hermes tried wm5 and wm6. I think it maybe related to NAT-T translation as am unsure from my reading weather MS supports NAT-T on the mobile end. If data session is being NATed by your provider then this may be the cause. Probably need to check the ip packets comming from the phone to see what it is sending out. Is that what you did or is the sniffer at the other end.
Click to expand...
Click to collapse
It has nothing to do with NAT traversal. WM5 (and WM6 probably?) does NOT support NAT-T, however I am not attempting to get this working over NAT. As I said I have a put a sniffer on the Ethernet port my Wireless AP is connected to and my Wizard does not transmit anything when configured for L2TP/IPSec (except a DNS lookup for the VPN server name if I enter it's DNS name as opposed to it's IP address). With PPTP it works and I can happily see the packets it transmits on the sniffer.
This is really frustrating as it looks like no one has ever got this to work
I had a HP iPAQ 6365 previously with Windows Mobile 2003 and I managed to get it working on this quite easily
Andy
Andy
I now have this working on both the wizard and the hermes.
I am a bit confused with your last response as ipsec port 4500 is nat-t and is required and is being transmitted by both the wizard and hermes in my case.
My setup maybe somewhat different to yours as I have a windows sbs2003 server running isa and rras. It is sitting behind an adsl modem router connected to the internet. The data connection on my phone is edge network on the wizard and HSDPA on the Hermes. Also have tried this via WiFi as well.
Steps I used
On server side router
On adsl modem router setup forwarding udp ports 500 ipsec, 4500 nat-t and 1701 l2tp and protocol 50 IPsec ESP. I selected l2tp/ipsec from its predefined list but noticed it missed udp 1701 so added this manually.
On Server.
ISA management selected Network Configuration right click and selected Allow vpn connections. This essentially setups the ip filters to allow incomming protocols and then sets up rras for pptp and l2tp ports.
In rras configure a preshared key by right click server/properties/security tick allow custome ipsec policy... and added preshared key.
On mobile
settings/connections
My Work Network
Edit my vpn servers and added new IPsec/L2TP connection.
Works a treat hope this helps
I did notice on another forum something about disabling the phone skin but I did not have to do this.
Regards
Stephen
sebjepb said:
Andy
I now have this working on both the wizard and the hermes.
I am a bit confused with your last response as ipsec port 4500 is nat-t and is required and is being transmitted by both the wizard and hermes in my case.
My setup maybe somewhat different to yours as I have a windows sbs2003 server running isa and rras. It is sitting behind an adsl modem router connected to the internet. The data connection on my phone is edge network on the wizard and HSDPA on the Hermes. Also have tried this via WiFi as well.
Steps I used
On server side router
On adsl modem router setup forwarding udp ports 500 ipsec, 4500 nat-t and 1701 l2tp and protocol 50 IPsec ESP. I selected l2tp/ipsec from its predefined list but noticed it missed udp 1701 so added this manually.
On Server.
ISA management selected Network Configuration right click and selected Allow vpn connections. This essentially setups the ip filters to allow incomming protocols and then sets up rras for pptp and l2tp ports.
In rras configure a preshared key by right click server/properties/security tick allow custome ipsec policy... and added preshared key.
On mobile
settings/connections
My Work Network
Edit my vpn servers and added new IPsec/L2TP connection.
Works a treat hope this helps
I did notice on another forum something about disabling the phone skin but I did not have to do this.
Regards
Stephen
Click to expand...
Click to collapse
What ROM are you running on the Wizard? I am currently running a WM6 ROM but I previously used the official QTEK update (AKU 2.3 I think?) and then various WM5 AKU 3.3 ROMs. I have tested this with all of them and none have worked. If I could just see it attempt to connect I would be happy The fact is it doesn't transmit anything at all and all I see is the dialogue box on the Wizard saying 'Cannot Connect'....
With regards to NAT-T I read that the VPN Client in Windows Mobile 5 was not capable of this, I could be wrong however?
Andy
Sorry didn't have signature updated I'm running WM6 MBE on the wizard and WM6 Black on the Hermes
Ok I am still confused can you tell me exactly how you are connecting to your work network. Wifi or gprs.
Can you check also.
Under settings/connections/advanced/select networks make sure you have a separate ie different connections for the internet and private network. The Intenet settings will be your service provider grps settings.
For the private network mine is set as My Work Network. Edit this and make sure sure you do not have any modem connection listed ie we want to make sure it goes out over our existing connection and does not try to make a new connection. Make sure the vpn tab has your vpn settings as required they must be listed here and not under the Internet connection.
If you are using WiFi you must make sure the network setup is Connects to: The Internet and not set to Work. If it is work the VPN will not connect. You can not change this on the fly need to disconnect and setup again.
PM Me When you get to work given time diff I should be home. Might be able to test connection to my server at home then can check logs etc
Also use Task manger v2.7 to view netsats on phone to confirm udp ports and ip routes etc. It will show you if the phone is indeed sending should see upd ports 500 4500 and 1701 being used.
