Re: DM200 and VPN link

Brewmeister62 · ‎2020-01-28

We are currently running a DM200 modem \ router in modem \router mode coupled with a Ubiquiti Amplifi HD mesh network in bridge mode. Everything worked fine until recently when my wife could no longer log on to her work server via a VPN connection. It allows her to sign in to the VPN but then nothing happens. Her companies tech support is blaming either our ISP, the modem or the router. The ISP is blaming the VPN and I've reset everything here from scratch and I'm now tearing my hair out!! Being not really techy, I was wondering if the DM200, might now be blocking the connection in some way?? Any help much appreciated.

michaelkenward · ‎2020-01-29

Is this a well known VPN? Might help if you said what it is.

If this used to work, unless you have tweaked them the modem and router aren't likely to have done anything to change this.

You could see it putting the DM200 into modem only mode and the (unnamed) Ubiquiti Amplifi HD into router mode. The "routering" on the DM200 isn't likely to be as powerful. (I have one connected to an R7800.)

Then again, if it used to work, it is hard to pinpoint where the issue might be.

One thing to consider when troubleshooting is the boot order for the network.

Be sure to restart your network in this sequence:

Turn off and unplug the modem.
Turn off the modem router and computers.
Plug in the modem and turn it on. Wait 2 minutes.
Turn on the modem router and wait 2 minutes.
Turn on the computers.

Brewmeister62 · ‎2020-01-29

Hi Michael,
Thanks for coming back to me.
VPN is Endpoint Security.
All used to work just fine, the VPN was changed \ upgraded and since then, nada.
I've already tried, several times the re-boot sequence you suggest with no change. I've also hard reset everything and started from scratch.
Tried also changing the DM200 to modem only, also no joy (changed ok but no internet signal getting to Amplifi) and seems to be well documented on here that its notoriously difficult to get working that way, hence the Amplifi being in bridge mode.

Thanks again for coming back and any further suggestions, woul be most gratefully received.

michaelkenward · ‎2020-01-29

@Brewmeister62 wrote:
All used to work just fine, the VPN was changed \ upgraded and since then, nada.

It looks suspiciously like that is where the problem lies.

@Brewmeister62 wrote:
Tried also changing the DM200 to modem only, also no joy (changed ok but no internet signal getting to Amplifi) and seems to be well documented on here that its notoriously difficult to get working that way, hence the Amplifi being in bridge mode.

The Amplifi should be in router mode if the DM200 is modem only. Then you have to follow the restart sequence.

Brewmeister62 · ‎2020-02-08

Hi Michael,
Apologies for the silence, i've been waiting on a report from Ubiquiti which has now come through and tell me that all is good this end and the fault lies with the VPN.
So, now the battle begins again!!
Many thanks for your help and advice.

Nick

michaelkenward · ‎2020-02-08

I suppose that is some sort of progress. Not great having to grapple with so many different players.

Brewmeister62 · ‎2020-02-08

Michael, you'll never know how much aggro this has been. No-one taking ownership for the problem. However, Ubiquiti support is second to none and I would recommend them to anyone that was interested. Thanks again for your help.

michaelkenward · ‎2020-02-08

Next thing you know they will be blaming it on Coronavirus.

Brewmeister62 · ‎2020-02-08

Where I am it's probably Novichok!!!

arielXTX · ‎2020-03-25

Hey,

Same issue on my side - have this Modem too with some Netgear Router.

When I'm not connected to the VPN client (GlobalProtect by PaloAlto if this matters) everything works fine, once I connect the internet connection becomes super slow and everything hangs.
I reached out to our PaloAlto masters which saw my slowness and they checked the company firewall and it seems to be OK.

I connected to the Modem itself with RJ45 to be sure its not the router and the issue continues, I called the ISP which told me they don't block anything - I was sceptic so I changed ISP but the issue went on (so I came back to the previous one).

Now - I connected some old DLINK (modem + router) and poof - the issue disappeard - so, 99.9% it's the modem itself, now, checking for which configuration can cause this one.

Netgear support guys - what property can cause this super slowness?

michaelkenward · ‎2020-03-25

@arielXTX wrote:

Now - I connected some old DLINK (modem + router) and poof - the issue disappeard - so, 99.9% it's the modem itself, now, checking for which configuration can cause this one.

The DLink is a modem + router. What router were you using with the DM200?

How is the DM200 configured?

Out of the box it is has some limited router function. If you plan to use it with a router, then you should put the DM200 into modem only (bridge) mode.

Not doing this may be fine for many applications, with a router that sees the modem and responds accordingly, but there may be something subtle going on with the VPN.

This is all guesswork on my part. Just a hunch based on past experience.

arielXTX · ‎2020-03-26

@michaelkenward- Well, I got Netgear R6700, BUT - I connected to the Modem (which was on Modem only | Modem + Router modes) RJ45 itself and it's not working, so my thought was that if the Modem alone doesn't work, a router after can't help.

