Troubleshooting VPN passthrough for Home Routers

VPN is a way to connect two secure networks over the Internet — for example a home network and one in a business. It needs special equipment or software at both ends.

The term "VPN passthrough" on routers means that the equipment does NOT support one of the endpoints, but only that it allows traffic from those endpoints to "pass through". All NETGEAR routers support VPN passthrough for IPSec, PPTP and L2TP. To create one of these endpoints, see What is VPN?.

This article applies if you were already connected with VPN, but installing a NETGEAR router stopped your VPN from working.

NETGEAR routers with VPN passthrough are intended to work without modification, however sometimes troubleshooting is necessary to localize a problem.

List of routers and their VPN connections. If your router supports 0 VPN terminators, you need other equipment or software besides the router.

To Troubleshoot VPN passthrough

Any of these steps may solve the problem:

1. If your equipment supports NAT-T (NAT Traversal), turn it on.
2. Contact your network administrator to understand details of how you need to configure your VPN software. (Common software is Cisco NAT-T and NETGEAR ProSafe).
3. If your company uses L2TP passthrough, register your computer's MAC address with your company's system adminstrator. The address is found on the bottom label of the router,
4. Upgrade to the latest router firmware.
5. Turn port forwarding for the VPN ports: 50, 51, (and 500, for IPSec VPN's). Turn on port 1723 for PPTP VPN's- used for PPTP control. Turn on port 1701 for L2tp- L2tp routing and remote access.
6. By default the router's firewall is configured to drop (delete) ICMP packets sent from outside your network to the WAN port. Your VPN may require the ICMP packets. To accept them:
   1. Log in to the router using a browser by typing http://192.168.0.1 or http://192.168.1.1.
   2. Type admin for the username and password for the password (unless you change the password from the default). Older routers use 1234 for the default password.
   3. Select WAN Setup > Advanced > Respond to Ping on Internet Port.
   4. Click Apply.

Doc: N101495.asp July 1, 2005