Pocket PC 2002 How-to: ActiveSync through dial-up Internet [Archive]

View Full Version : Pocket PC 2002 How-to: ActiveSync through dial-up Internet

Ed Hansberry

09-20-2002, 03:00 PM

Michael Sprague has put together a couple of nice articles for Pocket PC Thoughts. The first is a short but informative How-to on setting up your PC and Pocket PC to allow you to ActiveSync over the internet. This is perfect for those with broadband connections that are always connected. Click "more" for the entire article. Thanks Michael! This requires the most excellent <a href="http://www.pocketpcthoughts.com/forums/viewtopic.php?t=3462">Pocket Hosts app discussed last week</a>, which should be in future Pocket PC ROMs, or at least in the ActiveSync Extras folder. <!> This How-to is based on the following configuration: • Desktop computer with ActiveSync is on the Internet, a known IP address. • Pocket PC device will connect to the Internet over a dial-up connection to your ISP. Motivation: On my Pocket PC I have a Compact Flash 802.11b network card. I can sync and surf the net at work and at home with the WLAN. When I am traveling however I do not have that luxury. So I have set up my Pocket PC to connect to my ISP through my Nextel phone whenever the WLAN is not available. Note: If your desktop is behind a firewall you will have to open ports 990, 999, 5678, and 5679 (per <a href="http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q259369&">Microsoft KB Article</a>). If you have not set up your Pocket PC for a dial-up connection yet, you will want to do that first. Step 1. You must enable network connections to ActiveSync on your desktop computer. In the "File" menu select "Connection Settings..." <img src="http://www.pocketpcthoughts.com/images/hansberry/article-asipsync/sync_step01.jpg" /> Step 2. Check the box "Allow network..." Click "OK" <img src="http://www.pocketpcthoughts.com/images/hansberry/article-asipsync/sync_step02.jpg" /> Step 3. You must enable ActiveSync on your Pocket PC to synchronize remotely. In the "Tools" menu select "Options..." <img src="http://www.pocketpcthoughts.com/images/hansberry/article-asipsync/sync_step03.jpg" /> Step 4. Check the box "Include PC when..." Make note of the computer name listed, you will use it as the Host Name in the next step. Click "OK" <img src="http://www.pocketpcthoughts.com/images/hansberry/article-asipsync/sync_step04.jpg" /> Step 5. You will need to set some registry entries in order for your Pocket PC to locate your desktop computer over the Internet. This is similar in functionality to a hosts file on your Windows PC. Marc Zimmermann has developed a utility program called Pocket Hosts so that you don't have to edit the registry directly. Download phosts.zip from <a href="http://zimac.de/software.htm">http://zimac.de/software.htm</a> Add the Host Name that you noted in the previous step with its IP address. <img src="http://www.pocketpcthoughts.com/images/hansberry/article-asipsync/sync_step05.jpg" /> Congratulations, you are done! You should be able to connect your Pocket PC to the Internet over your dial-up connection and synchronize to you desktop over the Internet! If you have not set up you Pocket PC for a dial-up connection yet, now is the time to do it!

van_mierlo

09-20-2002, 03:07 PM

Sync from Work desktop with cradle to home desktop through internet??

Ed Hansberry

09-20-2002, 03:39 PM

Jason Dunn

09-20-2002, 03:39 PM

Sync from Work desktop with cradle to home desktop through internet??

Good question - give it a try and let us know! ;-)

CoreyJF

09-20-2002, 04:39 PM

DOes it have to be dialup? if I am sitting in a coffee shop or office that has a wifi conection can I do it that way?

Jason Dunn

09-20-2002, 04:49 PM

DOes it have to be dialup? if I am sitting in a coffee shop or office that has a wifi conection can I do it that way?

The connection shouldn't matter, but even public Wifi points can sometimes be behind Firewalls, so the right ports may not be open.

ChrisD

09-20-2002, 05:11 PM

Hi,
First, I suggest that you erase your IP address out of the images. Otherwise you may be inviting hackers to attack. After all they know you have a Windows machine with ActiveSync running on it!

