Ubuntu – Can’t access website though PPTP VPN

Ubuntuvpn

I have setup a VPN server on AWS Ubuntu 14.04.1 LTS VPS. And I added NAT on the server for my Win7 client PC. After I connect to that VPN, I can't access any websites. But I can ping google.com from my Win7 client PC. And the nslookup works well when I was typing nslookup google.com.

I did the following steps for VPN and NAT setup:

Installed necessary packages

sudo aptitude install ppp pptpd iptables

Configured PPTP IP ranges on the server

sudo vim /etc/pptpd.conf

localip 192.168.100.1
remoteip 192.168.100.1-199

Configured DNS servers to use when clients connect to this PPTP server

sudo vim /etc/ppp/pptpd-options

ms-dns 8.8.8.8
ms-dns 8.8.4.4

Added a test account

sudo vim /etc/ppp/chap-secrets

# client    server  secret          IP addresses
test    pptpd   abcd1234    *

Added iptables rule

sudo vim /etc/rc.local
sudo iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -j MASQUERADE

Enabled IPv4 forwading

sudo vim /etc/sysctl.conf

net.ipv4.ip_forward=1

Reloaded the configuration

sudo sysctl -p

Rebooted the server

sudo reboot

Here are the logs for PPTPD and PPPD when VPN connection establishing:

