SDMoore0805
asked on
PPTP VPN through NAT disconnects after 2 minutes
I have a number of remote users using the Windows XP PPTP VPN client to connect to a Windows 2003 VPN server. The VPN server is behind a NAT firewall that maps TCP port 1723 and GRE to the VPN server. Most remote users can connect and stay connected indefinitely. However, I have one user who can connect but is disconnected after approximately two minutes. This user's PC is behind a Netgear WGR614 V4 cable/wireless router.
I've captured his connect attempts with Ethereal on the public side of the firewall and this is what I see:
Remote User Firewall
SYN --------------------------
<-------------------------
Start-Control-Connection-R
Retry Start-Control-Connection-R
<-----------Start-Control-
Outgoing-Call-Request-----
<----------------------Out
Set-Link-Info-------------
<--------------TCP ACK (for Set-Link-Info)
<----------------Set-Link-
Set-Link-Info-------------
<-------TCP ACK (for second Set-Link-Info)
The short version is the VPN client isn't seeing the Set-Link-Info from the server. The client never acknowledges this packet at the TCP layer. The VPN server resends the Set-Link-Info several times then resets the PPTP connection, causing the VPN to disconnect. While the PPTP connection is up, the user is able to move data across the tunnel.
The ports and TTL on the Set-Link-Info look good. For example, they're the same as the Outgoing-Call-Reply which does make it to the client.
It seems likely that the Netgear is blocking the Set-Link-Info for some reason. I'm wondering if there's anything at the VPN server end that could be causing this.
I've captured his connect attempts with Ethereal on the public side of the firewall and this is what I see:
Remote User Firewall
SYN --------------------------
<-------------------------
Start-Control-Connection-R
Retry Start-Control-Connection-R
<-----------Start-Control-
Outgoing-Call-Request-----
<----------------------Out
Set-Link-Info-------------
<--------------TCP ACK (for Set-Link-Info)
<----------------Set-Link-
Set-Link-Info-------------
<-------TCP ACK (for second Set-Link-Info)
The short version is the VPN client isn't seeing the Set-Link-Info from the server. The client never acknowledges this packet at the TCP layer. The VPN server resends the Set-Link-Info several times then resets the PPTP connection, causing the VPN to disconnect. While the PPTP connection is up, the user is able to move data across the tunnel.
The ports and TTL on the Set-Link-Info look good. For example, they're the same as the Outgoing-Call-Reply which does make it to the client.
It seems likely that the Netgear is blocking the Set-Link-Info for some reason. I'm wondering if there's anything at the VPN server end that could be causing this.
see here if one of these issues matches yours:
http://kbserver.netgear.com/kb_web_files/n100772.asp
... but first check the SPI setting - that seems obvious
Holger
http://kbserver.netgear.com/kb_web_files/n100772.asp
... but first check the SPI setting - that seems obvious
Holger
ASKER
Thanks, Holger. I'll get him to try disabling the firewall.
Steve
Steve
ASKER
We tried disabling the SPI firewall last night. Surprisingly, it didn't make any difference. Does anyone have any other ideas?
Steve
Steve
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
--------------------------
Disable SPI Firewall
Normally, this option should be Enabled, so that your local network will be protected by the
Stateful Packet Inspection (SPI) firewall included in the WGR614 v4. However, certain
communications functions like VPN may require turning off the SPI feature.
--------------------------
So the SPI firewall could be the problem ... turn it off and test connection
regards Holger