This solution has worked for the past few years with ActiveSync. The key is having ports 990, 999, and 5678 not blocked and the ability to resolve the host name to IP address. The last issue is addressed by PocketHosts.

van_mierlo

09-20-2002, 05:19 PM

Sync from Work desktop with cradle to home desktop through internet??
Now your pushing it. :wink: I don't think that is possible because your PPC is already communicating with one instance of ActiveSync, even if it is in Guest mode.
Yes you're right...maybe this is something for a developer to come up with. Alot of us people use two desktops daily with high speed internet acces and it would be great to do acces the active sync app on you base computer from a remote site.

van_mierlo

09-20-2002, 05:22 PM

Janak Parekh

09-20-2002, 06:26 PM

Hi,
First, I suggest that you erase your IP address out of the images. Otherwise you may be inviting hackers to attack. After all they know you have a Windows machine with ActiveSync running on it!
Good point, except he does appear to be on a DHCP DSL address, so just do a release/renew and hopefully you'll be on your way :)

Speaking of which, does anyone know of known ActiveSync-over-IP vulnerabilities with 3.5/12007?

--bdj

Ed Hansberry

09-20-2002, 06:30 PM

Speaking of which, does anyone know of known ActiveSync-over-IP vulnerabilities with 3.5/12007?
LOL! :lol: Given AS was never intended to be used in this manor, I would say the holes are as big as my house. I wouldn't put this on a corporate network until you had a security guy check it out.

Terry

09-20-2002, 07:54 PM

Anybody know what ports Active Sync over TCP/IP uses?
That might help begin to answer the security questions.
Now I'm going to need to pressure Cisco for a VPN client for my PPC (as if...).

fmcpherson

09-20-2002, 08:10 PM

Wouldn't the answer to your question be the ports listed in the article?

Qman

09-20-2002, 08:18 PM

Thanks for this great how-to. I just got it working with Earthlink Wireless,
Yea Baby! 8)

Underwater Mike

09-20-2002, 09:05 PM

Any suggestion for a host with a dynamically assigned IP? How do you make sure the Pocket Hosts association is accurate all the time?

msprague

09-20-2002, 10:00 PM

Hi,
First, I suggest that you erase your IP address out of the images. Otherwise you may be inviting hackers to attack. After all they know you have a Windows machine with ActiveSync running on it!
Good point, except he does appear to be on a DHCP DSL address, so just do a release/renew and hopefully you'll be on your way :)

Speaking of which, does anyone know of known ActiveSync-over-IP vulnerabilities with 3.5/12007?

--bdj
Actually, last week our ISP switched our block of IPs to a whole new subnet so you were poking around someone else's machine today.
Thanks Ed, for blurring the IP though.

aner

09-21-2002, 10:12 AM

Hello,
Thanks for the great tip. I am continually struggling to connect my pocket PC to work.
This is what happens:
I disabled the firewall just to be sure. My Ipaq connects to the internet through my ericsson T68i (GPRS). Active sync shows the 'connecting' animation, but there it stops: after a few minutes I get an error about a critical connection fault and are advised to reboot. Any thoughts?
Desktop: winXP on mxstream DSL modem !!Active sync 3.6!
Pocket PC: Ipaq 3970, bluetooth connection to ericsson T68i GPRS

TeQuilYa

09-21-2002, 02:13 PM

The scenario with a critical connection fault typically means either there is a firewall in the way or you are perhaps behind a NAT router or some other form of Internet connection sharing. Network Address Translation means that you have many machines with private IP addresses all sharing one incoming "real" IP address.

I'll give more detail about the client side since I'm very familiar with it. I may be able to provide more server (desktop) side details in a day or two, but don't hold me to that :)

On the client side, the firewall must be configured to allow port 990 to come in and be routed to your PocketPC. This can just be opening a port on a firewall, or in the case of NAT you must tell the router what internal address should handle this request. You have to either statically set your IP on the PocketPC or, if your router handles it you can set up a "special application".

I have worked with DLink DI-713p and DI-614+ routers and they are very similar for setting up "special applications". The idea is to figure out an outgoing trigger port, and when that outgoing trigger is used open up an incoming port to that IP address. There are two nice things about this approach: The incoming port isn't open when not being used and you don't have to statically tie the incoming port to one IP address (more than one PocketPC can use activesync, though probably not at the same time).

For clients it works to set the trigger port to 5679 and the incoming public port to 990. If you can't use trigger ports then you'll have to tie the incoming 990 port to the static IP you'll always assign to your PocketPC.

