RTX1200 L2TP/IPSec 見えない
自宅のPCから、会社にある
YAMAHA のルータ RTX1200 に L2TP/IPsec でVPN接続しようとしているのですが、
RTX1200のルータまでは接続できて、
RTX1200 へのpingは通るのですが、
その先のＰＣにpingが通らず、またtracert コマンドで確認しても
RTX1200まではいくのですが、その先はタイムアウトします。
自宅PC ( IP : 192.168.0.51/24) (Win7 の標準のネットワーク接続でVPN設定)
|
|
[ルータ:NEC Aterm]
|
|
（ INTERNET ）
|
| WAN ( IP : DDNS )
[ルータ:NTT NXSM-4BRU-2] udp 500,1701,4500 転送。 192.168.1.254
| LAN ( IP : 192.168.1.1/24)
|
| LAN2 ( IP : 192.168.1.254/24)
[ルータ:YAMAHA RTX1200]
| LAN1 ( IP : 192.168.11.1/24 )
|
会社PC ( IP : 192.168.11.100/24 )
RTX1200 CONFIG ファーム REV.10.1.48
※テストのためフィルタを解除して全通し
---------------------------------------------
ip route default gateway 192.168.1.1
ip route 192.168.1.0/24 gateway dhcp lan2
ip route 192.168.11.0/24 gateway dhcp lan1 tunnel 11
ip lan1 address 192.168.11.1/24
ip lan1 ospf area backbone
ip lan1 proxyarp on
ip lan1 secure filter in 1099
ip lan1 secure filter out 1099
ip lan2 address 192.168.1.254/24
ip lan2 rip send on version 2
ip lan2 ospf area backbone
ip lan2 secure filter in 1099
ip lan2 secure filter out 1099
ip lan2 nat descriptor 1
ip lan2 proxyarp on
pp disable all
pp select anonymous
pp bind tunnel11
pp auth request mschap-v2
pp auth username [user-id] [password]
ppp ipcp ipaddress on
ppp ipcp msext on
ip pp remote address pool 192.168.11.51-192.168.11.59
ip pp mtu 1258
pp enable anonymous
no tunnel enable all
tunnel select 11
tunnel encapsulation l2tp
ipsec tunnel 111
ipsec sa policy 111 11 esp aes-cbc sha-hmac
ipsec ike keepalive use 11 off
ipsec ike local address 11 192.168.11.1
ipsec ike nat-traversal 11 on
ipsec ike pre-shared-key 11 text [公開キー]
ipsec ike remote address 11 any
l2tp tunnel disconnect time off
l2tp keepalive use on 10 3
l2tp keepalive log on
l2tp syslog on
ip tunnel tcp mss limit auto
tunnel enable 11
ip filter 1000 reject * * udp,tcp 135 *
ip filter 1001 reject * * udp,tcp * 135
ip filter 1002 reject * * udp,tcp netbios_ns *
ip filter 1003 reject * * udp,tcp * netbios_ns
ip filter 1004 reject * * udp,tcp netbios_dgm *
ip filter 1005 reject * * udp,tcp * netbios_dgm
ip filter 1006 reject * * udp,tcp netbios_ssn *
ip filter 1007 reject * * udp,tcp * netbios_ssn
ip filter 1008 reject * * udp,tcp 445 *
ip filter 1009 reject * * udp,tcp * 445
ip filter 1011 reject 192.168.11.0/24 * * * *
ip filter 1012 reject * 192.168.11.0/24 * * *
ip filter 1021 reject * * tcp * telnet
ip filter 1022 reject * * udp * tftp
ip filter 1030 pass * * icmp * *
ip filter 1031 pass * * established * *
ip filter 1032 pass * * tcp * ident
ip filter 1033 pass * * tcp ftpdata *
ip filter 1034 pass * * tcp,udp * domain
ip filter 1035 pass * * udp domain *
ip filter 1036 pass * * udp * ntp
ip filter 1037 pass * * udp ntp *
ip filter 1071 pass * * udp * 500
ip filter 1072 pass * * esp * *
ip filter 1073 pass * * udp * 500
ip filter 1074 pass * * esp * *
ip filter 1075 pass * * udp * 4500
ip filter 1076 pass * * udp * 4500
ip filter 1077 pass * * udp * 1701
ip filter 1078 pass * * udp * 1701
ip filter 1099 pass * * * * *
ip filter 5000 reject * * * * *
ip filter dynamic 10080 * * ftp
ip filter dynamic 10081 * * domain
ip filter dynamic 10082 * * www
ip filter dynamic 10083 * * smtp
ip filter dynamic 10084 * * pop3
ip filter dynamic 10098 * * tcp
ip filter dynamic 10099 * * udp
nat descriptor type 1 masquerade
nat descriptor address outer 1 primary
nat descriptor address inner 1 any
nat descriptor masquerade static 1 1 192.168.11.1 esp
nat descriptor masquerade static 1 2 192.168.11.1 udp 500
nat descriptor masquerade static 1 3 192.168.11.1 udp 1701
nat descriptor masquerade static 1 4 192.168.11.1 udp 4500
rip use on
ospf area backbone
ipsec auto refresh on
ipsec transport 1 111 udp 1701
syslog notice on
syslog debug on
tftp host any
dhcp service server
dhcp server rfc2131 compliant except remain-silent
dhcp scope 1 192.168.11.100-192.168.11.179/24
dns server 192.168.1.1
l2tp service on
