Configuring a VPN server in Windows 10 - Where am I going wrong here?

[Ichinisan]

How to Create a VPN Server on Your Windows Computer Without Installing Any Software
http://www.howtogeek.com/135996/how-to-create-a-vpn-server-on-your-windows-computer-without-installing-any-software/

I'm using Windows 10 Pro. I'm very familiar with port forwarding configuration. I already had port forwarding configured for Remote Desktop connection with an alternate external port. I tried to do the same thing for this VPN setup (a different alternate port) and specified the alternate port on my iPhone using the public / WAN IP address for my home network, followed by a ":" colon and the alternate port number. It can't connect. I changed the server field to the local IP with no hostname and still couldn't connect.

I know these Arris devices must have the PPTP / L2TP pass-thru options enabled to allow VPN client connections from the LAN. Do those options prevent me from hosting a server on the LAN and making it accessible from the Internet?

Because I access my home PC with Remote Desktop every day, it already has an always-on wired connection with a DHCP reservation so the LAN IP won't change and the port forwarding rules will not break.

[edit]

Well, I tested on 2 Windows 10 systems and neither of them show anything listening on port 1723 when I run netstat -a

Went through the same setup on a Windows 7 system and it worked perfectly fine. Did Microsoft break this with Win10? Any chance the functionality was intentionally limited or removed?

From the iPhone, I can connect to the Windows 7 test VPN over LAN or WAN (only with the default port number 1723). The iPhone could not connect to the Windows 7 test VPN through any alternate external port number. I configured several in the 4,000s and configured the iPhone with [wanIP]:[port], but it wouldn't connect. I don't know if that's a problem with my router or a limitation of the iPhone VPN client. Perhaps the iOS VPN client doesn't interpret the hostort syntax?​

[/edit]

 

[Ichinisan]

 

[Ichinisan]

That's the current setting, but I've also tried it with the Windows Firewall disabled completely. No third-party firewall/Internet security software is installed.

 

[smakme7757]

A few tips based on the fact that the VPN client believes that there is no endpoint listening at the address it is trying to connect too.

1:
Try a "netstat -a" and see if the service port is actually listening on the windows machine. If it isn't then you need to find out why (Maybe VPN service is stopped?).

2: Are you connecting from within your home network or from outside of it over 3/4g?
If it's inside your network some consumer routers get confused with NAT if you're resolving a hostname on the public internet that points to your public IP.

So try connecting from outside your home network.

 

[smakme7757]

YOu can use
http://www.canyouseeme.org/
And punch in your connecting port. It's an easy way to see if it's open and responding.

 

[Ichinisan]

A few tips

1:
Try a "netstat -a" and see if the service port is actually listening on the windows machine. If it isn't then you need to find out why (Maybe VPN service is stopped?).

Thanks. Ran that command as Administrator and sent the output to a text file. What do I search for?

2: Are you connecting from within your home network or from outside of it over 3/4g?

Fails when I connect to WiFi and use the LAN IP with no alternate port specified.
Fails when I disable WiFi (using mobile data connection) and attempt connecting to the WAN IP with alternate port specified.

If it's inside your network some consumer routers get confused with NAT if you're resolving a hostname on the public internet that points to your public IP.

Using IPv4 addresses exclusively, so no hostname resolving here...

 

[Ichinisan]

YOu can use
http://www.canyouseeme.org/
And punch in your connecting port. It's an easy way to see if it's open and responding.

It finds a listening server when I enter the external port I configured for RDC.

It doesn't find anything when I enter the external port I configured for VPN.

No surprise to me since it doesn't work over LAN either. I think the PC is the problem.

 

[Ichinisan]

Thanks. Ran that command as Administrator and sent the output to a text file. What do I search for?

Searched the resulting text file for "1723" and found nothing.

 

[smakme7757]

It finds a listening server when I enter the external port I configured for RDC.

It doesn't find anything when I enter the external port I configured for VPN.

No surprise to me since it doesn't work over LAN either. I think the PC is the problem.

Yea most likely.

As for netstat

here is an example from an SQL server which listens on port 1433
TCP 0.0.0.0:1433 MSSQL-01:0 LISTENING

Yours would then be
TCP 0.0.0.0:1723 WindowsPC:0 LISTENING

If you see "Listening" then you know that an application is listening on that port.

That doesn't mean that the port is open in the Windows Firewall though.

 

[Ichinisan]

Yea most likely.

As for netstat

here is an example from an SQL server which listens on port 1433
TCP 0.0.0.0:1433 MSSQL-01:0 LISTENING

Yours would then be
TCP 0.0.0.0:1723 WindowsPC:0 LISTENING

If you see "Listening" then you know that an application is listening on that port.

That doesn't mean that the port is open in the Windows Firewall though.

Since the netstat -a output contained no instance of "1723," I'm thinking something is broken with my machine. I have deleted and re-created the VPN settings multiple times (following the instructions I linked in the OP) and restarted my machine.