As far Activesync on the desktop side goes, I know the trigger approach won't work. This is because the request for ActiveSync is originated by the PocketPC and there is no trigger before that request to open the incoming port. So you must either have a non-NAT address or be able to configure the incoming ports to be forwarded to your private IP address. The incoming ports are one or more of 999,5678 and 5679 (I will try to do some testing or talk to the firewall guy at work to see if I can narrow this down a bit - I've always meant to).

If you area already non-NAT on the desktop side and still having trouble then it is likely a firewall issue needing to open the same ports.

Hope that all makes enough sense to be useful.

TeQuilYa

09-21-2002, 02:25 PM

I just had another thought about this ActiveSync remote stuff. While VPNs (Virtual Private Networks) can help with the port opening stuff, they don't seem to be a panacea. This is because they seem to rely on any NAT (Network Address Translation) routers between you and the VPN back at the office support the VPN protocol you are using.

The short answer is: use VPN if you can as this enables all ports between you and your desktop PC. However, if NAT is involved you may be out of luck.

I experienced this issue while traveling last week in DC. My hotel had high-speed ethernet connection in every room, but as is typical I was behind a NAT router. I thought "No prob, I've already tested this out from home behind my own NAT router and can just fire up the PocketPC's built-in VPN support". No dice. The routers at the hotel did not seem to have the PPTP routing support enabled and I was SOL.

I switched to downloading the PocketPC IPSEC VPN client for securemote since my office also has that but had similar trouble using it. I am not 100% certain that IPSEC was stopped by the hotel's router as my tech support back at the office was unable to help at that time. However, it seems likely that there could have been similar router support issues since my home router has checkboxes to enable both PPTP and IPSEC VPN support.

FYI: I haven't yet set up my own VPN, I've only been using the clients to access a VPN already configured back at my office. That means I can't yet help much with setting up VPN's. I'd be happy to clarify anything client-side though if this post wasn't clear.

Ed Hansberry

09-21-2002, 05:05 PM

I experienced this issue while traveling last week in DC. My hotel had high-speed ethernet connection in every room, but as is typical I was behind a NAT router. I thought "No prob, I've already tested this out from home behind my own NAT router and can just fire up the PocketPC's built-in VPN support". No dice. The routers at the hotel did not seem to have the PPTP routing support enabled and I was SOL.

Sounds like the hotel had the VPN port blocked. They don't have to support VPN, but they do have to open the port. Some cell phones and ISPs block this port unless you pay an extra fee - knowning as a business traveler you will be more likely to pay.

09-21-2002, 05:40 PM

Janak Parekh

09-21-2002, 08:00 PM

Sounds like the hotel had the VPN port blocked. They don't have to support VPN, but they do have to open the port. Some cell phones and ISPs block this port unless you pay an extra fee - knowning as a business traveler you will be more likely to pay.
There's also the problem of overlapping IP address ranges. If you try to open a VPN session from a 10.* address block behind one of these NAT routers, and the subnet you're trying to access is 10.*, the routing tables in your computer will get massively confused as to which network to direct packets onto.

This is why I set my NAT routers at home to 172.16.*, as they're used the least of the three private IP blocks.

--bdj

Ed Hansberry

09-21-2002, 10:24 PM

There's also the problem of overlapping IP address ranges. If you try to open a VPN session from a 10.* address block behind one of these NAT routers, and the subnet you're trying to access is 10.*, the routing tables in your computer will get massively confused as to which network to direct packets onto.

This is why I set my NAT routers at home to 172.16.*, as they're used the least of the three private IP blocks.
I thougth 192.168.*.* was the best to use behind NAT. Those addresses simply don't exist in the wild.

TeQuilYa

09-22-2002, 08:00 AM

The hotels swears they had no firewall at all, just NAT. I think the overlapping subnets seems a likely cause of failure, I hadn't thought of that issue. I'll have to see if I can configure the subnet masks to force it to treat them as separate networks next time.

As far as the routers not needing VPN support, I don't think that is true. My routers definitely have checkboxes to enable both PPTP and IPSEC pass-through. I'm sure this isn't as simple as opening a port, I think there is some header fix-up work to be done.

