Category: Networking

Social Wifi Hotspot Router Drives Traffic

While investigating ambient music service for a business through Pandora for business, found this incredible new way for businesses to socially connect with the users of their free WiFi service. With Social Wifi using the Mood WiFi router setup properly users will be taken to a portal page upon connecting to the free WiFi system. This portal page asks for them to login via Facebook, Twitter, Instagram account or email address then for those who connect with social media are asked to like the business they are connecting at to gain access to the internet. This system brilliantly allows business to track who is using their internet service and deeply connect with them via social media. I could easily see this as a huge benefit for any small retail store or restaurant wanting to expand their advertising dollar with a very small budget ($35 per month).

RDP Gateway NULL SID errors

Recently converted a client’s Windows Standard 2012 R2 terminal server into a Remote Desktop Protocol (RDP) Gateway server so that remote users could connect to their workstations inside the corporate network. (The details of how to do this properly will follow soon in another post.) Once the setup was completed it was time to test the connectivity as follows:

Testing RDP Connectivity

  1. Log into a remote workstation
  2. Open Microsoft Terminal Services Client (MSTSC)
  3. Type in the Computer name and User name into the General tab:
    Remote Desktop Connection - General Tab
  4. Click on the Advanced tab and then on the Settings… button.
    Remote Desktop Connection - Advanced Settings
  5. Choose Use these RD Gateway server settings then type in the external URL of the RDP Gateway
  6. Choose Bypass RD Gateway server for local addresses
  7. Choose Use my RD Gateway credentials for the remote computer then click OK
  8. Should then be able to click Connect to tunnel into that workstation

Issues with NULL SID as follows:

  • Getting errors during login process about inability to connect, noticed that it allowed for credentials at RDP Gateway but then failed when trying to login to local worksations.
  • Attempted to connect from machines without the KB2592687 and KB2830477 installed, but same errors occured.
  • Checked the event logs for the local workstation and found Event ID #4625 NULL SID errors. Which should have pointed to issues with authentication.
  • Tested NTLMv2 login issues via changing the following registry entry:

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] – LMCompatibilityLevel set above 3

  • Did the same thing via Group Policy using the following setting:

    Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options – “Network security: LAN Manager authentication level” set to Send NTLMv2 response only

  • Finally narrowed it down to NTP settings on the router not being set and mismatch of time.

Securing RingCentral via Juniper SRX

Recently wrestled with a Juniper SRX 220 router that a client needed help with securing RingCentral on. This entailed creating port forwarding rules for specific secure port ranges for TLS transport and linking those with rules for specific IP ranges belonging to RingCentral servers. Here are the specific lines of code that were used to make this connection possible (I am also throwing in the CoS settings used to shape traffic for good measure):

Setting to configure Juniper SRX for RingCentral

class-of-service classifiers dscp TRAFFIC_CLASSIFIER import default
class-of-service classifiers dscp TRAFFIC_CLASSIFIER forwarding-class PHONE_QOS_CLASS loss-priority low code-points 101110

class-of-service forwarding-classes queue 0 PHONE_QOS_CLASS
class-of-service forwarding-classes queue 1 Best_Effort_Class

class-of-service interfaces ge-0/0/0 scheduler-map WAN_SCHEDULE_MAP
class-of-service interfaces ge-0/0/0 unit 0 classifiers dscp TRAFFIC_CLASSIFIER

class-of-service scheduler-maps WAN_SCHEDULE_MAP forwarding-class PHONE_QOS_CLASS scheduler PHONE_SCHEDULER
class-of-service scheduler-maps WAN_SCHEDULE_MAP forwarding-class Best_Effort_Class scheduler BE_SCHEDULER

class-of-service schedulers PHONE_SCHEDULER transmit-rate percent 20
class-of-service schedulers PHONE_SCHEDULER buffer-size percent 20
class-of-service schedulers PHONE_SCHEDULER priority strict-high

