TomatoUSB

I've run through the following guide - http://tomatousb.org/tut:configuring-a-pptp-vpn and it's working fine within the LAN.

However when accessing from via the WAN (Using 3g) I can see the packets getting dropped in the logs.

My tomatousb router is setup using DHCP for the WAN interface which is passed to it from an ADSL modem in half bridge mode.

I've tried a few ways of allowing the traffic using iptables but cannot figure out why it's being blocked:

user.warn kernel: DROP IN=vlan2 OUT= MAC=48:5b……… SRC=121.90.xxx.xxx DST=124.xxx.xxx.xxx LEN=64 TOS=0x00 PREC=0x00 TTL=52 ID=46875 DF PROTO=TCP SPT=51305 DPT=1723 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (02040582010303020101080A224E956F0000000004020000)

Help!

I had the exact same problem. I removed /opt/etc/config/vpn.fire and put the script below in Administration => Scripts => Firewall.
After a reboot everything worked fine.

#!/bin/sh
MAX_VPN_CLIENTS=10

iptables -A INPUT -p gre -j ACCEPT
iptables -A INPUT -p tcp —dport 1723 -j ACCEPT

I=0
while [ $I -lt $MAX_VPN_CLIENTS ]; do
IF=ppp$I
iptables -A INPUT -i $IF -j ACCEPT
iptables -A FORWARD -i $IF -j ACCEPT
let $((I=I+1))
done

I had this same problem too - including the dropped [rejected] packets and working on the LAN but not the WAN. I tried Pirmin's script, but it did not work for me.

I finally go it working with this vpn.fire script. This is the original script with 4 lines added….

#!/bin/sh
iptables -A INPUT -p tcp —dport 1723 -j ACCEPT
iptables -A INPUT -p gre -j ACCEPT
iptables -A INPUT -i ppp+ -j ACCEPT
iptables -A FORWARD -i ppp+ -j ACCEPT
iptables -A FORWARD -o ppp+ -j ACCEPT

iptables -t nat -I PREROUTING -p tcp —dport 1723 -j ACCEPT
iptables -I INPUT -p tcp —dport 1723 -j ACCEPT
iptables -I INPUT -i ppp+ -j ACCEPT
iptables -I FORWARD -i ppp+ -j ACCEPT

I had the same problem. By now it appears that many people are suffering from this document. It badly needs to be updated. I tried updating it but I do not have enough privileges.

Anyway, I tried Pirmin's solution first. It did not work. Chuck's solution works!

I remember having issues with this and then just giving up. I edited the tutorial with Chuck's updated firewall rules. Hopefully this will make this much less frustrating for people.

I've spent a bunch of timing trying to figure this out and haven't been able to get the firewall issue resolved. With my setup the login attempt to port 1723 is being dropped. I did find that the double dash was a problem but even after fixing that it's still not working. I'm unfortunately unsure of what other posters mean when they say that their configuration works on the LAN. I don't understand how that is supposed to work with a VPN. Anyway, I think I'm abandoning the PPTP and going to openvpn with the gui. I just have to figure out how to make the certs and keys.

It's very easy to solve:
In GUI just add the following line into Administration => Scripts => Firewall

iptables -I INPUT 1 -p tcp —dport 1723 -j ACCEPT
Save and reboot your device.

It will permit incoming packets to pptp service port.

Have a nice day!