I updated a problem here with the cookbook approach on setting this up a few months back.
Basically, if you can log on to your TSO locally, you can enter the command 'TSO HOMETEST' and it will tell you if the z/OS side is okay.
Assuming it is, then the most common errors are that you have not set up your Hercules config adapter(s) to connect to the addresses that your z/OS instance thinks it need to use.
You need to know a few things going in:
1) The IP address of your Windows PC (the one you are actually running Hercules on)
2) The IP address of your ROUTER (both of these you get from the command prompt (IPCONFIG /ALL)
3) The IP address that you want your Hercules instance (your z/OS) to be, it cannot be the same as either of the above 2 items. It shoudl not match anything else in your local network (no other PC's) and it shoudl be a static address that you assign as static in your ROUTER (for both the PC and the HErcules instance of z/OS)
4) the device type of your connection, typincally it's defined in the Hercueles config as the LCS device (s)
5) a dummy mac address (you can use something like 02-AA-BB-CC-DD-EE) for CTCIWIN
For instance, my Windows PC local IP is 192.168.1.69 and my router is 192.168.1.64 (most people use 192.168.1.1, but I wanted to be a bit more secure). My z/OS hercules instance uses IP 192.168.1.66
My IODF has 4 CTCs defined at E20, E21, E22, E23 and I use E22 and E23 for my connection (and a backup)
So my hercules configuration entry is :
0E22-0E23 LCS -n 192.168.1.69 -m 02-AA-BB-CC-DD-EE 192.168.1.66
on z/OS my TCP/IP profile has the following (plus a lot more, but only these things matter)
E22 is my primary adapter and I am using a LCS device, you can use other types, even OSA, but I find LCS to perform the best (for me)
DEVICE LCSA2 LCS E22 AUTORESTART
LINK LCS2 ETHERNET 0 LCSA2
ROUTE 192.168.0.0 255.255.0.0 = LCS2 MTU 1492 <--MTU 1492 works well
ROUTE DEFAULT 192.168.1.64 LCS2 MTU 1492 <---router is 192.168.1.64
As I said, there are other items before and after these, but these are the ones that matter for your purposes.
You should also make sure that your TCPDATA has the following things set:
HOSTNAME Z23 <-- or whatever you called your host, some are ADCD, I set mine as z23, when you start up your z/OS, your COMMNDxx should have an entry like this:
COM='S EZAZSSI,P=Z23' <-- whatever you set the P= to is what you use as your host name.
DOMAINORIGIN SOMETHING.COM <-- obviously yours is something else, but whatever you use, make sure your TCPIP.HOSTS etc. is the same as this.
NSINTERADDR 192.168.1.64 <-- this is your ROUTER
Make sure you set up the RESOLVER and PORTMAP started tasks
Inside your RESOLVER task, make sure you set up:
Your IPNODES :at the GLOBALIPNODES statement and DEFAULTIPNODES statement
192.168.1.66 Z23 <-- z/OS (for me) is 192.168.1.66, and my hostname is Z23
Also, make sure that everything points to the exact same TCPDATA member of TCPPARMs, otherwise you end up with a system that you can go in one way but can't get back out.
If you set things up as I outlined, then you can connect to your z/OS from anywhere that has an internet connection (assuming you open up ports 20, 21, 23, and the SSL ports 443, 992 etc.if you use them inside your ROUTER) so that you can TN3270, FTP and send EMAIL from or to your z/OS.
If you want to use DB/2 and your z/OS web server, you will need to open up their ports as well. Make sure that you open them inside your ROUTER to your Hercules/zos instance, NOT your local PC's IP. In my case it's 192.168.1.66 (my PC itself is 192.168.1.69), don't mix them up, really odd things happen.
There are lots of other little fine tuning things you can/should do, but the above changes are where most people mess up.
Lately I have noticed that a lot of people are messing up on the actual CTC device they use to connect (for me that's the E20-E23), they have some other address (that they have to look up and use) or forget to define something that Hercules can use for this, it can be a CTC or even defined as an OSA adapter. I don't think you can use the OSA as an LCS, but there are OSA setting on this site as well.
If your system is (I hope because you would probably be breaking the law otherwise) a ADCD system or some other "legal" type, then you probably have E20-E23 like me.
If you got it via some nefarious means, then you will need to generate the proper devices and that's pretty much where I draw the line because if you are breaking the law, you are on your own. If you have a legal copy, then this won't be an issue for you, and it's just a matter of the other stuff I mentioned above.
If you have more questions, feel free to contact me off list if you want, but if you keep it on the list more people will benefit from the text of what you do to make it work.