Yes - the plan is to connect is to this router.

Which configuration do you want me to share? basically I brought it back to defaults and same all same.

Can you point me to some specific configuration I can change and test it?

I'm the only from my office with this issue, so I believe its on my side.

Also, came across with this one - https://www.vpnfaqs.com/netgear-vpn-passthrough-problem/ will try later.

michaelkenward · ‎2020-03-26

@arielXTX wrote:

@michaelkenward- Well, I got Netgear R6700, BUT - I connected to the Modem (which was on Modem only | Modem + Router modes) RJ45 itself and it's not working,

It can't be on "Modem only | Modem + Router modes".

It will be one or the other.

You should set up the DM200 in Modem + Router mode.

When you are satisfied that it has established an internet connection, you can then change it to Modem only mode.

When you have got that working, set up the R6700 to work with the DM200.

@arielXTX wrote:

.my thought was that if the Modem alone doesn't work, a router after can't help.

Spot on there. The modem has to be working before you can do anything else.

killbox · ‎2020-06-02

I've experienced a similar issue to that reported. A Checkpoint Endpoint VPN won't work through the DM200 when in modem+router mode.

When using the DM200 in modem+router mode we can establish the VPN, but running a ping through the VPN yields a 50%+ packet loss, yes some get through. It's too low for any service to work though. Everything works fine when we switch it out with a Huawei HG658.

I've tried switching the DM200 to modem only. That fixes the VPN issue but then all streaming services stop working (netflix). That issue is reported here and elsewhere https://community.netgear.com/t5/DSL-Modems-Routers/DM200-modem-stopping-netflix/td-p. Again, if I switch the modem out everything works fine.

The rest of the network is Ubiquiti. Never had any problems before getting the DM200.

I have updated the DM200 to the most recent firmware v1.0.0.61.

michaelkenward · ‎2020-06-02

@killbox wrote:

I've tried switching the DM200 to modem only. That fixes the VPN issue but then all streaming services stop working (netflix). That issue is reported here and elsewhere https://community.netgear.com/t5/DSL-Modems-Routers/DM200-modem-stopping-netflix/td-p. Again, if I switch the modem out everything works fine.

In modem only mode, the DM200 does next to nothing. It is down to the router to manage everything else.

VPNs are generally painful. Routers have a hard time with them.

I'd go ask the people who made/support the router for help.

Also talk to the people behind the VPN. If this is an important feature, then it may be down to buying a router that is known to play nicely with that VPN.

One advantage of having a standalone modem it that it offers a huge choice of routers. Combined modem/.routers – DSL or cable – are famously hopelessly at many things, especially VPNs.

chilewi111yy · ‎2020-06-23

FWIW, I'm also having the same issue.

DM200 provided by CenturyLink, running latest FW, operating in Modem+Router mode

WiFi provided by Airport Extreme running in Bridge Mode

Can connect to my company's VPN, GlobalProtect, without issue, but then have zero internet access (all pings/traceroutes time out)

For grins and giggles, I tried disabling IPv6 filtering from Secure to Open, NAT filtering from Secured to Open, and toggling on 'Disable Port Scan and DoS Protection', but no change.

If I run my phone as a hotspot and connect, no issues.

Might try to pursuade CenturyLink to swap the modem with a newer model.

michaelkenward · ‎2020-06-23

Tried the DM200 in modem only mode and the Airport Extreme as a router?

The DM200 is not the fanciest router going. Basic. VPNs are not going to be a priority,

The choice of DSL modems is poor and shrinking. Check it out.

My inclination is to stick with the DM200 as a modem and to get a proper router that can handle the VPN.

For many reasons, DSL modem/routers are a bad idea – been there, done that – not least the limited choice and lack of support for alternative firmware that might support a VPN. Does the Airport Extreme work on that front?

chilewi111yy · ‎2020-06-23

Thanks for the comment.

IIRC, I tried this before and was unable to get this to run purely as a modem given the need for PPPoE authentication, which the Airport Extreme either won't do or I couldn't figure out, so was forced to run DM200 as Modem+Router. Apple has discontinued their WiFi router product line, so if CenturyLink can't provide a more modern modem+router, then I'll just replace the router.

michaelkenward · ‎2020-06-23

@chilewi111yy wrote:

...so if CenturyLink can't provide a more modern modem+router, then I'll just replace the router.

Never a good idea to rent or buy a device from an ISP.

Something strange is happening in the DSL modem world. Check the (high) prices and the (limited) range available.

Seems to be going the same way as cable devices, where the ISPs simply don't allow users to update firmware.

chilewi111yy · ‎2020-06-23

@michaelkenward wrote:
Never a good idea to rent or buy a device from an ISP.

Agreed. I've always provided my own modem in the past when using cable internet and now actually work for one of the primary cable MSOs (would have free Internet if I lived in my company's footprint!). I live with roommates, however, and inherited the existing CenturyLink setup/contract.