Stephen
sebjepb said:
Sorry didn't have signature updated I'm running WM6 MBE on the wizard and WM6 Black on the Hermes
Ok I am still confused can you tell me exactly how you are connecting to your work network. Wifi or gprs.
Can you check also.
Under settings/connections/advanced/select networks make sure you have a separate ie different connections for the internet and private network. The Intenet settings will be your service provider grps settings.
For the private network mine is set as My Work Network. Edit this and make sure sure you do not have any modem connection listed ie we want to make sure it goes out over our existing connection and does not try to make a new connection. Make sure the vpn tab has your vpn settings as required they must be listed here and not under the Internet connection.
If you are using WiFi you must make sure the network setup is Connects to: The Internet and not set to Work. If it is work the VPN will not connect. You can not change this on the fly need to disconnect and setup again.
PM Me When you get to work given time diff I should be home. Might be able to test connection to my server at home then can check logs etc
Also use Task manger v2.7 to view netsats on phone to confirm udp ports and ip routes etc. It will show you if the phone is indeed sending should see upd ports 500 4500 and 1701 being used.
Stephen
Click to expand...
Click to collapse
I am using WiFi, this is all in a test environment so I have full control over everything. Under Connections I have 'My ISP' and 'My Work Network' listed. 'My ISP' has a modem entry, 'My Work Network' has no modem but has a VPN listed with the IP Address of the VPN server and set to L2TP/IPSec using a certificate on the device (I have tried with pre-shared key also). The WiFi entry is configured as 'Connects to The Internet'.
I enable the WiFi and verify I have connectivity, I then go to Connections, click on My Work Network, 'Manage existing connections' select the VPN tab, hold down the stylus on the entry and click connect and I almost immediately get the dialogue box saying 'cannot connect'. If I edit the VPN entry so it is PPTP it works every time. As I said I have a sniffer on so I can see what the Wizard transmits and it when set to L2TP/IPSec it doesnt transmit anything whatsoever, with PPTP I can capture the whole conversation.
Thanks for any help you can give me.
Andy
Ok I have now also tried using certificates and your right it does not seem to sending any info at all. It might ahve something to do with checking the certificate store first I ahve had issues before with Cisco vpn and certificates you have to get the nameing and certification justs right before it even starts the connection.
So first thing lets try pre shared keys as I have got that working. I will PM you my server details if you wish to try that first.
Stephen
sebjepb said:
Ok I have now also tried using certificates and your right it does not seem to sending any info at all. It might ahve something to do with checking the certificate store first I ahve had issues before with Cisco vpn and certificates you have to get the nameing and certification justs right before it even starts the connection.
So first thing lets try pre shared keys as I have got that working. I will PM you my server details if you wish to try that first.
Stephen
Click to expand...
Click to collapse
I have just re-tested this and using a pre-shared key - same result
There is a brief flash of 'connecting' when you click connect but then the 'Cannot Connect' dialogue box appears, nothing gets transmitted. I have tried entering different IP addresses (public, private etc) just to see if it will transmit anything - it doesn't regardless of the IP address I enter.....
Andy
Andy
check your pm
Are you sure the wireless ap is actually passing the ipsec/l2tp traffic.
Working, well sort of.....
After a lot of messing around I now have this working, at least partially........
Following a soft-reset I can connect to a Wireless network OK (either a new one or one that is pre-configured), I can then connect the VPN using L2TP/IPSec. I can also manually disconnect the VPN and re-connect without any issues. However, when the wireless is disconnected (i.e. turned off from CommManager) and then re-connected the VPN will never work again, unless the Wizard is soft-reset.
Does anyone know what is likely to be causing this? some application in memory or a registry 'state' entry
Does anyone else see this behaviour?
Andy
I had exactly this with L2TP/IPSec on the MDA Vario II, but the same settings work as they should on my Athena.
ADB100 said:
After a lot of messing around I now have this working, at least partially........
Following a soft-reset I can connect to a Wireless network OK (either a new one or one that is pre-configured), I can then connect the VPN using L2TP/IPSec. I can also manually disconnect the VPN and re-connect without any issues. However, when the wireless is disconnected (i.e. turned off from CommManager) and then re-connected the VPN will never work again, unless the Wizard is soft-reset.
Does anyone know what is likely to be causing this? some application in memory or a registry 'state' entry
Does anyone else see this behaviour?
Andy
Click to expand...
Click to collapse
HI!
How can you DISCONNECT?? Do you get a "Disconnect" button or menu item somewhere??
How do you know you are connected to VPN?
Thank you,
Dmitry.
A bit late but...
I have a possible solution to the fact it doesn't send ANY traffic on a connect attempt - on my XDA mini S (HTC Wizard) it requires me to put something in the 'domain' field on the username/pwd screen before it will start the IPSec negotiation....
Now I just have to get it o complete the process with the sonicwall...
David
Revisiting this
I can't get PPTP going on my HD2. Thoughts?
bumping this message
I have tried all the usual vpn software (for 3g connectivity) the only third party software that connects is the ncp software, but I get stuck because it wont accept a challenge response grid.
