University of Cambridge VPN issues (again)

[#1]

I need to work from home this morning and yet again, the VPN connection I need to establish isn't working.

(Previous topic here: https://community.plus.net/t5/Fibre-Broadband/University-of-Cambridge-VPN-connectivity-issues/m-p/15... )

This is the service I use: https://help.uis.cam.ac.uk/service/network-services/remote-access/uis-vpn

Other current issues:

1. Your website says there is a problem with my account when I log in to look at my account (I don't believe this)

2. Last night I was unable to watch HD IP TV via your youview box as it caused the broad band to drop out every 3mins or so.

3. I believe I'm paying for 80mb speed - currently according to speedtest.net on multiple devices, I'm getting 8mb today.

My IP address is currently - 80.229.163.146

[#2]

Hi @nec10 

There did seem to be some issue yesterday as there was lots of drop outs: 

Your router is currently syncing at 55Mbps; 

Test OutcomePass

Test Outcome CodeGTC_FTTC_SERVICE_0000

DescriptionGEA service test completed and no fault found .

Main Fault LocationOK

Sync StatusIn Sync

Downstream Speed55.0 Mbps

Upstream Speed15.8 Mbps

Appointment RequiredN

Fault Report AdvisedN

NTE Power StatusPowerOn

Voice Line Test ResultPass

Bridge TapNot Detected

Radio Frequency IngressNot Detected

Repetitive Electrical Impulse NoiseNot Detected

Cross TalkNot Detected

Estimated Line Length In Metres577.8

Upstream Rate AssessmentReasonable

Downstream Rate AssessmentReasonable

Interference PatternRegular Interference Observed on Week Days

Service ImpactRetrains Observed

Interference Duration Longest OccurrenceFrom20:00to20:30

Interference LocationUnknown

Interference Observed In Days0

Home Wiring ProblemNot Detected

Downstream Policing Discard Rate0.0

Customer Traffic LevelUpstream and Downstream Traffic Detected

TechnologyVDSL

Current 15Min Bin Retrains0

Last 15Min Bin Retrains0

Profile Name0.128M-80M Downstream 5dB, Retransmission High - 0.128M-20M Upstream, Retransmission Low

This is within the estimates provided for your circuit as per DSL Checker profile. 

Could you let us know that the error message you get when you try and log in is? 

Thanks, 

MoR

[#3]

Error was attached to original message, have attached to this reply as well.

Our network team says:

That’s inconvenient! I can confirm the Managed VPN is working, the following logs show my recent connection but none from you, so I suspect your ISP is blocking some / all the IPSec traffic to 131.111.2.22!

[#4]

Hi @nec10,

We fixed the issue last time by giving you a Static IP address. Has there been any recent changes from your side that could have caused this issue. Would it be possible to try and use the VPN on a different device to see if any different.

In terms of the connection, there definitely seems to be something out of place somewhere as we can see the disconnections from this end, although our tests aren't picking up exactly what's causing the issue so we will have to do some troubleshooting to start ruling things out. I'd recommend starting with basic checks here

And if that doesn't help the next thing would be to rule your internal wiring out by plugging the connection into your test socket which is under the faceplate of your master socket and seeing if the drops stop. This rules out internal wiring, face plates and extension sockets as being the cause. How to locate the test socket and set your connection into it can be found here

If the problem still persists from here we will go down the route of raising a fault, please click here and let us know once you've done the checks and raised the fault so we can progress it for you. - Faris

[#5]

OK, Even after paying for a static IP (which is supposed to be optimised for VPNs???) , the VPN issue is still ongoing!

So working with our network team, I've included two WireShark captures of it working (non plusnet network) and not working (on plusnet at home).

I don't have any wiring issues at home - it's all working normally apart from this.

The University of Cambridge VPN needs UDP port 500 and/or 4500 open to the University's VPN IP range (131.111.2.22 in my case).

If you take the two files I've attached, you will see that when on plusnet, the encrypted tunnel is never setup because it doesn't receive a reply - only 3 packets are sent before it stops working and times out. Compare that to  when it works normally on other networks.

Thanks,

Nick Cole

UIS

University of Cambridge

[#6]

@nec10 what results do you get for a traceroute to 131.111.2.22 ?

[#7]

Thanks for getting back to us @nec10 I'm sorry to see you're still experiencing problems. 

A static IP isn't something that's 'optimised' for VPNs, there are just some VPNs that don't play well with dynamic IPs. I'm noting that your broadband firewall is set to high which is likely going to be blocking a lot of ports.

I'd recommend amending the broadband firewall settings, if you're unsure how to do this there's instructions Here

Let us know how it goes.

I hope this helps.

[#8]

Setting the broadband firewall to "low" fixed it.

So it's the return packets from our end that were being blocked?

Our guys say they never saw anything at our end, so does it block outbound as well?

Thanks for your help 🙂

[#9]

@nec10 Excellent, I'm glad to see that worked. 👍

Unfortunately I don't know much about how the firewall works, I'd imagine it only blocks incoming ports. Looking at the 'blurb' next to the 'Low' setting of the firewall, it says "This is the only VPN (Virtual Private Network)-compatible firewall setting)."

It's odd that you've been able to use the VPN fine on a high firewall setting previously though.

It's good to see you're back in business now, feel free to let us know if there's anything else you'd need help with.