FTP and RDP through OpenVpn

paullus

I have openvpn setup between two networks, everything works except FTP and RDP to Windows server 2008 (VPC on VMWare).
OpenVPN server works on Windows server 2008 R2.
Client - openSUSE.
MTU set to 1100 on client and server:

server.conf
mtu 1100

>netsh interface ipv4 show subinterfaces

MTU MediaSenseState Bytes In Bytes Out Interface
------ --------------- --------- --------- -------------
4294967295 1 0 16104 Loopback Pseudo-Interface 1
1500 1 370540332366 31767739920 Local Area Connection
1500 5 0 0 Local Area Connection 2
1500 5 0 0 Local Area Connection 3
1500 5 0 0 Local Area Connection 4
1500 1 78 1317294 VMware Network Adapter VMnet1
1500 1 156 1324762 VMware Network Adapter VMnet8
1100 1 547060397 888289463 Local Area Connection 5(ovpn)

client

client.conf
mtu 1100
tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.98.6 P-t-P:192.168.98.5 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1100 Metric:1

When I'm trying to access ftp it return only first line of welcome message:

220 - ****************\r\n

instead of

220 - ****************\r\n
220 - ****************\r\n
blah blah

DNF flag is set for this packet but full size of it is 826 which is less than MTU size.
What about RDP it not working only to Win2008R2, for example on WinXP it works.

B00k3r_D3w1tt

As far as the RDP issues goes, it sounds more like a RDP issue than a VPN issue. What I mean by that is since you can connect to the XP machine and not the 2008 machine, it sounds like the RDP client you're using does not support Network Level Authentication (since that 'feature' didn't exist in XP). Try this, open System Properties on the 2008 machine and go to the Remote tab, then change it to "Allow connections from computers running any version of Remote Desktop" and see if you can connect. If you can, then you know that the client you're using isn't compatible with Network Level Authentication. Sounds like you're running Linux on the client, try out Remmina - that's what I use with my Debian machine and it works fine with Network Level Authentication.

With regard to the FTP issue, why would you need to VPN in to access an FTP server, is it not public facing? By the way FTP is pretty terrible when it's behind a NAT, what I mean is when you connect to the server and it's behind a NAT the client sends the initial request over port 21 and then the second request (not very technical, sorry) goes to a seemingly random port this is also called "passive mode". So you have to open a pretty big range of ports to the FTP server (if it's behind a NAT). For me I set the minimum port range to 49152 and the maximum to 65534 so I had to open all those ports in the router for this IP address (I did a 1:1 NAT) so that I could connect. Does your FTP server support SFTP? If so, I would try to connect with that instead since all the traffic will go over port 22.