Unable to Establish VPN Connection

Brandix · July 2

I was recently setting up a VPN, and it turns out that when I used the wizard tool, it didn't work when executing the .bat file; it basically didn't establish a connection. I believe the problem is that the USG Flex 100 is not directly connected to the internet but to a router. Can anyone advise me on which ports or forwarding settings I should configure on the router for the VPN to work?

PeterUK · July 2

Yes correct you can get a DDNS and use Domain Name / IP instead of interface then disable/enable the VPN to make new config

or you can edit the .bat with the WAN IP

https://community.zyxel.com/en/discussion/comment/67099#Comment_67099

Brandix · July 3

https://community.zyxel.com/en/discussion/comment/67288#Comment_67288

Don't let me select the certificate

PeterUK · July 3

try without the wizard

Zyxel_Kay · July 3

Hi @Brandix

Could you let us know which VPN client you use to establish the VPN? Is it through SecuExtender?

Brandix · July 3

https://community.zyxel.com/en/discussion/comment/67341#Comment_67341

I tried, I charged the certificate but doesn't work

https://community.zyxel.com/en/discussion/comment/67347#Comment_67347

I'm connecting with the .bat

PeterUK · July 3

Ok with wizard put in "Domain Name / IP" your WAN IP this should make a certificate under auto.

Brandix · July 3

https://community.zyxel.com/en/discussion/comment/67356#Comment_67356

I already tried that before posting in the forum and it didn't work for me.

PeterUK · July 3

Ok its a bit of a problem more here

https://community.zyxel.com/en/discussion/comment/67360#Comment_67360

But I have worked out the problem

So you should have a VPN config with your WAN IP but it don't work good thats the one you want now go to system > Certificates make a note of the Certificate with your WAN IP then go back to VPN settings set Certificate to Manual and select the noted Certificate then set Domain Name / IP to 0.0.0.0 and now when the VPN client connects it will work

Zyxel_Kay · July 4

Hi @Brandix

If you want to set up an L2TP VPN behind NAT, you'll need to configure port forwarding on your primary router to allow VPN traffic to reach the USG Flex 100.

For more details, please refer to this discussion thread:

https://community.zyxel.com/en/discussion/675/how-do-i-configure-the-zywall-for-a-l2tp-server-behind-nat

PeterUK · July 4

Hi Kay

The problem is much more then port forwarding due to how simple the VPN setup is that is causes a problem when setting with auto Certificate.

So you use Incoming Interface WAN but that put the wrong IP in config and make a Certificate for like 192.168.2.2 and so the client will not connect so you would think for Incoming Interface set the WAN IP which make the config with the right IP and Certificate but you will get “policy match error” on the VPN client so you change the Incoming Interface to 0.0.0.0 but then this make a new Certificate with 0.0.0.0 and config to IP 0.0.0.0 which is wrong. So in order for it to work you must use the config with the Certificate of the WAN IP by Manually selecting it with Incoming Interface to 0.0.0.0 then it all works.

Unable to Establish VPN Connection

All Replies

Categories

Security Help Center