• Guest, The rules for the P & N subforum have been updated to prohibit "ad hominem" or personal attacks against other posters. See the full details in the post "Politics and News Rules & Guidelines."

Configuring a VPN server in Windows 10 - Where am I going wrong here?

Ichinisan

Lifer
Oct 9, 2002
28,204
1,191
136
How to Create a VPN Server on Your Windows Computer Without Installing Any Software
http://www.howtogeek.com/135996/how-to-create-a-vpn-server-on-your-windows-computer-without-installing-any-software/


I'm using Windows 10 Pro. I'm very familiar with port forwarding configuration. I already had port forwarding configured for Remote Desktop connection with an alternate external port. I tried to do the same thing for this VPN setup (a different alternate port) and specified the alternate port on my iPhone using the public / WAN IP address for my home network, followed by a ":" colon and the alternate port number. It can't connect. I changed the server field to the local IP with no hostname and still couldn't connect.

I know these Arris devices must have the PPTP / L2TP pass-thru options enabled to allow VPN client connections from the LAN. Do those options prevent me from hosting a server on the LAN and making it accessible from the Internet?

Because I access my home PC with Remote Desktop every day, it already has an always-on wired connection with a DHCP reservation so the LAN IP won't change and the port forwarding rules will not break.

[edit]
Well, I tested on 2 Windows 10 systems and neither of them show anything listening on port 1723 when I run netstat -a

Went through the same setup on a Windows 7 system and it worked perfectly fine. Did Microsoft break this with Win10? Any chance the functionality was intentionally limited or removed?

From the iPhone, I can connect to the Windows 7 test VPN over LAN or WAN (only with the default port number 1723). The iPhone could not connect to the Windows 7 test VPN through any alternate external port number. I configured several in the 4,000s and configured the iPhone with [wanIP]:[port], but it wouldn't connect. I don't know if that's a problem with my router or a limitation of the iPhone VPN client. Perhaps the iOS VPN client doesn't interpret the host:port syntax?​
[/edit]





































 
Last edited:

Ichinisan

Lifer
Oct 9, 2002
28,204
1,191
136


That's the current setting, but I've also tried it with the Windows Firewall disabled completely. No third-party firewall/Internet security software is installed.
 

smakme7757

Golden Member
Nov 20, 2010
1,488
1
81
A few tips based on the fact that the VPN client believes that there is no endpoint listening at the address it is trying to connect too.

1:
Try a "netstat -a" and see if the service port is actually listening on the windows machine. If it isn't then you need to find out why (Maybe VPN service is stopped?).

2: Are you connecting from within your home network or from outside of it over 3/4g?
If it's inside your network some consumer routers get confused with NAT if you're resolving a hostname on the public internet that points to your public IP.

So try connecting from outside your home network.
 
Last edited:

Ichinisan

Lifer
Oct 9, 2002
28,204
1,191
136
A few tips

1:
Try a "netstat -a" and see if the service port is actually listening on the windows machine. If it isn't then you need to find out why (Maybe VPN service is stopped?).
Thanks. Ran that command as Administrator and sent the output to a text file. What do I search for?

2: Are you connecting from within your home network or from outside of it over 3/4g?
Fails when I connect to WiFi and use the LAN IP with no alternate port specified.
Fails when I disable WiFi (using mobile data connection) and attempt connecting to the WAN IP with alternate port specified.

If it's inside your network some consumer routers get confused with NAT if you're resolving a hostname on the public internet that points to your public IP.
Using IPv4 addresses exclusively, so no hostname resolving here...
 

Ichinisan

Lifer
Oct 9, 2002
28,204
1,191
136
YOu can use
http://www.canyouseeme.org/
And punch in your connecting port. It's an easy way to see if it's open and responding.
It finds a listening server when I enter the external port I configured for RDC.

It doesn't find anything when I enter the external port I configured for VPN.

No surprise to me since it doesn't work over LAN either. I think the PC is the problem.
 

smakme7757

Golden Member
Nov 20, 2010
1,488
1
81
It finds a listening server when I enter the external port I configured for RDC.

It doesn't find anything when I enter the external port I configured for VPN.

No surprise to me since it doesn't work over LAN either. I think the PC is the problem.
Yea most likely.

As for netstat

here is an example from an SQL server which listens on port 1433
TCP 0.0.0.0:1433 MSSQL-01:0 LISTENING

Yours would then be
TCP 0.0.0.0:1723 WindowsPC:0 LISTENING

If you see "Listening" then you know that an application is listening on that port.

That doesn't mean that the port is open in the Windows Firewall though.
 

Ichinisan

Lifer
Oct 9, 2002
28,204
1,191
136
Yea most likely.

As for netstat

here is an example from an SQL server which listens on port 1433
TCP 0.0.0.0:1433 MSSQL-01:0 LISTENING

Yours would then be
TCP 0.0.0.0:1723 WindowsPC:0 LISTENING

If you see "Listening" then you know that an application is listening on that port.

That doesn't mean that the port is open in the Windows Firewall though.
Since the netstat -a output contained no instance of "1723," I'm thinking something is broken with my machine. I have deleted and re-created the VPN settings multiple times (following the instructions I linked in the OP) and restarted my machine.
 

smakme7757

Golden Member
Nov 20, 2010
1,488
1
81
Just as an aside.

