Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Mountain Lion Server VPN for home use

I

irishv

macrumors regular
Original poster
Oct 27, 2008
141
76
Can someone help me through the process of setting up a VPN for external access? I currently have a Mac mini serving as an HTPC. I have my own domain with a subdomain pointed to my home IP. My router has a few select ports open, which it forwards traffic to the mini (VNC, SSH, etc). My goal is to close all of that out and just have a VPN connection to get into the network.

I just purchased the mountain lion server app. While I plan to play with some other features (wiki server, profile manager, calendar server), the main goal is VPN so I can securely VNC into the box. I ran the setup and configured the server as private. I turned on the VPN service and was able to connect my iphone to it on the local network. What steps are needed now to connect remotely? Are there specific ports I need to forward from the router? I would assume there are different connection settings I need to make on the client devices as well.
 
S

switon

macrumors 6502a
Sep 10, 2012
636
1
RE: VPN ports...

irishv said:
Can someone help me through the process of setting up a VPN for external access? I currently have a Mac mini serving as an HTPC. I have my own domain with a subdomain pointed to my home IP. My router has a few select ports open, which it forwards traffic to the mini (VNC, SSH, etc). My goal is to close all of that out and just have a VPN connection to get into the network.

I just purchased the mountain lion server app. While I plan to play with some other features (wiki server, profile manager, calendar server), the main goal is VPN so I can securely VNC into the box. I ran the setup and configured the server as private. I turned on the VPN service and was able to connect my iphone to it on the local network. What steps are needed now to connect remotely? Are there specific ports I need to forward from the router? I would assume there are different connection settings I need to make on the client devices as well.
Click to expand...

Hi irishv,

Depending upon what flavor of VPN you wish to use determines exactly what ports you need to forward through your router. If you are using an Apple router, then the VPN setup should open the appropriate ports for you. If not, then you need to open and forward UDP 1701 for L2TP or TCP 1723 for PPTP, TCP and UDP 3283, 5900 for Remote Management, UDP 4500 if using L2TP IKE NAT, and UDP 500 if using L2TP ISAKMP/IKE. Basically, I'd start with forwarding 1723 if using PPTP or 500, 1701, 4500 if using L2TP. Then you might add 3283 and 5900 if VPN didn't initially work.

Also make sure your firewall is not blocking VPN connections.

Regards,
Switon

P.S. By the way, you can't use both VPN and Back to My Mac at the same time, as they conflict on their use of ports.
 
Last edited:
mus0r

mus0r

macrumors regular
Mar 27, 2005
229
0
switon said:
P.S. By the way, you can't use both VPN and Back to My Mac at the same time, as they conflict on their use of ports.
Click to expand...

Sorry to hijack, but what about using ARD? Does that interfere? If so, I would have to use the VPN to use ARD over VPN, rather than just connect over the internet?
 
S

switon

macrumors 6502a
Sep 10, 2012
636
1
RE: ARD and ...

mus0r said:
Sorry to hijack, but what about using ARD? Does that interfere? If so, I would have to use the VPN to use ARD over VPN, rather than just connect over the internet?
Click to expand...

Hi mus0r,

ARD uses some of the same ports as VPN (plus others) and thus will potentially also conflict with the wide-area bonjour (wide-area zeroconf or mDNS-like) that Back to My Mac uses. Since I don't use ARD myself, I can't give any specific examples of this possible conflict (an ARD specialist or the ARD documentation may answer this question). But since ARD is Apple's administration tool, they may have taken special steps for it not to conflict. On the other hand, as you suggest you could VPN to your local network and then ARD or VNC (Screen Share) or even run the Server.app from there.

