UPC vpn...is it possible ?

beer enigma

Ok so up until our router was replace four weeks ago I was able to VPN into work from home without issue. We use a Cisco client on the laptop and its click and connect.

We're on UPC/virgin broadband only, so it's the basic router with no tv. The router went and was replaced, but now although it connects, it drops after 30 seconds. I can Vpn through tether on my mobile.

I know virgin don't support VPN but is there something that blocks it on the latest routers & any way round ?

ED E

Most likely they moved you to DSLite, a new device triggers it. This screws with VPNs among other things. You need to request they turn it back off for your account.

beer enigma

ED E wrote: »

Most likely they moved you to DSLite, a new device triggers it. This screws with VPNs among other things. You need to request they turn it back off for your account.

Not quite sure what DSLite is, but will they not just say that Vpn not supported ?

ED E

Instead of giving you a regular IPv4 address they give you an IPv6 address then share your IPv4 with X other customers.

They know it causes havok for many users and will turn it off once you ask.

TallGlass

Andip wrote: »

Not quite sure what DSLite is, but will they not just say that Vpn not supported ?

VPN is not supported on UPC.

degsie

TallGlass wrote: »

VPN is not supported on UPC.

It is with an IPV4 IP address.

beer enigma

Ok excuse my ignorance ��

IPv4 IPv6 ?

As I said, I appreciate that UPC don't support VPN, I'm not a business, just on call and need to VPN into work. My question is that I was able to until the box was replaced recently, is there any way I can do this now without tethering, something has changed with the new box

Edit: background info, I live in Cork and have a UPC box which is quite happy to allow VPN , same box for two years, my VPN issue is from the place I rent in Dublin

ED E

TallGlass wrote: »

VPN is not supported on UPC.

They dont support you with VPN problems ≠ you can't use a VPN.

ED E

Andip wrote: »

Ok excuse my ignorance 🙄

IPv4 IPv6 ?

As I said, I appreciate that UPC don't support VPN, I'm not a business, just on call and need to VPN into work. My question is that I was able to until the box was replaced recently, is there any way I can do this now without tethering, so wing has changed

Basically when you first connected your new modem Virgins operations system stopped giving your modem a v4 address and gave it a v6 address. Your offices VPN works on v4(Most do!) and thus it gets confused.

You can't fix it until Virgin open their contact centre again in the morning.

degsie

Contact VM on the Talk To.. forum and request a change to IPv4 addressing.

beer enigma

ED E wrote: »

Basically when you first connected your new modem Virgins operations system stopped giving your modem a v4 address and gave it a v6 address. Your offices VPN works on v4(Most do!) and thus it gets confused.

You can't fix it until Virgin open their contact centre again in the morning.

Thanks for the explanation, edited my previous post in the meantime to say that from my home in Cork on UPC I can happily VPN, as I could from the place I rent in Dublin until they replaced the box. If I phone them asking for IPv4 what excuse can I use as if I mention VPN they won't dance.

degsie

Test by clicking on this link...

http://test-ipv6.com/

ED E

You just ask, see this thread:
http://www.boards.ie/ttfthread/2057282895

dub45

ED E wrote: »

You just ask, see this thread:
http://www.boards.ie/ttfthread/2057282895

But there is no guarantee that any customer will be left on an ipv4 address.

Originally posted by Virgin Media: Brian

To answer your further questions - as we mentioned, we reserve the right to change your connection specifics like your IP address if network maintenance or upgrades require this. That can happen without a bundle or an equipment replacement or change but if you see any issue with your connection we'll look into this with you.

If you're changed to IPv4 this may revert to IPv6 if further works require this but if that happens we can follow up with you.
An account cannot be "flagged" for IPv4 permanently.

In short - connection details can change, any network changes are tested before they're put in place to ensure they don't cause issues for you but if at any time those changes adversely effect your service we'll do everything we can to resolve it.

TallGlass

ED E wrote: »

They dont support you with VPN problems ≠ you can't use a VPN.

No. And if don't believe me go to the talk to forums. Connecting to VPNs is not allowed. Now in saying that you can connect to one. But it could void the contract.

ED E

TallGlass wrote: »

No. And if don't believe me go to the talk to forums. Connecting to VPNs is not allowed. Now in saying that you can connect to one. But it could void the contract.

Go ahead and quote that in terms yeah?

bk

TallGlass wrote: »

No. And if don't believe me go to the talk to forums. Connecting to VPNs is not allowed. Now in saying that you can connect to one. But it could void the contract.

I've been using my work Cisco VPN with UPC/Virgin daily for years, works perfectly.

Also I've never once heard of them even once disconnecting a customer for using one.

When they say it isn't supported, they simply mean that they won't give you technical support to get it working, but nothing stopping you using one. Pretty much the same for every ISP.

