topic Re: DG8041W not forwarding IPSec vpn traffic in Broadband

DG8041W not forwarding IPSec vpn traffic

dw07dal — Wed, 11 May 2022 07:37:22 GMT

Hi,

I have a DG8041W with fibre 65 connection. I have a VPN server on LAN. I can connect to the VPN ok from the LAN. when I try to connect to the server from the internet the connection fails negotiation. I have allowed IPSec ports upd-4500 and udp_500 through the router.

The port forwading page specifies IPSec. But it looks like the router is either NATing IPSec, or its fragmenting the paclet, or its blocking ESP.

This VPN server log show udp packets with messages larger than udp packets.

The VPN connects fine on the LAN only difference is the connection is sourced from the WAN port now. The router is marketed as being IPSec forwarding capable, and has an option to allow IPSec.

I can connect to VPN server across the internet if I use cisco-force-udp on vpn client, but not traffic flows over the tunnel

How dp I speak to an engineer to resolve?

vpn server log

2022-05-09 03:36:08 Local7.Debug 10.10.10.10 2658: May 10 20:17:20.006: ISAKMP (0:0): received packet from 213.205.192.234 dport 500 sport 7344 Global (N) NEW SA
2022-05-09 03:36:09 Local7.Warning 10.10.10.10 2659: May 10 20:17:20.006: %CRYPTO-4-IKMP_NO_SA: IKE message from 213.205.192.234 has no SA and is not an initialization offer
2022-05-09 03:36:09 Local7.Warning 10.10.10.10 2660: May 10 20:17:20.018: %CRYPTO-4-IKMP_PKT_OVERFLOW: ISAKMP message from 213.205.192.234 larger (3424390) than the UDP packet length (80)

Re: DG8041W not forwarding IPSec vpn traffic

Anonymous — Wed, 11 May 2022 07:43:00 GMT

Hello,

I'm not aware of any specific issues with VPN and the Huawei Wifi hub. Has this worked previously? Have you tried factory resetting the router and then re-setting this back up again?

Thanks

Re: DG8041W not forwarding IPSec vpn traffic

dw07dal — Wed, 11 May 2022 07:56:20 GMT

Hi Michelle,

I hope you are doing well

Yes it works fine if I connect from the LAN, but fails from the internet. The router is seeing the traffic and starts negotiating a connection but it fails due to udp packet message and header length mismatch.

The only difference here is where I am connecting from. The LAN connection to the vpn server from the vpn client has to flow through the huawei LAN interface on wifi to get to the vpn server on the wired LAN port with a secondary ip on a seperate network to the vpn client LAN.

So the traffic path is the same only difference is the ports on the huawei which are traversed, that is the connection is now sourced from the internet and comes in the huawei WAN interface to get to the vpn server. instead of its LAN interface

the WAN port does NAT for portwarding to map the public to the private internal ip of the vpn server. But the huawei has no granular configuration options. only port-forwarding with nat combined.

does this huawei have a cli with more configuration options? I can not find any guides

Re: DG8041W not forwarding IPSec vpn traffic

Debbie-TalkTalk — Wed, 11 May 2022 08:01:54 GMT

Hi dw07dal

Thanks for your reply.

@KeithFrench are you able to help with this please?

Debbie

Re: DG8041W not forwarding IPSec vpn traffic

KeithFrench — Wed, 11 May 2022 08:09:17 GMT

Hi @dw07dal

The Huawei does block certain ports when it comes to port forwarding, there is no CLI interface. Perhaps you should try the very similar spec Sagemcom WiFi hub, as that does not block anything. If you would like to try that, please ask @Debbie-TalkTalk in your reply.

Re: DG8041W not forwarding IPSec vpn traffic

Debbie-TalkTalk — Wed, 11 May 2022 08:10:43 GMT

Thanks @KeithFrench 🙂

@dw07dal Would you like me to send a Sagemcom WIFI hub for testing?

Re: DG8041W not forwarding IPSec vpn traffic

dw07dal — Wed, 11 May 2022 08:18:55 GMT

HI Debbie,

Yes please

Re: DG8041W not forwarding IPSec vpn traffic

dw07dal — Wed, 11 May 2022 08:29:51 GMT

Hi Keith,

The reviews of this Sagemcom WiFi hub home hub dont look good. Have you got anything cisco?

CUSTOMER REVIEWS

Based on 4 reviewsWrite a review

An other load of CRAP Why dont Talk Talk give us something that is worth more money than they paid for it? I have been sick of them for years. Roll on the court case I have with them. TonyB.

Toiny Booker on Apr 09, 2022

TalkTalk Please give me something that works!

