VPN Server with Two-Router Local Network

Discussion in 'Mac OS X Server, Xserve, and Networking' started by flyer05, Sep 12, 2011.

  1. flyer05 macrumors newbie

    Jul 20, 2011
    I just got a Mac Mini Server 2011 to set up as a home server. One of the main features I want to use is a VPN so I can access my files on my local network when I'm away from home. I live in Japan and I have a Japanese optical connection to the internet that runs through two boxes before I can use it in any form: some sort of modem, and a "gateway" which I literally just found out is also acting as a router and serving DHCP addresses. In addition, I have a 2TB Time Capsule that, until just recently, I had been using in the "Share a Public IP" mode because I didn't realize the gateway was also issuing DHCP addresses. I cannot simply plug my TC into the modem in place of the gateway - both are required to access the internet.

    Until today I had both routers using DHCP on the local networks they each created. Under that environment, I had finally configured Lion Server to file share (easy), manage network accounts (moderate), and serve Profile Manager (difficult). But despite my best efforts at mapping the ports on the Time Capsule, I just couldn't get the ports open using tools like canyouseeme.org, so the VPN was a no-go. That's when I realized the gateway could be a router too, so with some creative google searches, and extensive use of google translate, I was able to figure out how to open ports on the gateway. It does it pretty differently from the Time Capsule and other routers I've seen. It asks you define the host on the LAN (what i assume to be the target IP), the protocol (TCP vs. UDP), and then a range of ports for it to open. I plugged in the IP of the Time Capsule, opened all the UDP ports (since it was an option to just open all, and I figured 1) the TC would still protect my network and 2) it would just be a test), but I still couldn't see the ports as being open.

    So then I got desperate, and I switched the TC back to Bridge Mode, reconfigured the Server and my MBP (my client Mac) to the new IP addresses being served by the Japanese gateway, and tried again. I think I reconfigured the DNS settings in Server Admin properly to account for the change in IP, and then updated the services in Server.app, but now I can't even get to my server homepage (the apple placeholder page) using either its IP or its .private domain, and to make matters worse, I STILL can't seem to get the ports open (yes, I changed the port mapping to send it directly to the server IP as the target after the change).

    To add insult to injury, the wired ethernet connection I had been running from my TC to the MM Server is now reporting a cable unplugged (it's not), even when I plug it directly into the gateway, though I am able to connect wirelessly.

    Does anyone have any idea what's going on? Why can't I get these ports open? (By the way, I called my ISP and they said they aren't blocking any of the ones I'd want to use for VPN.)
    What is the *better* set up - using the TC as a second LAN, serving its own DHCP addresses, or using it in Bridge mode?
    Why did these changes sever my wired connection?

    I was getting even more problems (like loss of internet connectivity on all devices) using the TC in bridge mode, so I decided to go back to the dual network setup.
  2. jcgomez macrumors newbie

    Sep 19, 2011
    did you figure this out? I have a similar problem and cannot see my server.
  3. windowpain macrumors 6502a

    Apr 19, 2008

    I think I have a similar setup to you.
    If I am not totally mistaken, it should be possible to set up the router that the isp gave you to be in bridge mode, that way you can configure everything with the TC.

    I am using an airport extreme to serve DHCP addresses to my local network, and can access back to my mac etc with no problem at all.
    I was also have double NAT problems (which I think you are too.)

    Its been a while since I did it, but I think you need to access the router that the isp gave you and disable everything, i.e. delete all the boxed and remove all the numbers etc. this forces it into bridge mode.
    I use the AE to connect by PPoE. (with the account name and password the isp gave me.)

    I am far from an expert with this stuff, and configuring everything in Japanese isn't easy..hard enough in English.
  4. dampfdruck macrumors member

    Oct 20, 2008

    it's actually quite simple.

    The first box from your ISP is most likely an ONT. You can leave it untouched.

    The second box from your ISP is your residential gateway. This is the important box. You must be able to log into the box and make changes. On this box, you have to forward the ports/protocols for your VPN. Look for "source nat" configuration. You may also setup dyndns so you can find your home box when on the road.

    Your timecapsule must operate as a layer 2 device.

Share This Page