Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    AT&T vpn client not abble to connect

    Scheduled Pinned Locked Moved Firewalling
    18 Posts 5 Posters 2.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      nikkon
      last edited by

      @NogBadTheBad:

      Are you trying to connect to an AT&T VPN ?

      If so, you shouldn't need to add any firewall rules, I don't when I connect to my place of works VPN services or our customers.

      I smell a double NAT going on here, is your WAN address in the RFC 1918 range ?

      Wish my speedtest was that good :(

      WAN address is ok. yes.

      pfsense 2.3.4 on Supermicro A1SRi-2758F + 8GB ECC + SSD

      Happy PfSense user :)

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        AGNC appears to be a standard IPSec client. It should work behind pfSense with only the default allow rules in place. No incoming ports should be required.

        Your packet capture does not show any IPSec traffic though. It looks like it's not actually trying to connect.

        Steve

        1 Reply Last reply Reply Quote 0
        • N
          nikkon
          last edited by

          when AT&T client starts it tried to connect to some peer servers and autenticate there.
          I will try another capture tonight from the client machine itself.

          pfsense 2.3.4 on Supermicro A1SRi-2758F + 8GB ECC + SSD

          Happy PfSense user :)

          1 Reply Last reply Reply Quote 0
          • N
            nikkon
            last edited by

            Here is the tcpdump from the client machine & pfsense in the same time.

            tcpdump.zip

            pfsense 2.3.4 on Supermicro A1SRi-2758F + 8GB ECC + SSD

            Happy PfSense user :)

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Hmm, seeing no UDP port 500 or 4500 traffic there at all. However it looks like it's failing before it ever tries to actually connect the VPN:

              NetClient   +I 05/23 21:41:38.885 1C5C: dbActionSendHTTPInternetProbe: HTTP internet probe is initiated. 
              NetClient   +I 05/23 21:41:38.885 29E0: SendHTTPProbeThread: sending probe to '32.112.50.131'. 
              NetClient   +I 05/23 21:41:38.893 29E0: SendRequest: HttpSendRequest failed with error 12029\. 
              

              You can see that traffic in the packet capture at the client. The response is:

              Expert Info (Chat/Sequence): HTTP/1.1 400 Bad Request\r\n
              

              However it looks like that is coming from Squid running in pfSense. Are you filtering that?

              I don't know where you took the pfSense pcap but it looks like the WAN side. If that covers the complete connection attempt those http probes are never leaving so it looks like Squid/Squidguard is filtering them.

              Steve

              1 Reply Last reply Reply Quote 0
              • N
                nikkon
                last edited by

                pfsense pcap is from the wan interface.
                yes I use squid + squidguard. I used it before…but i may have some different settings now.

                pfsense 2.3.4 on Supermicro A1SRi-2758F + 8GB ECC + SSD

                Happy PfSense user :)

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Ok, then try disabling Squid as a test or add your client to the by-pass list.

                  Steve

                  1 Reply Last reply Reply Quote 0
                  • N
                    nikkon
                    last edited by

                    problem 50% solved.
                    It's squid bloking the connection.
                    Now i need to figure out how to by pass it or allow this connection

                    pfsense 2.3.4 on Supermicro A1SRi-2758F + 8GB ECC + SSD

                    Happy PfSense user :)

                    1 Reply Last reply Reply Quote 0
                    • N
                      nikkon
                      last edited by

                      problem solved 100%
                      thank you for all hints & support

                      pfsense 2.3.4 on Supermicro A1SRi-2758F + 8GB ECC + SSD

                      Happy PfSense user :)

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Great.

                        Were you able to open only the AT&T connection test servers? Can you post the allowed IPs that worked for you and exactly where you added them?
                        That will help anyone else hitting this a lot.

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • N
                          nikkon
                          last edited by

                          like always…thinks that look super complicated are very simple  :-[
                          I just added local IP as exception in Squid:
                          Squid Proxy Server ->ACLs -> Unrestricted Ip's -> Added my AT&T client local ip.
                          Then everything worked as expected.

                          pfsense 2.3.4 on Supermicro A1SRi-2758F + 8GB ECC + SSD

                          Happy PfSense user :)

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            While that is a simple solution to be sure.. That is not the solution normally people would want..  They would want to be able to access the something that doesn't work through the proxy, while using the proxy for everything else.  Your solution is pretty much just turning off the proxy for that client.

                            The proper solution would be to setup the proxy not to proxy connections to that specific destination for the vpn..  the big question is what is the dest, netblock of all the different possible connections are needed.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • N
                              nikkon
                              last edited by

                              you're right!
                              this was just a simple & quick sollution. I will try to get more data and identify the real issue.

                              pfsense 2.3.4 on Supermicro A1SRi-2758F + 8GB ECC + SSD

                              Happy PfSense user :)

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.