<html>
<body>
Well, of course, changing the router is a better solution. I'm
looking for a solution that, while perhaps not as good, works with the
DG834.<br><br>
Howard<br><br>
<br>
At 12:27 AM 3/9/2011, Alexis La Goutte wrote:<br>
<blockquote type=cite class=cite cite="">Hi,<br><br>
The DG834 don't support the Aggressive Mode, there is only expected for
VPN Site@Site<br>
Change the router is the better solution !<br><br>
Regards,<br><br>
On Mon, Mar 7, 2011 at 9:14 PM, Howard Spindel
<<a href="mailto:howard@sci1.com">howard@sci1.com</a>> wrote:<br>
<dl>
<dd>Fabio,<br><br>
<dd>Don't know why I'd need Dynamic DNS for the laptop. The router
doesn't have to find the laptop - the laptop finds the router.<br><br>
<dd>I did look at the tutorial for the Netgear connection, but the DG834G
is very different from the tutorial and hard to map. The DG834G has
many fewer settings allowed than the tutorial's ProSafe router.<br><br>
<dd>I tried the specific suggestions you had, and it made no difference
that I can see. Still not getting through Phase 1.<br><br>
<dd>Really need a cookbook approach tailored to the DG834G here.<br><br>
<dd>Thanks,<br>
<dd>Howard<br><br>
<br><br>
<dd>At 11:31 AM 3/7/2011, Fabio Cigoj wrote:<br>
<dl>
<dd>Howard,<br><br>
<dd>If you have a fixed IP address on the router that's ok, but you
still<br>
<dd>need a dynamic DNS service for the laptop.<br>
<dd>I am a bit confused about the router as the Netgear website states
it's<br>
<dd>a VPn passthrough in one place and that it can support up to 5
endpoints<br>
<dd>somewhere else.<br>
<dd>Worth giving it a try anyway...provided your router supports Mode
Config<br>
<dd>for policy generation. One of the things I am sure of is that
Shrew<br>
<dd>talks to Netgear only if Mode Config is used.<br>
<dd>If that is not the case then a new router is in order.<br>
<dd>Did you take a look to the tutorial published on Shrew's website
for<br>
<dd>connections with Netgear hardware ? It is written for another
router,<br>
<dd>but shouldn't be too difficult to figure it out.<br>
<dd>Bear in mind that some things need to be followed exactly, one
is<br>
<dd>example is the authentication: pre shared key only does not work;
it<br>
<dd>needs to be PSK + XAuth.<br>
<dd>Another thing is that the exchange mode must be set to aggressive.
I<br>
<dd>tried main and it didn't work.<br>
<dd>Local gateway on the router is the local WAN IP, while for the remote
I<br>
<dd>used a the FQDN assigned to the laptop.<br>
<dd>Make sure the address range to assign to the clients is on a
different<br>
<dd>subnet than your LAN.<br>
<dd>DH group must be 2<br>
<dd>Encryption algorithm must be 3DES and integrity algorithm must be
SHA-1<br><br>
<dd>Wouldn't know what more to add without a clear view of router and
client<br>
<dd>configuration, but I think you have some more things to try
now.<br><br>
<dd>Cheers<br><br>
<dd>Fabio<br><br>
<br>
<dd>On 07/03/11 20:03, Howard Spindel wrote:<br>
<dd>> Fabio,<br>
<dd>><br>
<dd>> I shouldn't need a Dynamic DNS service as I have a static IP for
my<br>
<dd>> Netgear router.<br>
<dd>><br>
<dd>> So, how would I make this work with the DG834, and what
additional<br>
<dd>> software do I need? The Netgear config panels don't talk
about it being<br>
<dd>> a VPN pass-through - they make it sound like a VPN
endpoint.<br>
<dd>><br>
<dd>> If I'm going to have to buy a different router to make this
work, what<br>
<dd>> router do folks like? (I need it with a DSL modem built-in
too).<br>
<dd>><br>
<dd>> Thanks,<br>
<dd>> Howard<br>
<dd>><br>
<dd>> At 05:05 AM 3/7/2011, Fabio Cigoj wrote:<br>
<dd>>> Howard,<br>
<dd>>><br>
<dd>>> The DG834 is a VPN-passthough in first place, not a
VPN-endpoint,<br>
<dd>>> which would force you set up a VPN server.<br>
<dd>>> From my gatherings, collected from qualified people like the
author of<br>
<dd>>> Shrew, it seems that Netgear uses quite an old VPN stack,
but there<br>
<dd>>> are better and worse routers.<br>
<dd>>> I use a 338, which, far from being perfect for my needs is
a<br>
<dd>>> VPN-endpoint, I managed to make work in much a similar
config as the<br>
<dd>>> one you need.<br>
<dd>>> The trick is to register with a (free) dynamic DNS service
both your<br>
<dd>>> router and your laptop, so every time you connect to
