Only a single PPTP-Linux VPN connection allowed

[Stephen Gornick]

Binary package hint: pptp-linux

I have two Ubuntu 7.10 systems, both can connect to the same VPN, but only one can connect at a time. It doesn't matter which connects to the PPTP VPN server first, but it does so successfully and and subsequent disconnects and reconnects from this same Ubuntu system occur without fail.

When I try to connect from the second Ubuntu 7.10 box to the same VPN, pptp times out (after 10 seconds) and gives an error dialog titled "VPN Connect Failure", and the message "Could not start the VPN connection `My Company` due to a connection error. VPN Connection failed".

I am clued in to the root cause because the syslog on the Ubuntu system that already is connected to the VPN shows:
  pptp[6327]: anon log[decaps_gre:pptp_gre.c:398]: discarding duplicate or old packet 0 (expecting 15)

What I learned is happening is that my firewall (in my case, an old Linksys BEFSR41 Wi-Fi router) is not handling the tunneling protocol GRE correctly, and as a result, responses from the VPN server are never reaching my second Ubuntu box that attempts to connect.

If this was a technical limitation and I needed to replace my router, that is what I would do. However, subsequent attempts to connect to the same VPN from any Windows (e.g., XP Pro) systems do NOT have a problem -- even when several Windows systems are already connect to the VPN and also with my single Ubuntu client already connect to the VPN, all simultaneously.

So, is this a bug, or a wishlist item?

BTW, I do have the "PPTP Pass Through" option enabled on my Linksys BEFSR41.

[Andres Mujica (andres.mujica)]

Hi As far as i know this is a limitation off PPTP protocol, not a real bug

http://en.wikipedia.org/wiki/Pptp
http://forum.pfsense.org/index.php?topic=2507.5;wap2

So you can connect behind such a router to 2 different PPTP tunnels but not to the same one.

What you can do is to create a static route at one of the machines in order to use the pptp connected machine to access the remote site.

[Andres Mujica (andres.mujica)]

Well after checking some info a little bit (i went on doubt) i've found this

http://forums.whirlpool.net.au/forum-replies-archive.cfm/524810.html
http://www.astaro.org/archive/index.php/t-13213.html

My previous post was based on real world experience with a customer, 2 remote locations with 2 pptp clients at each site. it wasn't possible to connect both vpn's. In fact i've found at the time some comment stating that this wasn't possible at all but couldn't find it to paste it here.

But according to your log posts could it be that the router gets confused with the natted connection?? and some kind of interaction with ubuntu TCP/IP stack?

maybe you can try to sniff some traffic and looking at upstream something about this.

[Stephen Gornick (sgornick)]

Just some additional information ... I listed the wrong router model in my first post on this ... should have been Linksys BEFW11S4 (v2).

This week I replaced it with a Linksys WRT54GL and I no longer have the issue and can . This doesn't mean there is no issue with Ubuntu's pptp support, just that that I was able to workaround the problem by changing to newer networking hardware.

But that at least explains why it appears that just a few people are having this issue.

[SK (skiani)]

I have Asante router and have the same limitation. I cannot connect more than one Linux box to the same PPTP server. I can connect at-least two Windows boxes (that's the most I could test) to same server at the same time one Linux box from this net to a single server.

[Andres Mujica (andres.mujica)]

This is probably caused for some incompatibilities between router firmware and linux kernel.

Please provide more information as kernel logs for example, also you can check this from pptp's site.

http://pptpclient.sourceforge.net/howto-diagnosis.phtml

and from ubuntu wiki.

https://help.ubuntu.com/community/VPNClient#PPTP

[James Cameron (quozl)]

Upstream code follows the RFC, and does not imitate the competing implementations exactly, therefore some routers do not handle the simultaneous connections properly, because the routers were coded and tested against other implementations.

Upstream will accept patches that seek to make the on-the-wire format closer to competing implementations.

[Dimitrios Symeonidis (azimout)]

Where are we on this issue? Stephen, is this still an issue for you? Could you please try with Jaunty? Thank you

[Stephen Gornick (sgornick)]

Sorry, I no longer have the equipment (rounter) that would allow me to confirm whether or not the problem still occurs.

[Dimitrios Symeonidis (azimout)]

Anyone else?

[James Cameron (quozl)]

I'm upstream.

My opinion is that the original poster's problem is a combination of the
incomplete implementation of pptp on Linux, and external devices that
were never intended to be operated in that fashion.

We have a feature request logged in our system (TODO) dated 23rd
December 2000 to fix do_gre_copy to handle multiple calls to the same
apparent external IP. There has been no interest in implementing this,
but it is logged.

I don't see any value in Ubuntu maintaining an interest in this feature
request unless there is someone willing to do the work. I don't know
what conditions let you close the bug, but I suggest you find one that
matches.

[Dimitrios Symeonidis (azimout)]

Hi James, thanx for dropping in.
If you can give us a link to the feature request, I'll add the tracker (I couldn't find anything in http://pptpclient.sourceforge.net/).
Otherwise, I'd close as won't fix...

[James Cameron (quozl)]

It's in the TODO file in the source repository and should be in the
.tar.gz, please check?

[Dimitrios Symeonidis (azimout)]

we can't track TODO files in launchpad.
closing this as won't fix, as per the upstream developer's statement...