Home / ubuntu / Questions / 1030866
In Process
Mark Johnson
Asked: 2018-05-02 20:30:56 +0800 CST

PPTP VPN passthrough stopped working on 18.04

  • 772

I've just upgraded to 18.04, and I have a problem that my wife cannot connect to her work PPTP-based VPN through our home network (Linux box operates as router). If I bypass the linux box, the VPN connection connects fine.

I had trouble setting this up back in the day, until I found I needed load module nf_nat_pptp. After that, it worked fine until the upgrade. I've tried disabling UFW, but it still won't work.

I can't seem to get much debug information on this. (Any debug tips?) The only thread I've got on the problem is a RasSstp error in Windows with message, "A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider." Would the Linux box (as router) need to be aware of the certification authority to allow the route?! Or perhaps it's inserting its own certificate in the chain, and that isn't a trusted CA at the Windows server end?

I just don't know enough about the protocol to unwind this---any help would be greatly appreciated.

vpn pptp

2 Answers

  1. Ubuntu 18.04.1 server
    PPTP PassThrough started to work after adding 

    net.netfilter.nf_conntrack_helper = 1

    and adding the module with: 

    modprobe ip_nat_pptp

    This should fix the problem.

    • 3

  2. I found the issue. I had to add:

       net.netfilter.nf_conntrack_helper = 1

    to /etc/sysctl.conf. Seems that by default the helper is off by default in newer kernel builds. (Think it's meant to be applied very selectively via the iptables. (Close as I get to iptables is UFW.) If you figure out how to do it selectively via the iptables, let me known.

    This setting, or me switching to netplan from ifupdown in desperation seemed to cause an dnsmasq race issue in my system. I added the following---but time will tell if it always works around the race (might go back to ifupdown if it persists).

    sudo systemctl edit dnsmasq` and add the three lines:

    [Unit]
After=network-online.target
Wants=network-online.target
    • 0