class-of-service schedulers BE_SCHEDULER transmit-rate remainder

security alg sip disable

security policies from-zone Internet to-zone LAN policy RingCentral_IP1_NAT match source-address RingCentral_IP1
security policies from-zone Internet to-zone LAN policy RingCentral_IP1_NAT match destination-address any
security policies from-zone Internet to-zone LAN policy RingCentral_IP1_NAT match application RingCentral
security policies from-zone Internet to-zone LAN policy RingCentral_IP1_NAT then permit

security policies from-zone Internet to-zone LAN policy RingCentral_IP2_NAT match source-address RingCentral_IP2
security policies from-zone Internet to-zone LAN policy RingCentral_IP2_NAT match destination-address any
security policies from-zone Internet to-zone LAN policy RingCentral_IP2_NAT match application RingCentral
security policies from-zone Internet to-zone LAN policy RingCentral_IP2_NAT then permit

security zones security-zone Internet address-book address RingCentral_IP1 199.255.120.0/22
security zones security-zone Internet address-book address RingCentral_IP2 199.68.212.0/22

applications application RingCentral term Mobile_App_Media destination-port 4000-5000 protocol udp
applications application RingCentral term Phone_Registration_UDP destination-port 5060-6000 protocol udp
applications application RingCentral term Phone_Registration_TCP destination-port 5060-6000 protocol tcp
applications application RingCentral term RTP_SRTP_Softphone1 destination-port 8000-8200 protocol udp
applications application RingCentral term RC_Meeting_Signaling_UDP destination-port 8801-8802 protocol udp
applications application RingCentral term RC_Meeting_Signaling_TCP destination-port 8801-8802 protocol tcp
applications application RingCentral term RTP_SRTP_Deskphone destination-port 16384-16482 protocol udp
applications application RingCentral term RTP_SRTP_Softphone2 destination-port 20000-60000 protocol udp

This should be everything unless you have custom firewall filters to lock down management access or something else like that. Please feel free to contact us if you need any help configuring either your RingCentral account or Juniper routers or switches.

UmbreCrypt RansomWare Hits Terminal Server

This one scares me to read about. A new variant of ransomware called UmbreCrypt RansomWare is out there that is getting into business networks via hacking of terminal servers. This is even more reason to use the best practice of connecting to a Virtual Private Network (VPN) before connecting to your company terminal server. Please take the time to read this article from BleepingComputer.com to find out the frightening details. Feel free to call or email us to discuss how to proactively protect your business computer network with managed antivirus and offsite backups. Schedule a full network security audit to determine just how vulnerable your systems are and to determine what can be done to mitigate the risks.

ScreenConnect Remote Access Tool

I have had the privilege of using a new remote support tool called ScreenConnect which was recently acquired. This tool has all the major features of other remote support tools including a built in screen annotation feature and OCR capability that feeds into the built in research tool. Looking forward to training and trying all the features of this wonderful new software.

My Computer Shows Network Drive Red Xs

Kept getting calls from clients about their network drives “disappearing” or disconnecting throughout the day at “random” intervals, so after much troubleshooting found these steps to take on the workstations and file server to help alleviate the issue:

Network Drive Red Xs On the Workstation:

1. Click on Start button then choose Control Panel
2. In Control Panel open the Device Manager
3. Expand the Network Adapters and open each one used on that workstation
4. Look in the Power Management tab and Advanced tabs to look for any power settings that would disable the device then uncheck them. Click OK button and close all other windows.
5. Open the Registry Editor.
6. Expand the tree to the following key:

HKLM\SYSTEM\CurrentControlSet\Service\lanmanworkstation\parameters

7. If it doesn’t exist then create a REG_DWORD named KeepConn with the Decimal value of 86400 (aka 24 hours)
8. Reboot the workstation for changes to take effect.