Report as Inappropriate

doesn't deliver

Simon Fogell on Jun 06, 2021

It drops out all the time and has poor coverage, this happens on multiple devices forcing a reboot of the unit. Really not helpful and useless for the home study/working world of 2021

Report as Inappropriate

Useless

Nav on Feb 15, 2021

It's necessary to keep re-booting as wi-fi signal drops. Ethernet works OK.
TalkTalk are hopeless.

Report as Inappropriate

poor

dean on Jan 02, 2021

this is a backward step for talktalk, it has no security, no parental controls and usb port

Re: DG8041W not forwarding IPSec vpn traffic

dw07dal — Wed, 11 May 2022 08:39:40 GMT

Hi Keith,

Have you got anything like this?

Cisco RV134W VDSL2 Wireless-AC VPN Router

https://www.cisco.com/c/en/us/products/routers/rv134w-vdsl2-wireless-ac-vpn-router/index.html

Re: DG8041W not forwarding IPSec vpn traffic

dw07dal — Wed, 11 May 2022 09:15:34 GMT

Hi Debbie,

Do you need any details?

Re: DG8041W not forwarding IPSec vpn traffic

Debbie-TalkTalk — Wed, 11 May 2022 09:17:49 GMT

Hi dw07dal

I can send the router to the address linked to the telephone number in your Community Profile, will this be ok?

Re: DG8041W not forwarding IPSec vpn traffic

dw07dal — Wed, 11 May 2022 09:22:53 GMT

Hi,

Debbie yes that will be fine

whats the ETA on delivery? its just I was told this huawei was coming in 2 days but took 2 weeks

Re: DG8041W not forwarding IPSec vpn traffic

Debbie-TalkTalk — Wed, 11 May 2022 09:25:59 GMT

Hi dw07dal

The router should take 24-48hrs to arrive.

Please can you also send me a Private Message to confirm the name on the account.

Thanks

Re: DG8041W not forwarding IPSec vpn traffic

dw07dal — Wed, 11 May 2022 09:59:04 GMT

Hi Debbie,

I can not send a private msg, i click your link and it takes me to 404 talktalk error page

I am on the phone to support but they say nothing is in the notes

Ive been logged out alsp

please advise

Re: DG8041W not forwarding IPSec vpn traffic

dw07dal — Wed, 11 May 2022 10:04:51 GMT

ok,

I called phone support because I couldnt message you, was logged, and my email was not recognised as though my account had been blocked.

I call support and tried to explain, I asked to speak to manager, I was put on hold, will the attendant went to get a manager then they hung up the phone

Ive been trying to sort this out for 3 hours now

Re: DG8041W not forwarding IPSec vpn traffic

Karl-TalkTalk — Wed, 11 May 2022 10:57:50 GMT

You should be able to send a PM now.

Karl.

Re: DG8041W not forwarding IPSec vpn traffic

KeithFrench — Wed, 11 May 2022 11:58:09 GMT

Sorry @dw07dal

If you read my signature you will find out that I am just a customer, therefore, I cannot supply you with anything. The Sagemcom has received a lot of firmware updates & most of the bugs that I have brought to the attention of the developers are now fixed. When reading reviews you must make sure which firmware version they are talking about & what are they trying to do with it.

Re: DG8041W not forwarding IPSec vpn traffic

dw07dal — Wed, 11 May 2022 16:24:32 GMT

Hi Keith,

I am sorry I didnt realise you will have to forgive me.

I thought I was talking to talktalk support. Usually providers have their own engineers that provide technical support to their customers, I did not realise that talktalk customers provide the technical support fpr talktalk. All the talktalk resources on the web direct you here for support even the automated call agent.

You should be getting paid mate they have got you doing 3rd line technical support and made you head of marketing for free, paying you with community stars and badges

Re: DG8041W not forwarding IPSec vpn traffic

dw07dal — Wed, 11 May 2022 16:36:26 GMT

Hi Keith,

You maybe right about the firmware Im not sure.

But this negative review was posted 09 april 2022. How many firmware updates have been distributed since then?

CUSTOMER REVIEWS

Based on 4 reviewsWrite a review

An other load of CRAP Why dont Talk Talk give us something that is worth more money than they paid for it? I have been sick of them for years. Roll on the court case I have with them. TonyB.

Toiny Booker on Apr 09, 2022

TalkTalk Please give me something that works!

Re: DG8041W not forwarding IPSec vpn traffic

dw07dal — Wed, 11 May 2022 16:46:01 GMT

Hi Karl,

It takes me a compose your message page now but when I type debbie-talktalk nobody is found

see screen shot attached