internet the name<br>
<dd>>> of your machines has the correct IP address assigned. At
that point<br>
<dd>>> you can use the FQDN (fully qualified domain name) in the
VPN config.<br>
<dd>>> It looks complicated, but it is(n't)<br>
<dd>>><br>
<dd>>> Cheers<br>
<dd>>><br>
<dd>>> Fabio<br>
<dd>>><br>
<dd>>> On Mon, Mar 7, 2011 at 1:31 PM, Howard Spindel
<<a href="mailto:howard@sci1.com">howard@sci1.com</a><br>
<dd>>>
<<a href="mailto:howard@sci1.com" eudora="autourl">
mailto:howard@sci1.com</a>>> wrote:<br>
<dd>>><br>
<dd>>> In all likelihood, the laptop would
no be directly connected to<br>
<dd>>> the internet. I would be at the
mercy of whomever was providing a<br>
<dd>>> hot spot.<br>
<dd>>><br>
<dd>>> Is there no way to get that to
work?<br>
<dd>>><br>
<dd>>><br>
<dd>>>> Hi,<br>
<dd>>>><br>
<dd>>>> You
laptop is directly connected to Internet ? (no NAT).<br>
<dd>>>> Because
the NETGEAR DG834 support only the MAIN Mode... (and<br>
<dd>>>> the VPN
is buggy...)<br>
<dd>>>><br>
<dd>>>>
Regards,<br>
<dd>>>><br>
<dd>>>> On Mon,
Mar 7, 2011 at 11:32 AM, Howard Spindel<br>
<dd>>>>
<<a href="mailto:howard@sci1.com">howard@sci1.com</a>
<<a href="mailto:howard@sci1.com" eudora="autourl">
mailto:howard@sci1.com</a>>> wrote:<br>
<dd>>>><br>
<dd>
>>>
I'm trying to setup a VPN that will allow me to connect<br>
<dd>
>>>
in to my home network (with a Netgear DG834Gv4 facing the<br>
<dd>
>>>
internet) from a Windows 7 laptop.<br>
<dd>
>>>
Can anyone provide a cookbook for setting the Netgear VPN<br>
<dd>
>>>
settings and ShrewSoft VPN client that would enable the<br>
<dd>
>>>
two to connect? I've been tearing my hair trying all<br>
<dd>
>>>
sorts of combinations, but can't get anything to work.<br>
<dd>
>>>
The VPN trace on the Win 7 laptop shows three attempts to<br>
<dd>
>>>
send phase1 packets before it hits "resend limit exceeded<br>
<dd>
>>>
for phase1 exchange" and aborts.<br>
<dd>
>>>
I am a computer programmer with 30 years experience and<br>
<dd>
>>>
lots of networking experience, but I can't figure this<br>
<dd>
>>>
one out!<br>
<dd>
>>>
Thanks,<br>
<dd>
>>>
Howard<br>
<dd>
>>>
Netgear policy page looks like this right now:<br>
<dd>
>>>
Remote VPN Endpoint: Dynamic IP address<br>
<dd>
>>>
Local LAN: IP address is set to my local subnet<br>
<dd>
>>>
Remote LAN: IP address is set to "Single PC - no subnet"<br>
<dd>
>>>
IKE direction: responder only (only choice allowed)<br>
<dd>
>>>
Exchange mode: Main mode (only choice allowed)<br>
<dd>
>>>
DH group: auto<br>
<dd>
>>>
Local ID type: WAN IP address<br>
<dd>
>>>
Remote ID type: FQDN<br>
<dd>
>>>
Encryption algorithm: 3DES<br>
<dd>
>>>
Authentication algorithm: auto<br>
<dd>
>>>
Using a pre-shared key for authentication<br>
<dd>>>><br>
<dd>>>><br>
<dd>
>>>
_______________________________________________<br>
<dd>
>>>
vpn-help mailing list<br>
<dd>
>>>
<a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a>
<<a href="mailto:vpn-help@lists.shrew.net" eudora="autourl">
mailto:vpn-help@lists.shrew.net</a>><br><br>
<dd>
>>>
<a href="http://lists.shrew.net/mailman/listinfo/vpn-help">
http://lists.shrew.net/mailman/listinfo/vpn-help</a><br>
<dd>>><br>
<dd>>><br>
<dd>>><br>
<dd>>>
_______________________________________________<br>
<dd>>> vpn-help mailing list<br>
<dd>>>
<a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a>
<<a href="mailto:vpn-help@lists.shrew.net" eudora="autourl">
mailto:vpn-help@lists.shrew.net</a>><br>
<br>
<dd>>>
<a href="http://lists.shrew.net/mailman/listinfo/vpn-help">
http://lists.shrew.net/mailman/listinfo/vpn-help</a><br>
<dd>>><br>
<dd>><br>
<dd>><br>
<dd>><br>
<dd>> _______________________________________________<br>
<dd>> vpn-help mailing list<br>
<dd>>
<a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a><br>
<dd>>
<a href="http://lists.shrew.net/mailman/listinfo/vpn-help" eudora="autourl">
http://lists.shrew.net/mailman/listinfo/vpn-help</a><br><br>
</dl><br><br>
<br>
<dd>_______________________________________________<br>
<dd>vpn-help mailing list<br>
<dd><a href="mailto:vpn-help@lists.shrew.net">vpn-help@lists.shrew.net</a>
<br>
<dd>
<a href="http://lists.shrew.net/mailman/listinfo/vpn-help" eudora="autourl">
http://lists.shrew.net/mailman/listinfo/vpn-help</a><br><br>
</dl></blockquote></body>
<br>
</html>