Newbie help with VPN-1

[rasoftware]

I install VPN-1 Pro on Windows 2003.

I have two network cards with public and private address. I am able to access internet from the VPN-1 server, but my client behind the firewall with gateway of the Checkpoint can't access the net.

Do I need to enable routing and remote access on the 2003 box?

I have enabled NAT from inside to outside.

I notice there are no rules by default, does this mean traffic flow by default?

[ddarby1]

rasoftware,

you need to read up a bit on Check Point and Firewalls.

Most firewalls, unlike routers are paranoid by default, though some will allow inbound to outbound by default, but certainly not the reverse.

This means that there is an implicit deny at the bottom of the rule set (or access-list, etc.). If you have no rules, no traffic is allowed, except in CheckPoint's case, hidden 'Implied Rules' which are required to manage the firewall form the Managment Server.

Try starting by adding a Security Rule, which has Source; Any, Destination; Any, Action; Accept.

Depending on how your NAT rule is setup your client behind the Firewall should then be able to access the Internet.

If this does not work, post back here, but do try to find out this information for yourself.


In answer to your question, no you do not need to enable routing and remote access on the 2003 box.

[Sergej]

Originally Posted by ddarby1

In answer to your question, no you do not need to enable routing and remote access on the 2003 box.

Sometimes installation process do not enable Routing (via registry key). You need than go to regedit and do it by yourself. You can also check if it enabled.

In a registry editor, navigate to HKEY_LOCAL_MACHINE \SYSTEM\CurrentControlSet\Services\Tcpip\Parameter s

Check if the "IPEnableRouter" value is 1

[rasoftware]

Thanks, documentations seems a litttle thin on the ground.

i got it working by installing a policy and reinstalling checkpoint on the SecurePlatform, traffic is now flowing inside-outside.

Any useful links for getting started would be helpful.