Re: PPTPD connect issue

So all your client networks are behind Linksys or other consumer grade
routers?  And the problem is, in some of your client networks, one
apparently random user's connection stays good while everyone  drops or
can't connect - right?

 

Let's say user A is good and users B and C are bad.  If A disconnects
and you wait, say 10 or 15 minutes, can either B or C connect back up
again?

 

As I recall, the PPTP protocol has no concept of caller ID - so the
protocol  by itself has no way to distinguish multiple calls from the
same public IP Address.  Your client networks have multiple users all
behind the same NAT gateway, right?  I used to have problems with my own
setup when I would try connections to the same PPTP server from multiple
computers in my same LAN from the same public IP Address.  Somehow that
all seemed to work out with later releases of Linux.  

 

Maybe you're running into something similar?  

 

Which office switch did you power cycle?  Somehow the switch in front of
your PPTP server in another country or the switch at a client site?
Since cycling the dumb 24 port switch seems to cure the problem for a
while, do you have the ability to try a different brand switch?  Maybe
the GRE protocol somehow messes with this dumb switch's "mind"?

 

Oh yes - why PPTP?  Why not do site to site VPNs with OpenVPN or IPSEC
or similar?  If your users are on cell phones, you could still do PPTP
for those guys when they're on the road.  But when they're in a client
network via wifi, they would already be connected and would not need to
PPTP VPN out from the phones.  

 

-        Greg Scott

 

 

From: David Schulz [mailto:[email protected]] 
Sent: Saturday, August 11, 2012 9:56 PM
To: [email protected]
Subject: [Poptop-server] PPTPD connect issue

 

Hello all,

 

i have a strange issue with my pptpd v1.3.4 setup on Ubuntu server
10.04, and would be extremely grateful for assistance or insights.

 

Users can connect to the VPN fine for days at a time, using different
devices and usually behind regular office nat routers connected to the
internet. Everything is great. Then all of a sudden, while 1 User may
still be able to connect via wifi OR wired (not both anymore), nobody
else can. Connecting from another network then (say the neighbors wifi),
it will work just fine for everyone who tries.

 

When using tcpdump on the pptpd server side, i can see a clients
incoming connection, and i can see the server sending back configuration
replies or ack packets. When then using tcpdump on my LAN side WAN
Interface, i can see what looks like the correct packets arriving back
at the firewall, but they never make it anymore to the client, so i
believe whats happening is that a connection never gets negotiated: the
Client is sending configuration requests, the Server is sending back
answers, but the LAN firewall will never pass them on somehow. Sounds
like a gre issue? But nothing changed and things may work fine for days
until this issue pops up.

 

While having this odd situation, i rebooted the pptpd server (which is
on a fixed Internet IP somewhere in another country), rebooted my
clients (such as iPhone, regular PC, MAC, Windows, all behind a Linksys
NAT Router), rebooted the Linksys, all to no avail. Tried using clients
on wifi and wired. It just won't connect no more.

As a last resort then, i turned off the power to the whole office server
rack, which basically just contains the Linksys, a dumb 24 Port Switch,
and a Modem. Resetting the Switch made everything go back to normal, and
everybody could connect again.

 

I have had this issue now from inside 3 different networks with
different setups and different clients. I don't know the exact steps yet
to trigger this "unable to connect" problem, but the next time it
happens i'll restart the switch again and believe it will temporarily
solve it.

 

Is anyone available to help me troubleshoot this rather bizarre issue? I
have taken packet captures from every angle and can provide any required
details. For now, just my simple pptpd.conf attached as below. 

 

/etc/pptpd.conf

option /etc/ppp/pptpd-options

logwtmp

localip 192.168.111.1

remoteip 192.168.111.101-200

 

/etc/ppp/pptpd-options

name pptpvpn

refuse-pap

refuse-chap

refuse-mschap

require-mschap-v2

require-mppe-128

ms-dns 8.8.8.8

ms-dns 8.8.4.4

proxyarp

nodefaultroute

debug

lock

nobsdcomp 

 

 

best regards,

David S.

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
Poptop-server mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/poptop-server