[Solved] Linux PPTP client NATed behind pfsense firewall
When migrating my PPTP client configuration from an older Linux server to a new one, I could not get a PPTP tunnel up and running on the new server. I kept getting this error flow: using channel 15 Using interface ppp0 Connect: ppp0 <--> /dev/pts/1 sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xxxxx6a93> <pcomp> <accomp>] sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xxxxx6a93> <pcomp> <accomp>] sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xxxxx6a93> <pcomp> <accomp>] sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xxxxx6a93> <pcomp> <accomp>] sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xxxxx6a93> <pcomp> <accomp>] sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xxxxx6a93> <pcomp> <accomp>] sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xxxxx6a93> <pcomp> <accomp>] Script pptp vpn.xxxxxxxx.com --nolaunchpppd finished (pid 23704), status = 0x0 Modem hangup So I was sending, but getting nothing back. I tripple checked my configuration, and tweaked a few settings. No luck. Then I stumbled on an article that talked about the challenges of PPTP behind NAT devices. I already knew about the common issue of not being able to dial out with more than one client session to a remote PPTP server. For that reason I was careful not to have more than one open at the same time, but I thought I'd dig a bit deeper to see if NAT was the culprit. Long story short, I noticed that pfsense -> diagnostics -> pftop was showing a GRE state from old server to the destination VPN server. It showed age of 3+ hours (forgot the exact number) even though I was sure that the PPTP session on the old server was shut down. I reset the firewall state on pfsense, and it started to work immediately. The moral of the story is that pfsense likes to keep the GRE state open for hours after it's been disconnected. That is a problem. Packets go out, but they are NATed to the wrong server when they come back. Version details: Pfsense: 2.1.4-RELEASE (i386) PPTP: 1.7.2 Linux: Ubuntu 14.04.1 LTS