SBS 2011 VPN, pfSense and Zerotier

1

Hi all

So we have taken over management of a business with their IT! New client, New server quote gone in for replacement in January and we are slowly inputting a pfsense box. pfSense is due to be fully installed in the next 2 weeks (best time for the business and downtime).

So right now we have no VPN capabilities through pfSense, however the MD of the business uses VPN which at the moment is through the SBS 2011 server - for some reason the service is very slow for him, he’s browsing the network through mapped drive using in built Windows 10 VPN client - it’s been fine until recently, nothing has changed. Internet speed fine at both ends!

I was trying to get him in via Zerotier as a temporary solution until we get pfSense in with OpenVPN - I have got ZT installed on the Server, which works for all of say 2 minutes then it drops out - if you try to ping after restarting the ZT service the pingts work, then they drop off and you cant get a connection to the server at all via ZT - in the ZT control panel the server shows as online! I’d like to get this working as a temporary measure. The current router is an ISP supplied Technicolor with UPNP turned on.

Any advice on either to fix the VPN through SBS or getting ZT working?

Thanks in advance

2

Since you don’t have pfsense fully working sound list the firewall is dropping the connections, you can try opening up some ports.
https://zerotier.atlassian.net/wiki/spaces/SD/pages/6815768/Router+Configuration+Tips

3

Thanks Tom

I have pfSense connected and slowly moving roles to it such as DHCP and removing them form the serv, so until we can get complete downtime I can’t remove the Technicolor router and shuft the WAN over to pfSense.

I’ll have a look at openning 9333 as per that guide you linked to pointing to the Server to see if that will help resolve, funny thing is, ZT was working perfect on this server then all of a sudden stopped and we are now getting dropped pings.

4

I have not been able to get ZT working so have gone with WIreguard instead.