 

[smakme7757]

Just as an aside.

You can run the following powershell command to open the Windows Firewall for that port. Save you some time clicking through the dialog.

Import-Module NetSecurity
New-NetFirewallRule -DisplayName "Windows VPN TCP" -Direction Inbound -LocalPort 1723 -Protocol TCP -Action Allow -Profile Public, Private, Domain

 

[smakme7757]

I'll try to set it up here. I've never used it, but it seems prety quick to do.

 

[smakme7757]

Ok i did a few tests.
It worked fine on Windows 7. I couldn't get it to work on Windows 10.

Windows also activates the requires firewall rules (1723 and 47) when the VPN server is setup so you don't need to worry about that.

 

[Ichinisan]

Ok i did a few tests.
It worked fine on Windows 7. I couldn't get it to work on Windows 10.

Thanks.

Maybe I should downgrade back to 8.1...

 

[rumpleforeskin]

Check the the incoming connection is assigned a static address that is outside the DHCP range.

 

[Ichinisan]

Check the the incoming connection is assigned a static address that is outside the DHCP range.

Found a video that mentioned that. My client (iPhone) doesn't let me specify an IP address, but I configured the VPN server to assign from a range that is outside of my router's DHCP range (but in the same subnet). Didn't work.

Still, barking up the wrong tree there because the Win10 system doesn't even show anything listening on port 1723 when I did the netstat -a command.

 

[rumpleforeskin]

Found a video that mentioned that. My client (iPhone) doesn't let me specify an IP address, but I configured the VPN server to assign from a range that is outside of my router's DHCP range (but in the same subnet). Didn't work.

Still, barking up the wrong tree there because the Win10 system doesn't even show anything listening on port 1723 when I did the netstat -a command.

You would specify the fixed IP address on the incoming connection (last image in the 1st post) not on the iphone. Click properties for "internet protocol version 4"


I just tested on my win 8 machine and if I move the incoming connection IP address within the DHCP range it does not show up as listening in "netstat" so it worth a try.

Edit: sorry I just reread what you typed and see that you tried it and it did not work

 

[Ichinisan]

Well, I tested on 2 Windows 10 systems and neither of them show anything listening on port 1723 when I run netstat -a

Went through the same setup on a Windows 7 system and it worked perfectly fine. Did Microsoft break this with Win10? Any chance the functionality was intentionally limited or removed?

From the iPhone, I can connect to the Windows 7 test VPN over LAN or WAN (only with the default port number 1723). The iPhone could not connect to the Windows 7 test VPN through any alternate external port number. I configured several in the 4,000s and configured the iPhone with [wanIP]:[port], but it wouldn't connect. I don't know if that's a problem with my router or a limitation of the iPhone VPN client. Perhaps the iOS VPN client doesn't interpret the hostort syntax?

 

[Oceanas]

PPTP pass-through works by monitoring connections hitting 1723, which is only the control channel used to setup the tunnel which is using GRE. If you are using port forwarding to 1723, it's not going to work since your inbound packet is not going to 1723 at the router WAN port. To get around that, you would need to have a router which supported forwarding the GRE protocol to your VPN server.

 

[CZroe]

Then why did it work on Windows 7?

Edit: Nevermind. It sounds like he couldn't remap the port on Win7.

 

[mxnerd]

You probably have to restart Routing and Remote Access service or restart PC.

I set up PPTP server in Windows 10 like you and in Services it shows "Routing and Remote Access" is running but when netstat -a is run port 1723 is not listening.

After I restarted the service port 1723 shows up in netstat -a command.

===========

Sorry, just saw your post #10 saying you restarted the PC.

Oh, well.

 

[Ichinisan]

You probably have to restart Routing and Remote Access service or restart PC.

I set up PPTP server in Windows 10 like you and in Services it shows "Routing and Remote Access" is running but when netstat -a is run port 1723 is not listening.

After I restarted the service port 1723 shows up in netstat -a command.

===========

Sorry, just saw your post #10 saying you restarted the PC.

Oh, well.

Thanks. I came across this myself by chance earlier today, but I had to leave and couldn't do any further testing.

I got that after I did this:
- disabled all network interfaces
- went into registry and deleted stored network profiles (I didn't like seeing a "2" on the end of it)
- enabled the Ethernet wired interface again
- on a hunch, tried creating the VPN server again, which finally gave me that error message

I checked and saw that the service was disabled.

 

[mxnerd]

Glad you sorted it out.

 

[Ichinisan]

Yup. It's working fine now -- except I really didn't want to use the standard port 1723 without some kind of encryption.

 

[Ichinisan]

Any idea why the "Routing and remote access" service would stop for no reason?

My devices were unable to connect to my home VPN for a while. I noticed the "incoming connections" icon was missing from Network Connections. I noticed the "routing and remote access" service was not running, so I started it. The "incoming connections" icon reappeared in Network Connections and my client devices can connect again.