Network Drive Red Xs On the Server:

1. Login as administrator
2. Open Command Prompt as administrator
3. Type in the following to disable Auto Disconnect of network drives:

net config server /autodisconnect:-1

4. Reboot the server for changes to take effect.

Configure Server 2012 VPN Connections

Here are the basics to configure Server 2012 VPN connections to the local network. This is preferred by Farmhouse Networking over a third party vendor software or router based solution because of its native functionality and integration with domain credentials – think Single Sign On (SSO) or one password to access it all.

Install the Routing & Remote Access Service (RRAS) Role

1. Start the Server Manager
2. Click Add Roles and Features from the Manage Menu
3. On Add Roles and Features wizard begins and click Next
4. Select the Role-based or feature-based installation option and click Next
5. If you have more than one server managed via the server manager console, then select the desired server you’d like to install Routing and Remote Access on
6. From the Roles lists select Remote Access, click Add Features on the popup window
7. Click Next
8. Click Next as no additional features are needed
9. Select DirectAccess and VPN (RAS), click Next
10. Click Next
11. Accept default selections and click Next
12. Click Install
13. When installation is completed, click Close

Initial Server 2012 VPN Configuration

1. From the Server Manager screen, click on the warning sign and click ‘Open the Getting Started Wizard’
2. On Configure Remote Access, click Deploy VPN Only.
3. From the Routing and Remote Access MMC, right-click on the server and click ‘Configure and Enable Routing and Remote Access’
4. Click Next on the wizard
5. Select Custom Configuration
6. Select VPN access
7. On completion, click Finish
8. Click Start service to start the RRAS, then wait for the service to startup.

Add IPv4 IP Address Range

1. From the Routing and Remote Access MMC, right-click on the server and click ‘Properties’
2. Under properties screen click IPv4 tab, select Static address pool, click Add and enter the desired IP address range on the windows popup
3. Click OK to close

Open Ports on Network Firewall

For compatibility, here are the ports to open for both Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Tunneling Protocol (L2TP) on the network firewall:

500, 1701, 1723 & 4500

Need to open IP Protocol 47 also on the router to allow PPTP Passthrough.

(Note: On SonicWall routers, you will need to create address objects for internal / external IP addresses, service group containing all the above ports, NAT rule for PPTP traffic and firewall rule allowing the service group from the external to the internal IP address.)

Enable Remote Access for users

Open the properties of a domain user account via Active Directory Users and Computer MMC. Click on Dail-in, under Network Access Permission click Allow access

If your company is in need of a robust and simple to use Windows Server 2012 VPN connection to your LAN resources, then contact us for assistance.

Command Line Configuring TCP/IP Addressing

Recently had an issue where a client needed to have their IP address statically assigned and the thought came to mind that my Remote Monitoring software was able to give me command line access, so I thought I would try configuring TCP/IP addressing via the command line interface and not have to interrupt the end users work. Here is how to get it done:

netsh interface ip set address name="Local Area Connection" static [static IP] [subnet mask] [default gateway] 1

That gets the IP address, subnet mask and default gateway – so what about static DNS? Here is the next step:

netsh interface ip add dns name="Local Area Connection" addr=[DNS address #1]

netsh interface ip add dns name="Local Area Connection" addr=[DNS address #2] index=2

If your company need remote assistance or help planning / maintaining / configuring TCP/IP addressing in your network infrastructure, then contact us for assistance.

Test SMTP Connectivity via Telnet

Had issues recently with another tech setting up a SMTP relay to Google Apps that didn’t work correctly and during the process of correcting their setup there came a need to test SMTP connectivity. Time to use a telnet connection to the SMTP server over port 25 method to test via my favorite telnet/ssh/console program PuTTY:
1. Open PuTTY and type in the Host Name of the SMTP server.
2. Choose Connection type of Telnet and change the Port to 25 then click the Open button.
3. Type EHLO [hostname] and then press ENTER.
4. Type MAIL FROM:[authorizeduser@domain.com] and then press ENTER.
5. Type RCPT TO:[anotheruser@domain.com] and then press ENTER.
6. Type DATA and then press ENTER. You will receive a response that resembles the following:

