A simple mistype

Kerio makes a nice firewall that includes VPN capabilities - server to server or client to server. These are usually very easy to set up and very trouble free.

Ahh, there's always the exception, isn't there? Yesterday I had a customer with three sites and the KWF firewall at each. I set up the VPN between two of the sites quickly, and then jumped in my car to set up the third.

Actually, the VPN was established and working soon after I got there and powered up the machine. That wan't a problem at all, but none of the client machines on the network worked.

The odd thing that should have clued me to the problem instantly was the observation of how the machines worked with Internet Explorer. If, for example, I typed in "http://aplawrence.com", IE would tell me that it was trying to contact 64.226.42.29 - but that was the end of it, and nothing would be in the Kerio logs bocking my access, no record at all, in fact. That should have told me what the problem was, but I missed it, and went off on a wild goose chase looking at switches and relacing the nic card, and redoing traffic rules.. no help.

Eventually I gave up and called in Kerio Support. They were equally puzzled for a long enough period to make me feel a little better for my struggles, but eventually they did spot the problem: the gateway in the DHCP server config (within KWF) was mistyped in the second octet: what should have been "243" was "143".

That explains the odd behavior: the DNS was correct, so the client could resolve names to ip's, but then it went to the wrong gateway to get the data. Stupid, stupid, stupid because I should have realized that. If you think about the symptoms logically, that's the only reasonable possibility: vpn works, access from the firewall machine itself works, clients get their DHCP address and DNS correctly but can't get out - gateway problem HAS to be the issue!

Now: I wasn't the one who mistyped the gateway. The customer had done that. I was the one who didn't CHECK that it was done correctly, so I took responsibility and did not charge for the excess time. That upset my wife ("it wasn't your fault") but I felt I should have found it more quickly, so that's the way it is. Some times you just have to eat the time, and I felt this was one of those circumstances.

Comments?

More Articles by Anthony Lawrence - Find me on Google+

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.