Plusnet Firewall issue

[#1]

Hi again.

I took my laptop out and tethered it to my iPhone. The VPN connected straight away. I was sort of hoping it wouldn't, because it might have been more straight forward to resolve.

So, i'm afraid it looks like the issue may well be within the PlusNet network...? 

i only ask about the routing becuase i found this thread - albeit it's old - in the forum - and wondered if it was relevant.

Fixed: VPN not working - Plusnet Community

[#2]

Hi Keith, ah that's disappointing.

It's a good shout, but in that example the IPs would be dynamic. I've never come across a static IP not play nicely with a VPN (or that may be vice versa), but there's a first time for everything. 

Upon further investigation, looking at our RADIUS records you weren't actually on a static IP before you bought one, based on the records I see in November and December last year, which suggests the firewall wasn't switched on then.

Would you be happy if I removed your static IP and put you on an IP of a dynamic range? This should render the firewall (if it's still enabled in the background) inoperable, and it'll also rule out an issue between the VPN and the static IP.

I can always assign you a new static IP and waive the one off £5 charge in this case if you'd want a static IP back in the future, though it likely won't be the same one as you've currently got as they're assigned automatically when we add it. 

If you're happy with me changing your IP, could you let me know by replying to the ticket I've logged Here? In the meantime, while trying to connect to the VPN, could you try running a traceroute to the remote endpoint and post up the results?

[#3]

hi Anoush. i've responded in the other ticket - yes please, put me back to a dynamic to test. (we might leave it there, im told the VPN client is no longer bothered about static addresses, they've implemented certificates and stuff to insure endpoints.

Here is the tracert to 51.143.231.233:

Tracing route to 51.143.231.233 over a maximum of 30 hops

1 3 ms 2 ms 2 ms amplifi.toa.lan [192.168.170.1]
2 82 ms 66 ms 18 ms 250.core.plus.net [195.166.130.250]
3 30 ms 29 ms 49 ms 84.93.253.83
4 174 ms 128 ms 57 ms core1-be1.colindale.ukcore.bt.net [195.99.125.132]
5 44 ms 30 ms 50 ms peer3-et-0-0-1.redbus.ukcore.bt.net [62.172.103.238]
6 149 ms 160 ms 84 ms ae64-0.lts-96cbe-1a.ntwk.msn.net [104.44.15.134]
7 142 ms * 41 ms ae25-0.icr01.lon22.ntwk.msn.net [104.44.239.101]
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.
19 * * * Request timed out.
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 * * * Request timed out.

Trace complete.

[#4]

Hi Keith,

Cheers and thanks for the traceroute. I've removed the static IP now.

Could you reboot your router and have a go at the VPN? Fingers crossed!

[#5]

Thanks Anoush... i'll need to wait until i get a break in usage, but will do it asap.

[#6]

No problem Keith, sounds like a plan

[#7]

looks the IP has refreshed automatically without a reboot... going to try the VPN now.

[#8]

and it worked first time...!

[#9]

Excellent! Could I add a static IP (free of charge) back to your account of a different range?

If the problem returns then it's likely the firewall is still active in the backend system, but if the problem doesn't return, then it may suggest some sort of odd behaviour between the VPN and that particular static IP you had.

[#10]

Yeah, its worth some testing I think.

I have, however, spoken to the various IT teams I work with, and they no longer - indeed they argue they never did - require static addresses... so it is possible that my need for one no longer exists.

However, I'm happy to help with some testing if it would be useful - it feels like you have a bit of an issue somewhere in the network that needs addressing.

So yes, if that helps you, go for it? (when we're done, though, i think going back to Dynamic is fine, too).

thanks, keith

[#11]

Cheers, I've added a static IP now and it's allocated one from a different range.

Happy to move you back onto a dynamic IP afterwards. Could you reboot and try your VPN? 

[#12]

Hi, can I please ask how close we are to a solution? It's over 2 months now and no real update on timescales.

Is turning the firewall on/off on request now an option for everyone?

Thank you 🙂

[#13]

Hi Keith,

I'm about to log off now for the weekend, but if you can't connect to the VPN after rebooting and you need it urgently before 9am on Monday when I'm back, feel free to post back here and one of my colleagues should be able to remove the static IP for you in my absence, depending on how busy we are.

I've also not got much planned, so I may log on as I work from home. Have a good weekend!

[#14]

---

@kissinuk wrote:
Hi, can I please ask how close we are to a solution? It's over 2 months now and no real update on timescales.

---

I've not got anything concrete to share I'm afraid, but we are actively working on the problem.

---

@kissinuk wrote:
Is turning the firewall on/off on request now an option for everyone?

---

I'd have loved this to be viable workaround, but unfortunately from the experience here, it doesn't actually appear to turn the firewall off in the backend system, so the workaround may very likely cause further issues elsewhere. 

I'm keeping a close eye on @keithdw's account. 

[#15]

Thank you 🙂