Good luck,
Switon
 
mus0r

mus0r

macrumors regular
Mar 27, 2005
229
0
switon said:
Hi mus0r,

ARD uses some of the same ports as VPN (plus others) and thus will potentially also conflict with the wide-area bonjour (wide-area zeroconf or mDNS-like) that Back to My Mac uses. Since I don't use ARD myself, I can't give any specific examples of this possible conflict (an ARD specialist or the ARD documentation may answer this question). But since ARD is Apple's administration tool, they may have taken special steps for it not to conflict. On the other hand, as you suggest you could VPN to your local network and then ARD or VNC (Screen Share) or even run the Server.app from there.

Good luck,
Switon
Click to expand...

Thanks for the reply! There seems to be no conflict with BTMM and ARD, specifically. As a matter of fact, I will often use the Bonjour network scan to find my computer being shared via Apple's BTMM wide-area service. It shows in the scan as an absurdly long MAC address, rather than an IP. Works just fine. I just sometimes want to use either ARD or VPN, but it seems I can't do both. That seems to be due to the conflict you mention earlier. I will have to stop BTMM on my Mini, turn VPN on and use ARD that way.

Thanks!
 
I

irishv

macrumors regular
Original poster
Oct 27, 2008
141
76
switon said:
Hi irishv,

Depending upon what flavor of VPN you wish to use determines exactly what ports you need to forward through your router. If you are using an Apple router, then the VPN setup should open the appropriate ports for you. If not, then you need to open and forward UDP 1701 for L2TP or TCP 1723 for PPTP, TCP and UDP 3283, 5900 for Remote Management, UDP 4500 if using L2TP IKE NAT, and UDP 500 if using L2TP ISAKMP/IKE. Basically, I'd start with forwarding 1723 if using PPTP or 500, 1701, 4500 if using L2TP. Then you might add 3283 and 5900 if VPN didn't initially work.

Also make sure your firewall is not blocking VPN connections.

Regards,
Switon

P.S. By the way, you can't use both VPN and Back to My Mac at the same time, as they conflict on their use of ports.
Click to expand...

Thanks for the response. I am using a Time Capsule and set the server to manage it, so I assume that should take care of the port forwarding requirements. I was planning to use L2TP. From an external access perspective, I should be able to just forward my domain to my home IP and then use that address when setting up the client (in this case, my iphone).
 
S

switon

macrumors 6502a
Sep 10, 2012
636
1
Your TC and the Server.app...

irishv said:
Thanks for the response. I am using a Time Capsule and set the server to manage it, so I assume that should take care of the port forwarding requirements. I was planning to use L2TP. From an external access perspective, I should be able to just forward my domain to my home IP and then use that address when setting up the client (in this case, my iphone).
Click to expand...

Hi irishv,

Yes, the Server.app will automatically configure your TC to allow VPN through it to your server. The Server.app actually asks if it should do this, and you just answer yes and it will configure your TC for Internet access to your LAN.

Regards,
Switon

----------
mus0r said:
Thanks for the reply! There seems to be no conflict with BTMM and ARD, specifically. As a matter of fact, I will often use the Bonjour network scan to find my computer being shared via Apple's BTMM wide-area service. It shows in the scan as an absurdly long MAC address, rather than an IP. Works just fine. I just sometimes want to use either ARD or VPN, but it seems I can't do both. That seems to be due to the conflict you mention earlier. I will have to stop BTMM on my Mini, turn VPN on and use ARD that way.

Thanks!
Click to expand...

Thanks mus0r for the information. I'm glad that Apple designed ARD so that it didn't conflict with their BTMM service.

Switon
 
I

irishv

macrumors regular
Original poster
Oct 27, 2008
141
76
switon said:
Hi irishv,

Yes, the Server.app will automatically configure your TC to allow VPN through it to your server. The Server.app actually asks if it should do this, and you just answer yes and it will configure your TC for Internet access to your LAN.

Regards,
Switon


Looks like my issue was at the domain level. Configuring my client to connect via the IP address seems to work fine. The issue seems to be with how my sub-domain redirects to that IP. Thanks for the help.
Click to expand...
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom