Problem with Vonage's V-Portal and Qwest's Actiontec M1000

Posts: 9 · New Forum Member Joined: Apr 07, 2008 Posts: 9

ed56 wrote:

I would try the solution on my last post . . . (we crossed here).

Set your gateway to 192.168.1.1 as well as the DNS. If that fails, I am soewhat at a loss.

from my set up, I can ping or access 192.68.55.xxx; 192.168.15.xxx or 192.168.100.xxx.

Up stream I also have a wireless access point connected to a hub that connects to the router. . . no problems.

Using your notation, my setup is the following:

M1000 modem/router 192.168.1.1 - - >Vonage (Wan by DHCP 192.168.1.2. LAN to Linux 192.168.15.1) - - > PC Firewall (WAN static 192.168.15.2, gateway 192.168.15.1)

If I understand you correctly, you are suggesting to change this to

M1000 modem/router 192.168.1.1 - - >Vonage (Wan by DHCP 192.168.1.1. LAN to Linux 192.168.15.1) - - > PC Firewall (WAN static 192.168.1.2, gateway 192.168.1.1)

Or is it PC Firewall (WAN static 192.168.15.1, gateway 192.168.1.1)? Or something different? To answer your last question, the PC firewall is currently nor blocking anything.

Posts: 831 · Vonage Forum Evangelist Joined: Jun 08, 2007 Posts: 831

If you are static on the WAN side of the Frewall PC use Gateway and DNS as 192.168.1.1 on the Lan side also use Gateway and DNS as 192.168.1.1 (you can use any DHCP OCTET you want for assigning IP adresses other than those ranges already assigned.)

Posts: 9 · New Forum Member Joined: Apr 07, 2008 Posts: 9

ed56 wrote:

If you are static on the WAN side of the Frewall PC use Gateway and DNS as 192.168.1.1 on the Lan side also use Gateway and DNS as 192.168.1.1 (you can use any DHCP OCTET you want for assigning IP adresses other than those ranges already assigned.)

I changed things as follows:

M1000 modem/router 192.168.1.1 - - >Vonage (Wan by DHCP 192.168.1.1. LAN to Linux 192.168.15.1) - - > PC Firewall (WAN static 192.168.15.2, gateway 192.168.1.1)

With this, the command

ping 192.168.1.1

from the firewall PC returns

PING 192.168.1.1 (192.168.1.1): 56 octets data
sendto: Network is unreachable
ping: sent 64 octets to 192.168.1.1, ret=-1
sendto: Network is unreachable

I get the same result if instead of assigning the 192.168.15.2 IP address to the firewall PC I assign 192.168.1.2 - the V-Portal box just refuses to route anything Sad

Posts: 831 · Vonage Forum Evangelist Joined: Jun 08, 2007 Posts: 831

Strange . . .since the vportal is assigned 192.168.1.2 from the M1000 modem/router , you should at least see it from the firewall PC.

Reviewing:
DSL assigns public IP to the M1000 modem/router for the WAN, Gateway and DNS.
M1000 modem/router = 192.168.1.1 LAN side and assigns 192.168.1.2 to the VPortal on the WAN side
The VPORTAL is 192.168.15.1 LAN side which assigns 192.168.15.2 to the PC Firewall on the WAN side.

Public IP - ->M1000 modem/router - >192.168.1.1 - - >192.168.1.2- - >Vportal - - >192.168.15.1 - ->192.168.15.2- - >PC Firewall - -> network

Looking at the Vportal's status, you probably see 192.168.1.1, ie the M1000 modem/router, as the gateway and DNS. Since the phone works this is where you woud be getting your connection information (DNS Gateway, etc.).

Since the Vportal seems to b not routing or perhaps blocking, I would chcek it's firewall log. Other than that, I am a bit at a loss as to what is happening. Also, there is a setting on Vportal that limits scanning opn both sides of the device:

Port Scan Detection
A port scan is a procedure used by computer hackers to determine what ports are open or in use on a network. Using this information the hacker can then attack the ports that are open and try to gain access to your LAN. This option detects and blocks port scan activity originating on both the LAN and the Internet. When the Blocked Connections option is selected on the Firewall Logs page and this option is selected, all port scan activity will be logged.

I would turn this OFF (if it is on) for testing.

Posts: 9 · New Forum Member Joined: Apr 07, 2008 Posts: 9

ed56 wrote:

Strange . . .since the vportal is assigned 192.168.1.2 from the M1000 modem/router , you should at least see it from the firewall PC.

Reviewing:
DSL assigns public IP to the M1000 modem/router for the WAN, Gateway and DNS.
M1000 modem/router = 192.168.1.1 LAN side and assigns 192.168.1.2 to the VPortal on the WAN side
The VPORTAL is 192.168.15.1 LAN side which assigns 192.168.15.2 to the PC Firewall on the WAN side.