354 Start mail input; end with .

7. Type Subject: [Test Subject] and then press ENTER.
8. Press ENTER. RFC 2822 requires a blank line between the Subject: header field and the message body.
9. Type [Test Message Body] and then press ENTER.
10. Press ENTER, type a single period character and then press ENTER. You will receive a response that resembles the following:

250 2.6.0 Queued mail for delivery

11. To disconnect from the destination SMTP server, type QUIT and then press ENTER. You will receive a response that resembles the following:

221 2.0.0 Service closing transmission channel

12. Check the [anotheruser@domain.com] mailbox to see if the message arrived successfully.

This allows testing of the connection without end user intervention or the creation of a test account to send from. If there is SMTP authentication or encryption then there are other commands that will need to be entered.
If your company is in need of help troubleshooting or needs to test SMTP connectivity on your email servers, then contact us for assistance.

CenturyLink Bonded ADSL PPPoE Connection

This was one of the most exasperating things that I have worked on in some time. The client got a bonded ADSL PPPoE connection from CenturyLink with 40Mbps Up by 2Mbps Down. The PPPoE was to authenticate the connection to CenturyLink.

Reconfigure the Technicolor C2000T modem into Bridged Mode

  • Login to the modem and click on the “Wireless” button

  • Disable the wireless completely and click on the “Apply” button

  • Click on the “Advanced” button then click on the “DHCP Settings” along the left hand menu

  • Disable DHCP completely and click the “Apply” button

  • Click on the “WAN Settings” and change the ISP Protocol to “Transparent Bridging” then click on the “Apply” button

  • Reboot the modem and move on to configuring the Juniper router

Configure the Juniper SRX 210 for the Bonded ADSL PPPoE connection

Enter the following commands on the router CLI:

  • Set the underlaying interface encapsulation to be PPP-Over-Ethernet:

    set interfaces ge-0/0/0 unit 0 encapsulation ppp-over-ether

  • Set PPP Options with Authentication method CHAP:

    set interfaces pp0 unit 0 ppp-options chap default-chap-secret YOUR-PASSWORD
    set interfaces pp0 unit 0 ppp-options chap local-name YOUR-USERNAME
    set interfaces pp0 unit 0 ppp-options chap no-rfc2486
    set interfaces pp0 unit 0 ppp-options chap passive

  • Set the PPPoE Options to the underlaying interface along with connection options:

    set interfaces pp0 unit 0 pppoe-options underlying-interface ge-0/0/0.0

  • Set the the pp0 interface to automatically negotiate the IP address:

    set interfaces pp0 unit 0 family inet negotiate-address

  • Set the security zone pp0.0 interface WAN (untrust):

    set security zones security-zone WAN interfaces pp0.0

  • If you are experiencing any fragmentation issue, you may want to adjust the tcp-mss setting as below, this was the part that I left out and had random websites not connecting:

    set security flow tcp-mss all-tcp mss 1300

    • If your company is using a Juniper JunOS router or CenturyLink Bonded ADSL PPPoE connection to the internet, then contact us for assistance.

Archives

Categories

Plant a Seed @ 541-761-9549
233 Rogue River Hwy #873 Grants Pass, OR 97527
Mon-Fri: 9:00am-5:00pm
support@farmhousenetworking.com
© 2016-2025 - Farmhouse Networking. All rights reserved
Terms and Conditions Privacy Policy

Evaluation Signup

Error: Contact form not found.

And God will generously provide all you need. Then you will always have everything you need and plenty left over to share with others. As the Scriptures say,
“They share freely and give generously to the poor. Their good deeds will be remembered forever.”
For God is the one who provides seed for the farmer and then bread to eat. In the same way, he will provide and increase your resources and then produce a great harvest of generosity in you. - 2 Corinthians 9:8-10