I looked around a bit and see several references to needing to get a router that has VPN support if you need it. Here is one such link: http://www.practicallynetworked.com/support/VPN_help.htm

Thanks for the suggestions to try.

Ed Hansberry

09-22-2002, 12:25 PM

As far as the routers not needing VPN support, I don't think that is true. My routers definitely have checkboxes to enable both PPTP and IPSEC pass-through. I'm sure this isn't as simple as opening a port, I think there is some header fix-up work to be done.
I am 99.9% sure that is for inbound VPN traffic so they can properly route the packets and fool the VPN client into thinking they are talking directly to the VPN server. I had to get a new router at work because our old Lucent couldn't do IPSEC pass-through properly.

09-24-2002, 01:57 AM

OK, I got this working with XP and my Tmobile. However, for some reason I am having problems with the firewall. When it is up I cannot remote activesync. When it is down I can. I have attempted to open the ports given but something tells me I am not doing it right. All I thought I had to do was open TCP filtering and add all the ports and then check the appropriate boxes. Is there more to it than this? Could someone perhaps give me some guidance on how their firewall is configured to get this to work?

Jason Dunn

09-24-2002, 02:23 AM

Janak Parekh

09-24-2002, 03:28 AM

I thougth 192.168.*.* was the best to use behind NAT. Those addresses simply don't exist in the wild.
As per the RFC 1918 standard ("Address Allocation for Private Intranets"), there are three private blocks, not one:

10.0.0.0-10.255.255.255 (10/8 prefix)
172.16.0.0-172.31.255.255 (172.16/12 prefix)
192.168.0.0-192.168.255.255 (192.168/16 prefix)

You've been restricting yourself all this time :D

I use 10.x mostly for customers, actually; it's easier to type.

It is indeed worth noting, though, that most home routers use 192.168.* by default. They don't have to, and all the ones I've used can change to one of the other blocks.

--bdj

09-24-2002, 03:29 AM

Could someone perhaps give me some guidance on how their firewall is configured to get this to work?

All firewalls are different in terms of interface, but they work in the same basic way: you open a port, and you need to direct that port to an IP address on the network. The IP address would be your desktop PC - if you don't know your desktop IP, START > RUN > CMD > IPCONFIG

Bam! That's it. :-)

Again, I am only using the firewall in XP, nothing else. I know my ip address and I guess I am opening the port with TCP filtering but I don't quite see how to direct that port to an ip address. I thought it would do this automatically. Could someone explain specifically how to do this within XP?

Jason Dunn

09-24-2002, 04:04 AM

Again, I am only using the firewall in XP, nothing else. I know my ip address and I guess I am opening the port with TCP filtering but I don't quite see how to direct that port to an ip address. I thought it would do this automatically. Could someone explain specifically how to do this within XP?

I'm just guessing here, because I don't use the XP firewall, but you should have it set up something like this:

ctmagnus

09-24-2002, 06:03 AM

rfischer

12-20-2002, 10:10 PM

My T-Mobile PPC will connect via GPRS, I'll see the ActiveSync on my XP Desktop attempt to connect and then it will give me an error message: "Critical Communications Services have failed to start." This is driving me crazy. I have a linux firewall and I have successfully redirected ports in the past for mail, etc so I don't think that's the problem. I have tried every combination of ports 900, 998, 999, 5678 & 5679 based on the different docs I've seen on the web getting nowhere.

Any Ideas? Thanks! :(

ctmagnus

12-20-2002, 10:46 PM

I have tried every combination of ports 900, 998, 999, 5678 & 5679 based on the different docs I've seen on the web getting nowhere.

Any Ideas? Thanks! :(

First thing to try: disable any firewall in use.

If it works from there, the firewall is the culprit and should be reconfigured appropriately.

JCA

12-23-2002, 08:31 PM

I have been trying for months to get a PPC with 2002 on it to dial into (using RAS) an XP or 2k machine. The IPAQ 3700 or 3800 will dial into a Win98 machine, and an IPAQ 3600 will dial into the XP/2k machine, but when you combine 2002 and XP/2k it only connects as a guest. Microsoft pointed me to Compaq and Compaq pointed me to Microsoft.

I guess nobody's doing medium to large scale sales force proliferation with dial-in and PPC2002...doesn't seem possible, but must be true. Any ideas? I have all recent patches to ActiveSync, Xp/2k,PPC2002.