The WAN address for the firewall PC is not assigned by the V-Portal. Rather, that address is hardcoded (static) in the firewall PC. The DHCP server capabilities in the V-Portal are turned off. I would have thought that this would make no difference...

ed65 wrote:

Public IP - ->M1000 modem/router - >192.168.1.1 - - >192.168.1.2- - >Vportal - - >192.168.15.1 - ->192.168.15.2- - >PC Firewall - -> network

Looking at the Vportal's status, you probably see 192.168.1.1, ie the M1000 modem/router, as the gateway and DNS. Since the phone works this is where you woud be getting your connection information (DNS Gateway, etc.).

Since the Vportal seems to b not routing or perhaps blocking, I would chcek it's firewall log. Other than that, I am a bit at a loss as to what is happening. Also, there is a setting on Vportal that limits scanning opn both sides of the device:

Port Scan Detection
A port scan is a procedure used by computer hackers to determine what ports are open or in use on a network. Using this information the hacker can then attack the ports that are open and try to gain access to your LAN. This option detects and blocks port scan activity originating on both the LAN and the Internet. When the Blocked Connections option is selected on the Firewall Logs page and this option is selected, all port scan activity will be logged.

I would turn this OFF (if it is on) for testing.

I'll check this out. Thanks once more for your suggestions.

Posts: 831 · Vonage Forum Evangelist Joined: Jun 08, 2007 Posts: 831

"The DHCP server capabilities in the V-Portal are turned off. I would have thought that this would make no difference..."

I agree, should not make a difference.

The Vportal should be at 192.168.15.1 and the Firewall PC (WAN side) should be at 192.168.15.2. The DNS and the Gateway on the Firewall PC LAN and WAN side should point to 192.168.1.1.

Don;t forget to check the DHCP Client Status on the Vportal. We are assuming is is:

IP Address : 192.168.1.2
Subnet Mask: 255.255.255.0
Router IP Address : 192.168.1.1
DNS Servers:

Posts: 9 · New Forum Member Joined: Apr 07, 2008 Posts: 9

ed56 wrote:

"The DHCP server capabilities in the V-Portal are turned off. I would have thought that this would make no difference..."

I agree, should not make a difference.

The Vportal should be at 192.168.15.1 and the Firewall PC (WAN side) should be at 192.168.15.2. The DNS and the Gateway on the Firewall PC LAN and WAN side should point to 192.168.1.1.

Don;t forget to check the DHCP Client Status on the Vportal. We are assuming is is:

IP Address : 192.168.1.2
Subnet Mask: 255.255.255.0
Router IP Address : 192.168.1.1
DNS Servers:

I have just tested again. The values for the V-Portal are the ones that you mention above, with the addition that the primary DNS server is 192.168.1.1.

I changed the firewall PC's configuration so that its IP address is 192.168.15.2, its net mask is 255.255.255.0 and its gateway is 192.168.1.1. Again, this does not work. When bringing up the network after these changes in the firewall PC, at some point the following command is executed:

route add default gw 192.168.1.1 metric 1

This fails with "SIOCADDRT: Network is unreachable". If instead I use 192.168.15.1 then the route gets installed OK, and both the M1000 and the V-Portal are reachable from the firewall PC. But, with this, I have the netsurfing issues I described in my first post.

I am not overly network savvy, but I find it intuitively reasonable that the route command above does not work. The firewall PC is physically connected to the V-Portal, which is in turn physically connected to the M1000. Is it not the case that the route command must work with addresses that are directly accessible? I mean, any packets for the M1000 (and the Internet) must necessarily travel through the V-Portal first - which is why I thought it should be the firewall PC's gateway.

Well, I am very confused.

Posts: 831 · Vonage Forum Evangelist Joined: Jun 08, 2007 Posts: 831

I think you are making progress. If using the linux gateway command to 192,.168.15.1 gives you connetivity, then I would simply set the DNS to the same address, I think maybe in your etc. file on Linux?

The resaon I think there is still a DNS issue is that your connectivy is mostly via cached dns and https does not usually cache.

Posts: 9 · New Forum Member Joined: Apr 07, 2008 Posts: 9

ed56 wrote:

I think you are making progress. If using the linux gateway command to 192,.168.15.1 gives you connetivity, then I would simply set the DNS to the same address, I think maybe in your etc. file on Linux?

The resaon I think there is still a DNS issue is that your connectivy is mostly via cached dns and https does not usually cache.

Things seem to work, at long last! But, there have been two major changes since my last message. First, I got my ISP to change my feed so I get a static IP address, instead of a dynamically allocated one. Second, my ISP told me that I can use either PPPoE or PPPoA. So I changed to PPPoA and the problems I reported seem to be gone.

I think this last change was the winner, for during all my testing my M1000 stayed with the same IP address throughout. If that's the case, I wonder what it is that the bloody PPPoE is doing to mess with my secure connections?

Anyway, I'll have to make sure over the next few days that things are fine, before proclaiming victory.

Posts: 831 · Vonage Forum Evangelist Joined: Jun 08, 2007 Posts: 831

Not sure why the difference but congratulations!

Glad to hear the problem is resolved.