I recently "upgraded" to the FIOS G3100 Router from the FIOS Quantum Router (due to a move) and can no longer VPN to my work network. Below is a summary of the issue from my IT department. Problem: Using and IPSec VPN connection to a Cisco firewall. After authentication, the firewall terminates the connection because the connection appears as a DoS attack. The logs show the following when connecting to the firewall: 2 Apr 06 2020 13:09:15 98.115.x.x x.x.x.x Deny IP teardrop fragment (size = 1480, offset = 0) from 98.115.x.x to x.x.x.x Basically, the firewall is interpreting the connection as TearDrop DoS attack. This works from other ISPs and the previous Fios connection. But under the new connection (and new router) the error occurs. Any thoughts or advice on how to allow the FIOS G3100 Router to VPN externally would be appreciated.

FIOS G3100 Router - External VPN Issues

Riplead

Hi! I'm having the exact same issue. Were you able to get this resolved?

Thanks,

John

Cang_Household

@Riplead wrote:
Hi! I'm having the exact same issue. Were you able to get this resolved?

Can you give us more details other than simply not working or not connecting?

What error messages are you getting?

SamerN

I am having the same exact issue. There must be something off with the firmware of these new routers.

I had both the older G1100 and the G3100 routers on hand at the same time so I was able to connect one router and test then remove it and try the same test with the other without changing anything on my laptop.

With the G1100, all is good. My VPN connects and I can access all the resources on the other network, or simply ping something in my office network.

But when I remove the G1100 and connect the G3100, My VPN still connects, but I just can't access any resources or ping anything in the office network.

For now the only way I can use my VPN is through a wired connection to the G3100 router. But obviously, that's annoying and I can't take my laptop anywhere in the house or VPN from my iPhone 😞

Verizon, please investigate this issue. There must be a bug in the G3100 firmware!!!!

Cang_Household

Hello SamerN.

I want to first mention that G3100 and G1100 are built completely differently by two separate manufacturers on two distinct platforms, so there is no meaningful comparison between the two.

To better assist you, can you tell us what type of VPN are you using? Since you said that the VPN can be connected, I am assuming the key exchange is fine. Have you checked whether your VPN requires static routing entries on G3100?

SamerN

My company uses Shrew Soft VPN Client software. Below is some of it's config and then the connection screen. Hope the attachment below works this time.

Update: sorry, in screenshot red text at bottom, last sentence, it should say "can't ping any internal..."

Cang_Household

Shrewsoft, humm...., it is a VPN client software EOL and EOS for a couple years now.

Anyway, when you bring up the tunnel, are you sure that the computer is routing all the traffic to the company router? If you ask Google what's my IP, does it display the company's IP? From my understanding of Shrewsoft and VPN, without tunnel splitting, all traffic is sent through the virtual adapter, encapsulated for security, and sent over the computer's actual adapter to G3100, then over the broadband to your company's VPN router. Your company's router would decapsulate the packet and decide to forward the packet to the internal LAN or to external resources.

I am thinking about the tunnel is not even brought up yet. This could be G3100 blocking the NAT-Traversal by default. You might want to view G3100's Firewall Log to see any alerts. To further troubleshoot, do you know how to use SSH?

Also, who sets up the Shrewsoft in the first place? I know its interface is a little tricky. Did you set it up?

Samsa

I have only a basic knowledge of networking and recognize you folks are on a higher level, so this suggestion for a workaround might be quite obviously ridiculous. If so, please be kind...

The OP said the VPN works on a wired connection to the Verizon router but not on a wireless connection. Have you tried connecting another wireless router to the Verizon router, turning off DHCP on the second wireless router and turning off both wireless radios on the Verizon router, then connecting wirelessly to the second router? Your laptop would still be getting its IP address from the Verizon router, but this might "fool" the Verizon router into treating your connection through the second router as a "wired" connection, since the second router is literally wired to the Verizon router.

Cang_Household

Yes. It should work as you described.

Update for the entire thread: a fix is on the way. VPN issue may be resolved in a future firmware update.

Cang_Household

Just for your information, VPN Fragmentation issue seems to be fixed in the latest firmware 3.1.0.12.

Users now does not need to use the Ethernet interface in order to connect to a remote IPsec VPN.