How to get around blocking ports 1701 500 4500?

Question

Network administration

The provider blocks the GRE protocol, it is checked, although they deny it in those support.
Therefore, instead of OpenVPN, l2tp + ipsec was raised.
But, apparently, the provider blocks ports 1701 500 4500
Is it possible to bypass the blocking and how?

Answer 1

OpenVPN doesn't seem to use GRE. It has udp port 1194 . Defined in the server config.
GRE is PPTP VPN port 1723 and protocol 47 itself. In your case, you need to use OpenVPN. It will pass in any case.

Answer 2

Bypassing the GRE restriction is not so easy - you can’t mask it with anything (well, except inside . Another problem here is that the provider itself may not know that it is blocking it. There you need to do a lot of tricky gestures to encapsulate gre / ipip inside pptp, for example,
PPTP within PPTP also doesn't work with default server configs, and don't forget that GRE /
ipip requires a white address assigned to you (right on the machine's interface).
, routers that can do this are marked with vpn-passthrough.)
Well, one of the options is to pass GRE through what in itself is a "different" L2. For example, through Hyperboria.

Answer 3

Solved the problem in the following way.
bought an asus rt-n10u router black
installed ddwrt firmware on it with a built-in openvpn client
on a remote server raised openvpn server
registered certificates in the client on the router
set mtu 1440
added rules to iptables on the router
iptables -I INPUT 2 -i tun0 -j ACCEPT
iptables - I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j
ACCEPT

Answer 4

First of all: the provider does not block GRE, but there is a known problem with the operation of GRE through NAT: https://ru.wikipedia.org/wiki/GRE_(%D0%BF%D1%80%D0...
I.e. if the provider gives you (or your router) a gray IP, then GRE (and PPTP with it) is unlikely to work.As
was correctly noted earlier, OpenVPN and GRE are unrelated things.OpenVPN should have worked. it was possible to solve the problem by replacing / flashing / reconfiguring your router, then the problem was not on the side of the provider.