Hi Everyone

I'm stumped.

Here's my basic topology

LAN (192.168.*.*) - Server 2016 with 2 network cards running RRAS (192.168.1.1 and 10.0.0.2) - Vigor 2925 (10.0.0.1 and Internet address)

From the internet a client can connect to the RRAS VPN using SSPT fine. But I need Apple devices to connect so I'm also using L2TP (preshared key). These also connect fine.

However, Windows clients won't connect using L2TP (Preshared key) through the internet.

If I connect one of these Windows devices into the router using a 10.*.*.* address, it connects fine with L2TP or SSTP.

This leads me to think the router is somehow blocking the authentication.

On the router;
In VPN and Remote Access - Remote Access Control, none of the services are ticked.

NAT - Open Ports, ports 500(TCP/UDP), 4500(TCP/UDP) and I've even tried 1701 (TCP/UDP) are open to the servers 10.*.*.* address

Firewall - I've tried turning off Strict Security and Enabled 'Pass inbound fragmented large packets'. I've also tried disabling the call and data filters.

When I've checked the logs on the server, L2TP seems to authenticate but the username and password doesn't.

Any ideas???

PS.

I've also added a registry key change on the server to allow NAT-T. It makes no difference.

The LAN network card on the server doesn't have a Default Gateway but the external network card has the Default Gateway set to the router (10.0.0.1).

PPS

Alto tried disabling DoS on the router. Still no luck.

There's a Draytek article here: https://www.draytek.com/en/faq/faq-vpn/vpn.others/how-to-set-up-vigor-router-to-pass-through-vpn-tunnel/

and something I recently stumbled upon in my 2860's Telnet interface ...

Code:

Valhalla> srv nat ipsecpass ? %% srv nat ipsecpass [options] %% on : Enabled IPSec ESP tunnel pass-thru and IKE src_port:500 preservation. %% off : Disabled IPSec ESP tunnel pass-thru and IKE src_port:500 preservation. %% status : Check status. Valhalla> srv nat ipsecpass status %% Status: IPsec ESP pass-thru and IKE src_port:500 preservation is OFF. Valhalla>

Here's the current value;

GEV_Hull> srv nat ipsecpass status
%% Status: IPsec ESP pass-thru and IKE src_port:500 preservation is ON.

GEV_Hull>

I'm pulling my hair out!!!

I've also updated the firmware on the router to the latest version.