PPTP VPN through NAT disconnects after 2 minutes

Posted on 2005-02-24
Medium Priority
Last Modified: 2010-05-18
I have a number of remote users using the Windows XP PPTP VPN client to connect to a Windows 2003 VPN server.  The VPN server is behind a NAT firewall that maps TCP port 1723 and GRE to the VPN server.  Most remote users can connect and stay connected indefinitely.  However, I have one user who can connect but is disconnected after approximately two minutes.  This user's PC is behind a Netgear WGR614 V4 cable/wireless router.

I've captured his connect attempts with Ethereal on the public side of the firewall and this is what I see:

Remote User                               Firewall
SYN ------------------------------------->
<----------------------------------SYN ACK
Retry Start-Control-Connection-Request--->
<--------------TCP ACK (for Set-Link-Info)
            <----------------Set-Link-Info // Never acknowledged by other end
<-------TCP ACK (for second Set-Link-Info)

The short version is the VPN client isn't seeing the Set-Link-Info from the server.  The client never acknowledges this packet at the TCP layer.  The VPN server resends the Set-Link-Info several times then resets the PPTP connection, causing the VPN to disconnect.  While the PPTP connection is up, the user is able to move data across the tunnel.

The ports and TTL on the Set-Link-Info look good.  For example, they're the same as the Outgoing-Call-Reply which does make it to the client.

It seems likely that the Netgear is blocking the Set-Link-Info for some reason.  I'm wondering if there's anything at the VPN server end that could be causing this.
Question by:SDMoore0805
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2

Expert Comment

ID: 13396114
From the manual:
Disable SPI Firewall
Normally, this option should be Enabled, so that your local network will be protected by the
Stateful Packet Inspection (SPI) firewall included in the WGR614 v4. However, certain
communications functions like VPN may require turning off the SPI feature.

So the SPI firewall could be the problem ... turn it off and test connection

regards Holger

Expert Comment

ID: 13396157
see here if one of these issues matches yours:

... but first check the SPI setting - that seems obvious


Author Comment

ID: 13396495
Thanks, Holger.  I'll get him to try disabling the firewall.


Author Comment

ID: 13403641
We tried disabling the SPI firewall last night.  Surprisingly, it didn't make any difference.  Does anyone have any other ideas?


Accepted Solution

holger12345 earned 1000 total points
ID: 13403788
- MTU setting doesn't match (try a lower MTU i.e. 1400 for testing)
- Wireless connection problem - http://kbserver.netgear.com/kb_web_files/n101299.asp
- upgrade to XP SP2 if not done yet
- update adapter or/and router firmware

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Do you have an old router lying around the house that you don’t know what to do with? Check the make and model, then refer to either of these links to see if its compatible. http://www.dd-wrt.com/site/support/router-database http://www.dd-wrt.c…
Using Windows 2008 RRAS, I was able to successfully VPN into the network, but I was having problems restricting my test user from accessing certain things on the network.  I used Google in order to try to find out how to stop people from accessing c…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Suggested Courses

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question