You can run the following powershell command to open the Windows Firewall for that port. Save you some time clicking through the dialog.

Import-Module NetSecurity
New-NetFirewallRule -DisplayName "Windows VPN TCP" -Direction Inbound -LocalPort 1723 -Protocol TCP -Action Allow -Profile Public, Private, Domain
 

smakme7757

Golden Member
Nov 20, 2010
1,488
1
81
Ok i did a few tests.
It worked fine on Windows 7. I couldn't get it to work on Windows 10.

Windows also activates the requires firewall rules (1723 and 47) when the VPN server is setup so you don't need to worry about that.
 

Ichinisan

Lifer
Oct 9, 2002
28,204
1,191
136
Check the the incoming connection is assigned a static address that is outside the DHCP range.
Found a video that mentioned that. My client (iPhone) doesn't let me specify an IP address, but I configured the VPN server to assign from a range that is outside of my router's DHCP range (but in the same subnet). Didn't work.

Still, barking up the wrong tree there because the Win10 system doesn't even show anything listening on port 1723 when I did the netstat -a command.
 

rumpleforeskin

Senior member
Nov 3, 2008
380
13
81
Found a video that mentioned that. My client (iPhone) doesn't let me specify an IP address, but I configured the VPN server to assign from a range that is outside of my router's DHCP range (but in the same subnet). Didn't work.

Still, barking up the wrong tree there because the Win10 system doesn't even show anything listening on port 1723 when I did the netstat -a command.


You would specify the fixed IP address on the incoming connection (last image in the 1st post) not on the iphone. Click properties for "internet protocol version 4"


I just tested on my win 8 machine and if I move the incoming connection IP address within the DHCP range it does not show up as listening in "netstat" so it worth a try.

Edit: sorry I just reread what you typed and see that you tried it and it did not work :(
 

Ichinisan

Lifer
Oct 9, 2002
28,204
1,191
136
Well, I tested on 2 Windows 10 systems and neither of them show anything listening on port 1723 when I run netstat -a

Went through the same setup on a Windows 7 system and it worked perfectly fine. Did Microsoft break this with Win10? Any chance the functionality was intentionally limited or removed?

From the iPhone, I can connect to the Windows 7 test VPN over LAN or WAN (only with the default port number 1723). The iPhone could not connect to the Windows 7 test VPN through any alternate external port number. I configured several in the 4,000s and configured the iPhone with [wanIP]:[port], but it wouldn't connect. I don't know if that's a problem with my router or a limitation of the iPhone VPN client. Perhaps the iOS VPN client doesn't interpret the host:port syntax?
 

Oceanas

Senior member
Nov 23, 2006
263
0
76
PPTP pass-through works by monitoring connections hitting 1723, which is only the control channel used to setup the tunnel which is using GRE. If you are using port forwarding to 1723, it's not going to work since your inbound packet is not going to 1723 at the router WAN port. To get around that, you would need to have a router which supported forwarding the GRE protocol to your VPN server.
 
Last edited:

CZroe

Lifer
Jun 24, 2001
23,752
673
126
Then why did it work on Windows 7?

Edit: Nevermind. It sounds like he couldn't remap the port on Win7.
 
Last edited:

mxnerd

Diamond Member
Jul 6, 2007
5,491
655
126
You probably have to restart Routing and Remote Access service or restart PC.

I set up PPTP server in Windows 10 like you and in Services it shows "Routing and Remote Access" is running but when netstat -a is run port 1723 is not listening.

After I restarted the service port 1723 shows up in netstat -a command.

===========

Sorry, just saw your post #10 saying you restarted the PC.

Oh, well.
 
Last edited:

Ichinisan

Lifer
Oct 9, 2002
28,204
1,191
136
You probably have to restart Routing and Remote Access service or restart PC.

I set up PPTP server in Windows 10 like you and in Services it shows "Routing and Remote Access" is running but when netstat -a is run port 1723 is not listening.

After I restarted the service port 1723 shows up in netstat -a command.

===========

Sorry, just saw your post #10 saying you restarted the PC.

Oh, well.
Thanks. I came across this myself by chance earlier today, but I had to leave and couldn't do any further testing.



I got that after I did this:
- disabled all network interfaces
- went into registry and deleted stored network profiles (I didn't like seeing a "2" on the end of it)
- enabled the Ethernet wired interface again
- on a hunch, tried creating the VPN server again, which finally gave me that error message

I checked and saw that the service was disabled.
 
Last edited:

Ichinisan

Lifer
Oct 9, 2002
28,204
1,191
136
Yup. It's working fine now -- except I really didn't want to use the standard port 1723 without some kind of encryption.
 

Ichinisan

Lifer
Oct 9, 2002
28,204
1,191
136
Any idea why the "Routing and remote access" service would stop for no reason?

My devices were unable to connect to my home VPN for a while. I noticed the "incoming connections" icon was missing from Network Connections. I noticed the "routing and remote access" service was not running, so I started it. The "incoming connections" icon reappeared in Network Connections and my client devices can connect again.
 

ASK THE COMMUNITY