Can't connect to PPTP VPN with ufw enabled on Ubuntu 14.04 with kernel 3.18
Solution 1
This is caused by a change for security reason in kernel 3.18 [1]. There are two ways to fix this.
First approach is adding this rule to the file /etc/ufw/before.rules
before the line # drop INVALID packets ...
-A ufw-before-input -p 47 -j ACCEPT
Second approach is manually loading the nf_conntrack_pptp
module. You can do this by running
sudo modprobe nf_conntrack_pptp
To load this module on every boot on Ubuntu, add it to the file /etc/modules
.
Solution 2
For ufw >= 0.34-2, a simple solution is:
sudo ufw allow proto gre from [PPTP gateway IP address]
Solution 3
Add nf_conntrack_pptp
to /etc/modules-load.d/pptp.conf
One liner
echo nf_conntrack_pptp | sudo tee /etc/modules-load.d/pptp.conf
Explanation
The accepted answer works for me, especially the 2nd suggestion--loading the nf_conntrack_pptp
kernel module--as opposed to modifying my iptables firewall. My laptop firewall is otherwise unmodified. sudo ufw enable
without exceptions is nice and clean. But I don't like editing /etc/modules
by hand... future package upgrades may have conflicts. /etc/modules-load.d/
provides an upgrade-friendly and more easily automatable way to load the module.
See also
Is there a ".d" directory to use to load modules at boot time, opposed to /etc/modules?
Parting shot: Do not use PPTP!
- https://www.schneier.com/cryptography/pptp/faq.html
- https://en.wikipedia.org/wiki/Point-to-Point_Tunneling_Protocol
- http://www.howtogeek.com/211329/which-is-the-best-vpn-protocol-pptp-vs.-openvpn-vs.-l2tpipsec-vs.-sstp/
Try openvpn instead.
Related videos on Youtube
Daniyal Javani
Updated on September 18, 2022Comments
-
Daniyal Javani over 1 year
Suddenly VPN disconnected and can't reconnect no longer on kernel 3.18.1, so I try to install kernel 3.18.2 but my problem still exist. But I can connect to VPN with 3.14 kernel easily.
The output of syslog:
Jan 11 17:43:51 DEMON NetworkManager[7443]: <info> Starting VPN service 'pptp'... Jan 11 17:43:51 DEMON NetworkManager[7443]: <info> VPN service 'pptp' started (org.freedesktop.NetworkManager.pptp), PID 8741 Jan 11 17:43:51 DEMON NetworkManager[7443]: <info> VPN service 'pptp' appeared; activating connections Jan 11 17:43:51 DEMON NetworkManager[7443]: <info> VPN plugin state changed: starting (3) Jan 11 17:43:51 DEMON NetworkManager[7443]: <info> VPN connection 'VPN connection 1' (Connect) reply received. Jan 11 17:43:51 DEMON pppd[8742]: Plugin /usr/lib/pppd/2.4.5/nm-pptp-pppd-plugin.so loaded. Jan 11 17:43:51 DEMON pppd[8742]: pppd 2.4.5 started by root, uid 0 Jan 11 17:43:51 DEMON pppd[8742]: Using interface ppp0 Jan 11 17:43:51 DEMON pppd[8742]: Connect: ppp0 <--> /dev/pts/25 Jan 11 17:43:51 DEMON pptp[8747]: nm-pptp-service-8741 log[main:pptp.c:314]: The synchronous pptp option is NOT activated Jan 11 17:43:51 DEMON NetworkManager[7443]: SCPlugin-Ifupdown: devices added (path: /sys/devices/virtual/net/ppp0, iface: ppp0) Jan 11 17:43:51 DEMON NetworkManager[7443]: SCPlugin-Ifupdown: device added (path: /sys/devices/virtual/net/ppp0, iface: ppp0): no ifupdown configuration found. Jan 11 17:43:51 DEMON NetworkManager[7443]: <warn> /sys/devices/virtual/net/ppp0: couldn't determine device driver; ignoring... Jan 11 17:43:51 DEMON pptp[8761]: nm-pptp-service-8741 log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 1 'Start-Control-Connection-Request' Jan 11 17:43:51 DEMON pptp[8761]: nm-pptp-service-8741 log[ctrlp_disp:pptp_ctrl.c:739]: Received Start Control Connection Reply Jan 11 17:43:51 DEMON pptp[8761]: nm-pptp-service-8741 log[ctrlp_disp:pptp_ctrl.c:773]: Client connection established. Jan 11 17:43:52 DEMON pptp[8761]: nm-pptp-service-8741 log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 7 'Outgoing-Call-Request' Jan 11 17:43:52 DEMON pptp[8761]: nm-pptp-service-8741 log[ctrlp_disp:pptp_ctrl.c:858]: Received Outgoing Call Reply. Jan 11 17:43:52 DEMON pptp[8761]: nm-pptp-service-8741 log[ctrlp_disp:pptp_ctrl.c:897]: Outgoing call established (call ID 0, peer's call ID 37038). Jan 11 17:43:53 DEMON vnstatd[1509]: Interface "ppp0" enabled. Jan 11 17:43:55 DEMON kernel: [ 921.480993] [UFW BLOCK] IN=wlan0 OUT= MAC=74:de:2b:02:0b:da:50:1c:bf:61:6f:41:08:00 SRC=192.168.0.1 DST=192.168.74.15 LEN=55 TOS=0x00 PREC=0x00 TTL=63 ID=64925 PROTO=47 Jan 11 17:43:55 DEMON kernel: [ 922.096723] [UFW BLOCK] IN=wlan0 OUT= MAC=74:de:2b:02:0b:da:50:1c:bf:61:6f:41:08:00 SRC=192.168.0.1 DST=192.168.74.15 LEN=54 TOS=0x00 PREC=0x00 TTL=63 ID=64926 PROTO=47 Jan 11 17:43:57 DEMON kernel: [ 923.911774] [UFW BLOCK] IN=wlan0 OUT= MAC=74:de:2b:02:0b:da:50:1c:bf:61:6f:41:08:00 SRC=192.168.0.1 DST=192.168.74.15 LEN=55 TOS=0x00 PREC=0x00 TTL=63 ID=64927 PROTO=47 Jan 11 17:44:16 DEMON kernel: [ 943.116984] [UFW BLOCK] IN=wlan0 OUT= MAC=74:de:2b:02:0b:da:50:1c:bf:61:6f:41:08:00 SRC=192.168.0.1 DST=192.168.74.15 LEN=54 TOS=0x00 PREC=0x00 TTL=63 ID=64937 PROTO=47 Jan 11 17:44:22 DEMON pppd[8742]: LCP: timeout sending Config-Requests Jan 11 17:44:22 DEMON pppd[8742]: Connection terminated. Jan 11 17:44:22 DEMON NetworkManager[7443]: <warn> VPN plugin failed: 1 Jan 11 17:44:22 DEMON NetworkManager[7443]: SCPlugin-Ifupdown: devices removed (path: /sys/devices/virtual/net/ppp0, iface: ppp0) Jan 11 17:44:22 DEMON pppd[8742]: Modem hangup Jan 11 17:44:22 DEMON pptp[8747]: nm-pptp-service-8741 warn[decaps_hdlc:pptp_gre.c:204]: short read (-1): Input/output error Jan 11 17:44:22 DEMON pptp[8747]: nm-pptp-service-8741 warn[decaps_hdlc:pptp_gre.c:216]: pppd may have shutdown, see pppd log Jan 11 17:44:22 DEMON pptp[8761]: nm-pptp-service-8741 log[callmgr_main:pptp_callmgr.c:234]: Closing connection (unhandled) Jan 11 17:44:22 DEMON pptp[8761]: nm-pptp-service-8741 log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 12 'Call-Clear-Request' Jan 11 17:44:22 DEMON pppd[8742]: Exit. Jan 11 17:44:22 DEMON NetworkManager[7443]: <warn> VPN plugin failed: 1 Jan 11 17:44:22 DEMON pptp[8761]: nm-pptp-service-8741 log[call_callback:pptp_callmgr.c:79]: Closing connection (call state) Jan 11 17:44:22 DEMON NetworkManager[7443]: <warn> VPN plugin failed: 1 Jan 11 17:44:22 DEMON NetworkManager[7443]: <info> VPN plugin state changed: stopped (6) Jan 11 17:44:22 DEMON NetworkManager[7443]: <info> VPN plugin state change reason: 0 Jan 11 17:44:22 DEMON NetworkManager[7443]: <info> Policy set '4r@z31' (wlan0) as default for IPv4 routing and DNS. Jan 11 17:44:22 DEMON NetworkManager[7443]: <warn> error disconnecting VPN: Could not process the request because no VPN connection was active. Jan 11 17:44:23 DEMON vnstatd[1509]: Interface "ppp0" disabled. Jan 11 17:44:28 DEMON NetworkManager[7443]: <info> VPN service 'pptp' disappeared
UPDATE
My problem solved by disabling ufw, could you please help me to solve this conflict of firewall and vpn?
UPDATE 2
So I try to add
-A ufw-before-input -p 47 -j ACCEPT -A ufw-before-output -p 47 -j ACCEPT
into
/etc/ufw/before.rules
but my problem still exist. -
RedPixel almost 9 yearsDon't forget to restart ufw to reload the new configuration.
-
Allen over 8 yearsYou save my life!!!
-
NoBugs over 8 years@wwwhizz You mean
sudo ufw reload
? That seems to do it, once I found the correct part of the file to add that rule to. -
guntbert almost 7 yearsAnswers should be as complete as possible and stand on their own - if you just want to add something to an existing answer please use a comment.
-
Fuzzy Analysis over 6 yearsI wonder, how could this sort of thing be done through the gufw ui?
-
terdon almost 6 years@Draco woah there! There is no call to insult other users. And we expect all users to act with civility here.
-
Dzamo Norton almost 6 yearsI'll just mention for future visitors: this solution is complete and not intended to be added on to any of the others.
-
peterh almost 5 years"nf_conntrack_pptp" did not work by me, but allowing proto 47 (GRE), as the OP writes, it did.
-
php_nub_qq almost 4 yearsDidn't even need to restart ufw, worked right after adding the rule.
-
SdSaati over 2 yearsyour method worked, thank you so much