APLawrence.com -  Resources for Unix and Linux Systems, Bloggers and the self-employed

A simple mistype

© October 2006 Anthony Lawrence


Kerio makes a nice firewall that includes VPN capabilities - server to server or client to server. These are usually very easy to set up and very trouble free.

Ahh, there's always the exception, isn't there? Yesterday I had a customer with three sites and the KWF firewall at each. I set up the VPN between two of the sites quickly, and then jumped in my car to set up the third.

Actually, the VPN was established and working soon after I got there and powered up the machine. That wan't a problem at all, but none of the client machines on the network worked.

The odd thing that should have clued me to the problem instantly was the observation of how the machines worked with Internet Explorer. If, for example, I typed in "https://aplawrence.com", IE would tell me that it was trying to contact - but that was the end of it, and nothing would be in the Kerio logs bocking my access, no record at all, in fact. That should have told me what the problem was, but I missed it, and went off on a wild goose chase looking at switches and relacing the nic card, and redoing traffic rules.. no help.

Eventually I gave up and called in Kerio Support. They were equally puzzled for a long enough period to make me feel a little better for my struggles, but eventually they did spot the problem: the gateway in the DHCP server config (within KWF) was mistyped in the second octet: what should have been "243" was "143".

That explains the odd behavior: the DNS was correct, so the client could resolve names to ip's, but then it went to the wrong gateway to get the data. Stupid, stupid, stupid because I should have realized that. If you think about the symptoms logically, that's the only reasonable possibility: vpn works, access from the firewall machine itself works, clients get their DHCP address and DNS correctly but can't get out - gateway problem HAS to be the issue!

Now: I wasn't the one who mistyped the gateway. The customer had done that. I was the one who didn't CHECK that it was done correctly, so I took responsibility and did not charge for the excess time. That upset my wife ("it wasn't your fault") but I felt I should have found it more quickly, so that's the way it is. Some times you just have to eat the time, and I felt this was one of those circumstances.

Got something to add? Send me email.

(OLDER)    <- More Stuff -> (NEWER)    (NEWEST)   

Printer Friendly Version

-> A simple mistype

Inexpensive and informative Apple related e-books:

Take Control of Pages

Take Control of High Sierra

Are Your Bits Flipped?

Digital Sharing Crash Course

Take Control of OS X Server

More Articles by © Anthony Lawrence

Printer Friendly Version

Have you tried Searching this site?

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us

Printer Friendly Version

Be respectful to your superiors, if you have any. (Mark Twain)

Linux posts

Troubleshooting posts

This post tagged:


Unix/Linux Consultants

Skills Tests

Unix/Linux Book Reviews

My Unix/Linux Troubleshooting Book

This site runs on Linode