TallGlass

ED E wrote: »

Go ahead and quote that in terms yeah?

Section 12: Use of Virtual Private Network (VPN)
As stated above, the Virgin Media Services are for residential use only and we do not support the use of VPN. If we find you are using VPN we may instruct you to stop using it and you must comply with this request. This is in order to prevent problems with our network and other Internet users.

Again as I said it's not allowed but a blind is turned to it.

ED E

I suspect thats targeted at hosts, but thanks for tracking it down.

Good thing mine is unintelligible from HTTPS traffic

TallGlass

ED E wrote: »

I suspect thats targeted at hosts, but thanks for tracking it down.

Good thing mine is unintelligible from HTTPS traffic

Yup I have worked with two companies and never any issues. I suppose they mean hosting a citrix server or the likes.

Cuddlesworth

TallGlass wrote: »

Section 12: Use of Virtual Private Network (VPN)
As stated above, the Virgin Media Services are for residential use only and we do not support the use of VPN. If we find you are using VPN we may instruct you to stop using it and you must comply with this request. This is in order to prevent problems with our network and other Internet users.

Again as I said it's not allowed but a blind is turned to it.

That's open ended and probably for good reason. They do not "support" the use of VPN and in certain circumstances they may terminate the contract. That's good business practise.

A good example would be somebody using their connection as a TOR exit node. While I like the idea of TOR, the reality is its a cesspool of materials that are illegal at best.

None of that applies to using a VPN for work. If they were to try to use that clause here to justify implementation of DSlite, I would say you could have a really good case with Comreg.

TallGlass

Cuddlesworth, not too sure but the reps point blank said no to it, when asked to before when it was the UPC talk to forum. I couldn't believe it till I checked over the T&Cs.

df_h

Virgin business connection here, took the whole of 5 minutes to ring their tech support and request a static ipv4 address, no problems.

Tho' I could see how residential would be treated differently

Their routing is not good btw as I wrote in other threads, I wouldnt want to rely on their network for anything important.

TallGlass

Yeah residential customers can't just do that think there's a fee for it. But if it's a server or something your looking to host, DNS duck works quite well and updates your records on the domain as the IP changes.

Cuddlesworth

df_h wrote: »

Virgin business connection here, took the whole of 5 minutes to ring their tech support and request a static ipv4 address, no problems.

Tho' I could see how residential would be treated differently

Their routing is not good btw as I wrote in other threads, I wouldnt want to rely on their network for anything important.

Wait, was it just a static IP-v4 address you were looking for or were you put on DS-lite as a business customer?

df_h

Cuddlesworth wrote: »

Wait, was it just a static IP-v4 address you were looking for or were you put on DS-lite as a business customer?

Wanted a static address for a server, no problem on business connection.


Tho' I do find it disturbing that their residential conditions (Section 12) mentioned above by someone prohibit VPN use, especially in light of their shody routing where your packets get sent across the ocean to East Coast US and back on certain routes, if one were paranoid :cool: one would think its almost deliberate....

Example of Galway<>Amsterdam routing (via US) on Virgin

                                              My traceroute  [v0.86]
backup (0.0.0.0)                                                                          Mon Jul 18 09:19:03 2016
Keys:  Help   Display mode   Restart statistics   Order of fields   quit
                                                                          Packets               Pings
 Host                                                                   Loss%   Snt   Last   Avg  Best  Wrst StDev
 1. 192.168.1.1                                                          0.0%    42    0.2   0.2   0.2   1.0   0.0
 2. 10.100.43.1                                                          0.0%    42    9.9   9.4   3.2  24.5   3.7
 3. 109.255.254.126                                                      0.0%    42    8.0   9.2   4.6  47.2   6.9
 4. ie-dub01a-ra4-ae23-0.aorta.net                                       0.0%    42   88.6  90.6  87.0  94.6   2.0
 5. ???
 6. 84.116.140.174                                                       0.0%    41   95.3  96.4  92.0 106.5   3.0
 [B]7. us-nyc03a-ri1-ae10-0.aorta.net                                       0.0%    41   92.0  91.8  89.3  97.8   1.9
 8. nyk-b3-link.telia.net                                                0.0%    41   91.7  93.9  90.2 117.7   5.2
 9. be1299.ccr21.jfk04.atlas.cogentco.com                                0.0%    41   95.2  96.3  91.1 104.4   2.3
10. be2324.ccr41.jfk02.atlas.cogentco.com                                0.0%    41   94.4  93.6  90.4 100.6   2.3[/B]
11. be2317.ccr41.lon13.atlas.cogentco.com                                0.0%    41  165.4 166.2 162.0 188.6   4.3
12. be12194.ccr41.ams03.atlas.cogentco.com                              12.2%    41  173.4 173.9 171.7 179.5   1.8
13. be2795.rcr21.b047839-0.ams03.atlas.cogentco.com                      0.0%    41  171.1 172.2 170.5 174.8   0.8
14. ?.?.?.?                                      0.0%    41  175.5 173.2 170.7 177.8   1.3
15. ?.?.?.?                                                          0.0%    41  172.8 173.9 170.8 181.6   2.3

They have been doing this for 6 years now, UPC say "meh" and Cogent say "UPC dont want to peer with us" even tho Cogent is the larger network and have many high bandwidth customers such as Netflix

ED E

That was a big problem around the time of the Netflix debacle but its since been resolved for me and others.