Symantic - won't auth
Green something - doesn't connect
MS VPN - doesn't connect
I have been able to connect in the past with an iPhone, but without a java i can't connect to most motorola hardware devices at work so it's useless. I'm testing a G1 on 1.6 now and it fails to connect also. Going to try openvpn today sometime. MY friend has his Eris working, so I know droid OS works.
I work for a large company and switching vpn hardware is out of the question, so if anyone has a 3g resolution for winmo, I won't have to trade my HD2.
Hi,
L2TR VPN with the Windows Mobile is working !!
The trick with L2TR VPN on WM is to use: a IP address (and NOT a hostname)
Strange, because using a hostname with PPTP VPN on the Windows Mobile it works.
With the trick L2TR works perfectly.
Chris
Hello. This is my first foray into VPN on Win Mo. I can establish a PPTP connection between my Imagio (stock Win Mo 6.5 R1) and my SBS 2008 server. I can ping the server and can browse the company web page. But I am having no luck accessing file shares. I have Schaps Network Plugin installed, but it doesn't see/can't access the shares. Will switching to IpSec VPN work? If so, any guidance on how to set it up on SBS 2008.
Hey Folks - maybe somebody can shed some light on VPN setup WM5/6
HTC-AT&T tilt / HTC-Tmobile 8125
I can't get either phone/network connection working for L2TP - I'll set up the connection on the server for PPTP, but for now let focus on L2TP
First - my Openswan server accepts L2TP connections from my laptop, so I know that the server side is OK
Second - I have used the Settings/Connections menu and added a modem under My Work Network, same settings as the modem for the Media Net(default network)
Modem details:
Name: Number
VPN1 wap.cigular
Select modem: Cellular Line(GPRS,3G)
Access point: wap.cingular
no user/pass/Domain
server assigned IP address
added a VPN with the same setting I use on my laptop
and try to connect by 'manage my existing connections' clicking the connection and 'connecting' it opens a 3G(At&T) connection I see the timer ticking if I check the connection. I don't think the network connection is right on the T-Mobile connection - no timer for a connection.(anybody have the T-Mobile network settings)
VPN1:
name: test
hostIP:XX.183.105.172
vpn: L2TP
preshared key
username & password
server assigned IP
But I get no data in the browser URL http://192.168.30.30
I see in the browser a info msg saying locating, and then it says opening...
but nada on either phone.
PC pops the web page up with no problem,
Third - yes I do have data plans for both phones ;-)
Lastly - yes my PC address is NATed, and I don't THINK that the AT&T address is NAT'ed (anybody??)
---
I ran across this : http://www.tutorials-win.com/PocketPC/PPTP-Issues/
which details entering dot'd addresses as an exception or it will drop the connection, which is what it looks like it is doing for a straight IPSEC connectio via TheGreenBow sw(which does not pass data either)
Here are the logs on the server from the laptop:
Feb 3 18:29:18 fc5 l2tpd[9768]: Connection established to 74.166.195.61, 1701.
Local: 33901, Remote: 2. LNS session is 'default'
Feb 3 18:29:18 fc5 l2tpd[9768]: Call established with XX.166.195.61, Local: 572
20, Remote: 1, Serial: 0
Feb 3 18:29:18 fc5 pppd[9773]: pppd 2.4.3 started by root, uid 0
Feb 3 18:29:18 fc5 pppd[9773]: Using interface ppp0
Feb 3 18:29:18 fc5 pppd[9773]: Connect: ppp0 <--> /dev/pts/0
Feb 3 18:29:23 fc5 pppd[9773]: Unsupported protocol 'Compression Control Protoc
ol' (0x80fd) received
Feb 3 18:29:23 fc5 pppd[9773]: Cannot determine ethernet address for proxy ARP
Feb 3 18:29:23 fc5 pppd[9773]: local IP address 192.168.130.99
Feb 3 18:29:23 fc5 pppd[9773]: remote IP address 192.168.130.130
I think that the compression control msg is MPPE but it should not be...
Any and all thoughts are welcome - I'm pulling what little hair I have left out...
Many Thanks
bobm
Hi Bob
Ok
First thing do not create a modem under the my work network section it needs to connect using the internet modem. If you have a modem under my work network it will try to directly access your work network via this modem and not start the vpn connection.
You should only have the modem section filled out for the connection for the internet. So Under settings connections you should have wap.cingular setup for internet. You can then setup the vpn settings in the my work network under edit my vpn servers. In this section you can press on the vpn and select connect.
Or you can make it connect automagically by adding exceptions for intranet addresses in the settings/connections/advanced section. ie *.my.domain.com/* or */* for everything etc.
One other problem if the wap.cingular is using the same nated address range as your internal network you will also have problems. ie if cingular use 10.x.x.x and you internal network is 10.x.x.x.
Regards
Stephen
PPTP VPN connections will not work on the wap.cingular APN. wap.cingular uses a NAPT to generate your IP address. NAPT does not support GRE packets which are necessary for PPTP VPN connections. However, I have read it is possible to setup an IPSec VPN across the NAPT server, although I have never done it.