Thanks. John

ctmagnus

12-23-2002, 09:44 PM

I have been trying for months to get a PPC with 2002 on it to dial into (using RAS) an XP or 2k machine. The IPAQ 3700 or 3800 will dial into a Win98 machine, and an IPAQ 3600 will dial into the XP/2k machine, but when you combine 2002 and XP/2k it only connects as a guest.

The 3600 has PPC2k2 also? If so, my theory is blown all to h377.

You would need an account setup on the XP/2k machine for the iPaq to connect with. It's possible that PPC2k (not 2k2) is setup such that the XP/2k end recognizes it and lets it in but beyond that I have no idea.

JCA

12-23-2002, 11:35 PM

No, the 3600 series doesn't have PPC2002. The 3600 authenticates perfectly but the 3700 and 3800 don't...they just connect as GUEST. If you think of anything...

ctmagnus

12-24-2002, 03:32 AM

I'm thinking that it's something with the OS on the iPaqs. PPC2000 works in this case but PPC2002 doesn't. Something obviously "broke" in PPC2002 such that the OS can no longer connect to a NT machine/workgroup/domain, as your case may be.

KLappDOgg

07-14-2003, 04:33 AM

I have a laptop running windows XP behind a Netgear router. I have a static IP address on my router. I can access my laptop from FTP and RemoteDesktop. I cannot get my vpn to work on my laptop. I have been trying to get my PDA to sync through my internet connection at work, with my laptop at my house. I tried the steps above and reached the point where my laptop recongnized my PDA trying to connect and active sync turns green and starts to spin. Next thing that happens is I get an error that says "Critical communications services have failed to start. To correct
this error, try resetting the device..." and thats as far as I get. Can anyone Help me!!??

HoTWiReZ

09-04-2003, 02:11 PM

Any suggestion for a host with a dynamically assigned IP? How do you make sure the Pocket Hosts association is accurate all the time?
I use the free dynamic IP DNS service such as DynDns.org and to make sure Pocket Hosts association is correct I guess you could always ping your DNS name before using it to make sure it matches what's stored in Pocket Hosts.
-----How do you use the Dynamic DNS service with pocket hosts? Is there a way to change the host name that you need to connect to in your Axim? A registry setting for Activesync perhaps? I have set my hostname and that is what my axim tries to connect to, but I also placed my higher level domain in the settings so that my full hostname matches what is on the internet with my dynamic dns service (so that the axim will be able to use the full hostname all of the time), but I have no way of changing the hostname in the axim. It only takes the first part of it, before the dynamic dns part..

jemichael

11-24-2003, 08:33 AM

I am having the same problem. I sync through my tmoble grps and it gives the bleep noise of activesync. I hear it on my desktop and it starts to connect. it sits there and then the desktop gives me the error:

Critical communications services have failed to start. To correct
this error, try resetting the device..."

how does this get fixed?

andyclap

12-05-2003, 06:37 PM

Critical communications services have failed to start. To correct
this error, try resetting the device..."

Me too on this one, got quite exited when the actisync beeps went off, but then got the above message.

Any ideas?

andyclap

12-08-2003, 01:32 PM

Got it working, yay!

The main problem is that most service providers seem to block the required ports over GPRS. I set up a normal GSM dial-up connection to my ISP under the work connections, and it synched first time.

Also, you'll need to identify what logon name to use, so that you don't connect as guest - this is in HKLM\Ident\User on the device - change it to the username on the PC under which you normally use activesync.

Underwater Mike

01-16-2004, 09:04 PM

I used to RAS okay using PPC2002. Now, after upgrading my Axim to WM2003, I can't get RAS to work. All the required ports on my NAT router are forwarded as before, and I'm using Pocket Hosts the same as before. Nothing has changed except the OS (I put all the settings as they were under 2K2).

Is there something different about doing this under 2003 vs. 2002? I'm away from my desktop for a while and can't get my &^!@ email. :?

ctmagnus

01-16-2004, 10:27 PM

WM2003 sometimes doesn't require a hosts file. Many people are finding that if they remove their desktop entry from Pocket Hosts and/or unintall the program completely, ActiveSync will suddenly work over WiFi.