Tracing route to login.p1.worldoftanks.eu [92.223.1.112]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  READYSHARE [192.168.2.1]
  2     6 ms     8 ms    10 ms  10.254.184.1
  3     7 ms     8 ms     7 ms  109.255.254.29
  4     6 ms     6 ms     7 ms  ie-dub01a-ra4-ae35-0.aorta.net [84.116.238.70]
  5     8 ms     6 ms     7 ms  ie-dub01a-ri1-ae52-0.aorta.net [84.116.130.117]
  6     8 ms     6 ms     8 ms  dbln-t2core-a-ae-0-0.aorta.net [213.46.165.2]
  7    16 ms    18 ms    18 ms  ldn-bb3-link.telia.net [62.115.116.132]
  8    24 ms    23 ms    24 ms  prs-bb3-link.telia.net [62.115.115.12]
  9    31 ms    30 ms    34 ms  ffm-bb4-link.telia.net [62.115.140.211]
 10    32 ms    37 ms    33 ms  ffm-b1-link.telia.net [62.115.116.160]
 11    30 ms    35 ms    34 ms  gcore-ic-303937-ffm-b11.c.telia.net [62.115.37.82]
 12    31 ms    31 ms    33 ms  fr2-n5596-fe-1-vl231.fe.core.pw [92.223.124.163]
 13    30 ms    31 ms    42 ms  fr2-sl-b112.worldoftanks.eu [92.223.1.112]

Trace complete.

Dublin - London - Paris - Switzerland - Germany

Cuddlesworth

df_h wrote: »

They have been doing this for 6 years now, UPC say "meh" and Cogent say "UPC dont want to peer with us" even tho Cogent is the larger network and have many high bandwidth customers such as Netflix

Cogent changed things when they took on one of the largest providers of video streaming in the world. Their peering relationships became incredibly one sided, which is exactly what peering arrangements were not meant to be.

Either way, I'm surprised UPC blow you off. Sending traffic to the US costs them money(intercontinental is expensive) and in most cases they would want to avoid it. BGP is weird at times though.

df_h

Cuddlesworth wrote: »

Cogent changed things when they took on one of the largest providers of video streaming in the world. Their peering relationships became incredibly one sided, which is exactly what peering arrangements were not meant to be.

Either way, I'm surprised UPC blow you off. Sending traffic to the US costs them money(intercontinental is expensive) and in most cases they would want to avoid it. BGP is weird at times though.

I just checked back over emails, it was 3 years ago I contacted not 6 so my bad.
Yes UPC/Aorta would be better of peering at AMX-IX or something but no they instead go shuffling packets across the atlantic and back when it comes to Cogent
And this was not just UPC here in Ireland, a friend on UPC network in Poland back then had same results.
Anyways both parties know about it, but seems the decision is political form the UPC/Virgin/Aorta end of things not technical. It makes no sense for them not to peer, especially when Cogent is heavily outgoing and UPC are heavily on incoming.


The problem is not just with Cogent, see my post over in Imagine thread,

Imagine residential (Co Galway) to Virgin business (Galway City) goes via Dublin as it should being the main exchange there
But vice versa Virgin go sending the packets all the way via Frankfurt in Germany
my post here with mtr results

Cuddlesworth

df_h wrote: »

I just checked back over emails, it was 3 years ago I contacted not 6 so my bad.
Yes UPC/Aorta would be better of peering at AMX-IX or something but no they instead go shuffling packets across the atlantic and back when it comes to Cogent
And this was not just UPC here in Ireland, a friend on UPC network in Poland back then had same results.
Anyways both parties know about it, but seems the decision is political form the UPC/Virgin/Aorta end of things not technical. It makes no sense for them not to peer, especially when Cogent is heavily outgoing and UPC are heavily on incoming.


The problem is not just with Cogent, see my post over in Imagine thread,

Imagine residential (Co Galway) to Virgin business (Galway City) goes via Dublin as it should being the main exchange there
But vice versa Virgin go sending the packets all the way via Frankfurt in Germany
my post here with mtr results

Unless I'm missing something there, from Dublin to FRA01 shows a 2ms difference in timing. I'd say that's more of a DNS issue then a routing one, UPC/virgin moved a lot of IP's around. They are using private addressing on their pt-pt links at the moment.

srsly78

I upgraded my vpn software rather than changing to ipv4. Modern versions work fine with dslite.

beer enigma

Sorry for late comeback and thanks for all of the replies. So I phoned them and explained that I'm a residential customer but as I'm on call, I sometimes have to VPN into work.....they read clause 12? And threatened to terminate the contract !!

I have the same router at my home in cork and can VPN from that no prob, it's just the new one we have in Dublin that doesn't like it. Dublin is IP6 not sure about cork as haven't been home for a couple of weeks.

As its a work configured Cisco VPN client, I can't change it

degsie

Andip wrote: »

Sorry for late comeback and thanks for all of the replies. So I phoned them and explained that I'm a residential customer but as I'm on call, I sometimes have to VPN into work.....they read clause 12? And threatened to terminate the contract !!

I have the same router at my home in cork and can VPN from that no prob, it's just the new one we have in Dublin that doesn't like it. Dublin is IP6 not sure about cork as haven't been home for a couple of weeks.

As its a work configured Cisco VPN client, I can't change it

Did you request a change to ipv4?

TallGlass

Andip wrote: »

As its a work configured Cisco VPN client, I can't change it

What's blocking it? What is it doing when you try to connect which error are you getting, you mention Cork and Dublin.

Would it be a case that the computer in Dublin is blocking it with a firewall on the computer.

beer enigma

TallGlass wrote: »

What's blocking it? What is it doing when you try to connect which error are you getting, you mention Cork and Dublin.

Would it be a case that the computer in Dublin is blocking it with a firewall on the computer.

Same laptop. Ok so I work in Dub and live in Cork. During the week I rent in Dub. I have a UPC (Virgin) router in both locations, identical router just the Cork one has been there for a good few months, the Dublin one replaced last month. Using my work laptop, I can VPN in from Cork with no issue. I USED to be able to VPN in from Dublin until they replaced the router. The new Dublin one is IPv6 and I'm guessing the Cork one is still on IPv4. I asked if they could give me IPv4 in Dublin and that's when they quoted their rules prohibiting VPN.

I'm having to tether from Dublin which is a pain

degsie

Andip wrote: »

Same laptop. Ok so I work in Dub and live in Cork. During the week I rent in Dub. I have a UPC (Virgin) router in both locations, identical router just the Cork one has been there for a good few months, the Dublin one replaced last month. Using my work laptop, I can VPN in from Cork with no issue. I USED to be able to VPN in from Dublin until they replaced the router. The new Dublin one is IPv6 and I'm guessing the Cork one is still on IPv4. I asked if they could give me IPv4 in Dublin and that's when they quoted their rules prohibiting VPN.

I'm having to tether from Dublin which is a pain

Just tell VM that you have an issue with online gaming and insist that they change you to ipv4. You are hitting your head against a brick wall otherwise.

Cuddlesworth

Contact comreg.

http://www.comreg.ie/queries-complaints/internet/

srsly78

Why complain to comreg? This is a problem with the users vpn software, not a problem with UPC. Older VPN software does not work with ds-lite - needs to be upgraded.

FYI - I had this problem with Junos pulse. Company updated it to newer version and then it worked fine over ds-lite.

Cuddlesworth

srsly78 wrote: »

Why complain to comreg? This is a problem with the users vpn software, not a problem with UPC. Older VPN software does not work with ds-lite - needs to be upgraded.

FYI - I had this problem with Junos pulse. Company updated it to newer version and then it worked fine over ds-lite.

You don't know what fixed it or what was broken, you only know that at some point Juniper wrote in a workaround. Dslite is a flawed but cheap implementation of IPv6, proper IPV4 connectivity is a basic and fundamental part of internet services and Virgin not providing that is against the product they are selling.

The number of complaints about it on this forum would be a fraction of what actually ends up with Virgin reps who do not mention its existence or offer to remove it that I am aware of.

OP, ring them back and tell them they you have installed security cameras and can't port forward on the router they supplied, the options are greyed out.

degsie

OP has been advised how to fix this by several posters for over a week and is unwilling or unable to do so. Meanwhile other posters bicker over semantics. Another thread goes to the dogs...

TallGlass

degsie wrote: »

OP has been advised how to fix this by several posters for over a week and is unwilling or unable to do so. Meanwhile other posters bicker over semantics. Another thread goes to the dogs...

There's noting wrong with triaging the problem. IPV6 should have an IPV4 address that compliments it for non IPV6 complaint routing.

There's a mention of two different routers, has anyone any ideas on what port Cisco VPN uses to get out of the network, as it really sounds like a local firewall issue blocking it.

Can you confirm the error you are getting in Dublin from the VPN software?