See this thread (http://www.pocketpcthoughts.com/forums/viewtopic.php?t=17165&start=0) for more info.

johnatthebar

01-04-2005, 05:58 AM

been following this thread for aeons with little result.

heres the deal. my home network, nating router, static IP.
home comp that i want to vpn into is an XP pro box.
PPC is an e740 running 2k2

I am able to log onto my VPN as long as I am not at my home network. If I am it errors out, if I am away from home it connects. Home of not, under this configuration it will not sync. If I try to sync while rmeotly connected to the VPN, ActiveSyn says "connecting" but does nothing.

I have tried with and witout the assistance of Zimmerman Pocket Hosts. I am really running out of ideas here.

Buler...Anyone?
-Thanks-

Underwater Mike

01-04-2005, 06:18 PM

I gave up on this last spring. :(

copernicus

01-04-2005, 06:39 PM

How are you connecting to your VPN? Via GPRS? Via LAN to LAN VPN?

I have used ActiveSync via vpn via the VPN at my work and home and over dialup (using a landline modem and CSD (very slow).

The way I coonected was using and IPSEC client, but it should also work via PPTP.

The first step is to make sure that the VPN networking is working properly. After that it get easier.

-cr.

been following this thread for aeons with little result.

heres the deal. my home network, nating router, static IP.
home comp that i want to vpn into is an XP pro box.
PPC is an e740 running 2k2

I am able to log onto my VPN as long as I am not at my home network. If I am it errors out, if I am away from home it connects. Home of not, under this configuration it will not sync. If I try to sync while rmeotly connected to the VPN, ActiveSyn says "connecting" but does nothing.

I have tried with and witout the assistance of Zimmerman Pocket Hosts. I am really running out of ideas here.

Buler...Anyone?
-Thanks-

johnatthebar

01-05-2005, 10:07 PM

I have been conecting via WLANs, both personal and business. As I said, when i am off of my own personal WLAN I can connect to the VPN without fail, but I just cant sync. If I am local, I cannot connect.

Interestingly enough, if I change the vpn ady to my local IP when I am on my locla WLAN, it will not only connect to the VPN, but also sync sucessfuly.

I am using microsofts built in VPN client, which I am pretty certain is PPTP.

copernicus

01-06-2005, 02:07 AM

Why are you using the VPN connection for connecting locally?

Basically, to activesync via TCP/IP (whether it be wireless or wire via ethernet), if you are on the same local subnet as you host PC it usually should work without isses because it sees the computer. Typically, what I do is in the TCP/Ip config of my PDA, I set the WINS and the host file IP address to the Activesync host.

If you are connecting via VPN connection over the internet to connect to your lan should have been assigned a virtual IP address by the VPN server/firewall. That means you should be able to not only Activesync, but you should be able to do other things too (i.e. ping other devices, VNC to a PC etc, etc.). In this case you do not change the WINS or the host file.

Same thing goes for LAN to LAN VPNs. The host file and wins remain the same.

It gets a little trickier when you are doing it by fowarding ports from a firewalll/router to your host.

-c.

snuffiesnuf

05-30-2005, 02:12 PM

snuffiesnuf

05-30-2005, 02:12 PM

Has anybody found a solution to the Critical Communication Error?

Critical communications services have failed to start. To correct this error, try resetting the device..."
I have a PPC HX4700 with 2003SE and connecting with ActiveSync 3.8 on my Win XP pc

I've NAPT my modem/Router, opened ports 990, 999, 5678 and 5679 there and in my firewall....

And: Sync works within my own WLANetwork at home, but not via internet :(

Thanks a bunch!

(sorry for the double posts.... can mod remove my first post?)

Ed Hansberry

05-31-2005, 01:37 AM

snuffiesnuf

06-04-2005, 07:50 AM

Do I need to uninstall the previous ActiveSync first?

Darius Wey

06-04-2005, 12:37 PM

Do I need to uninstall the previous ActiveSync first?

Usually, a reinstall works fine, but if it's still a problem, do a complete uninstall then reinstall.

snuffiesnuf

06-06-2005, 11:08 AM

After reinstalling, the synchronizing of the PPC with my home pc via internet still doesn't work.
(Normal -via USB and via WLAN at home- sync does work.)
Any other suggestions, anybody??