Dec 26 02:20:45 ip-172-31-14-72 pptpd[1225]: CTRL: Client 183.62.136.251 control connection started
Dec 26 02:20:45 ip-172-31-14-72 pptpd[1225]: CTRL: Starting call (launching pppd, opening GRE)
Dec 26 02:20:45 ip-172-31-14-72 pppd[1226]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded.
Dec 26 02:20:45 ip-172-31-14-72 pppd[1226]: pptpd-logwtmp: $Version$
Dec 26 02:20:45 ip-172-31-14-72 pppd[1226]: pppd 2.4.5 started by root, uid 0
Dec 26 02:20:45 ip-172-31-14-72 pppd[1226]: using channel 1
Dec 26 02:20:45 ip-172-31-14-72 pppd[1226]: Using interface ppp0
Dec 26 02:20:45 ip-172-31-14-72 pppd[1226]: Connect: ppp0 <--> /dev/pts/1
Dec 26 02:20:45 ip-172-31-14-72 pppd[1226]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x893bee97> <pcomp> <accomp>]
Dec 26 02:20:46 ip-172-31-14-72 pppd[1226]: rcvd [LCP ConfReq id=0x0 <mru 1400> <magic 0x79ad5454> <pcomp> <accomp> <callback CBCP>]
Dec 26 02:20:46 ip-172-31-14-72 pppd[1226]: sent [LCP ConfRej id=0x0 <callback CBCP>]
Dec 26 02:20:46 ip-172-31-14-72 pppd[1226]: rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x893bee97> <pcomp> <accomp>]
Dec 26 02:20:46 ip-172-31-14-72 pppd[1226]: rcvd [LCP ConfReq id=0x1 <mru 1400> <magic 0x79ad5454> <pcomp> <accomp>]
Dec 26 02:20:46 ip-172-31-14-72 pppd[1226]: sent [LCP ConfAck id=0x1 <mru 1400> <magic 0x79ad5454> <pcomp> <accomp>]
Dec 26 02:20:46 ip-172-31-14-72 pppd[1226]: sent [LCP EchoReq id=0x0 magic=0x893bee97]
Dec 26 02:20:46 ip-172-31-14-72 pppd[1226]: sent [CHAP Challenge id=0x75 <a27aa8aa1ca5bb9e4f326ff8ea59b781>, name = "pptpd"]
Dec 26 02:20:46 ip-172-31-14-72 pppd[1226]: rcvd [LCP Ident id=0x2 magic=0x79ad5454 "MSRASV5.20"]
Dec 26 02:20:46 ip-172-31-14-72 pppd[1226]: rcvd [LCP Ident id=0x3 magic=0x79ad5454 "MSRAS-0-PC201404170414"]
Dec 26 02:20:46 ip-172-31-14-72 pppd[1226]: rcvd [LCP Ident id=0x4 magic=0x79ad5454 "\010w\377777777774\37777777607\37777777651\37777777676H\37777777667\37777777737\006\37777777665\017\37777777777\37777777652\37777777655"]
Dec 26 02:20:46 ip-172-31-14-72 pppd[1226]: rcvd [LCP EchoRep id=0x0 magic=0x79ad5454]
Dec 26 02:20:46 ip-172-31-14-72 pppd[1226]: rcvd [CHAP Response id=0x75 <0a403b0e014f3edabcf7ae41b863f2ad0000000000000000cfe4bbbd236c21274289fc6a6db9383acad0868e955e08f900>, name = "mtc"]
Dec 26 02:20:46 ip-172-31-14-72 pppd[1226]: sent [CHAP Success id=0x75 "S=B4CF7D2F19305CFC72BE10F163487851E9DE8F80 M=Access granted"]
Dec 26 02:20:46 ip-172-31-14-72 pppd[1226]: peer from calling number 183.62.136.251 authorized
Dec 26 02:20:46 ip-172-31-14-72 pppd[1226]: sent [CCP ConfReq id=0x1 <mppe +H -M +S -L -D -C>]
Dec 26 02:20:46 ip-172-31-14-72 kernel: [7682099.701630] PPP MPPE Compression module registered
Dec 26 02:20:47 ip-172-31-14-72 pppd[1226]: rcvd [IPV6CP ConfReq id=0x5 <addr fe80::50b0:7670:15ae:d6f4>]
Dec 26 02:20:47 ip-172-31-14-72 pppd[1226]: Unsupported protocol 'IPv6 Control Protocol' (0x8057) received
Dec 26 02:20:47 ip-172-31-14-72 pppd[1226]: sent [LCP ProtRej id=0x2 80 57 01 05 00 0e 01 0a 50 b0 76 70 15 ae d6 f4]
Dec 26 02:20:47 ip-172-31-14-72 pppd[1226]: rcvd [CCP ConfReq id=0x6 <mppe +H -M +S -L -D -C>]
Dec 26 02:20:47 ip-172-31-14-72 pppd[1226]: sent [CCP ConfAck id=0x6 <mppe +H -M +S -L -D -C>]
Dec 26 02:20:47 ip-172-31-14-72 pppd[1226]: rcvd [IPCP ConfReq id=0x7 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-wins 0.0.0.0> <ms-dns2 0.0.0.0> <ms-wins 0.0.0.0>]
Dec 26 02:20:47 ip-172-31-14-72 pppd[1226]: sent [IPCP TermAck id=0x7]
Dec 26 02:20:47 ip-172-31-14-72 pppd[1226]: rcvd [CCP ConfAck id=0x1 <mppe +H -M +S -L -D -C>]
Dec 26 02:20:47 ip-172-31-14-72 pppd[1226]: MPPE 128-bit stateless compression enabled
Dec 26 02:20:47 ip-172-31-14-72 pppd[1226]: sent [IPCP ConfReq id=0x1 <addr 192.168.100.1>]
Dec 26 02:20:47 ip-172-31-14-72 pppd[1226]: rcvd [IPCP ConfAck id=0x1 <addr 192.168.100.1>]
Dec 26 02:20:48 ip-172-31-14-72 pppd[1226]: rcvd [IPCP ConfReq id=0x8 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-wins 0.0.0.0> <ms-dns2 0.0.0.0> <ms-wins 0.0.0.0>]
Dec 26 02:20:48 ip-172-31-14-72 pppd[1226]: sent [IPCP ConfRej id=0x8 <ms-wins 0.0.0.0> <ms-wins 0.0.0.0>]
Dec 26 02:20:48 ip-172-31-14-72 pppd[1226]: rcvd [IPCP ConfReq id=0x9 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
Dec 26 02:20:48 ip-172-31-14-72 pppd[1226]: sent [IPCP ConfNak id=0x9 <addr 192.168.100.100> <ms-dns1 8.8.8.8> <ms-dns2 8.8.4.4>]
Dec 26 02:20:49 ip-172-31-14-72 pppd[1226]: rcvd [IPCP ConfReq id=0xa <addr 192.168.100.100> <ms-dns1 8.8.8.8> <ms-dns2 8.8.4.4>]
Dec 26 02:20:49 ip-172-31-14-72 pppd[1226]: sent [IPCP ConfAck id=0xa <addr 192.168.100.100> <ms-dns1 8.8.8.8> <ms-dns2 8.8.4.4>]
Dec 26 02:20:49 ip-172-31-14-72 pppd[1226]: Cannot determine ethernet address for proxy ARP
Dec 26 02:20:49 ip-172-31-14-72 pppd[1226]: local  IP address 192.168.100.1
Dec 26 02:20:49 ip-172-31-14-72 pppd[1226]: remote IP address 192.168.100.100
Dec 26 02:20:49 ip-172-31-14-72 pppd[1226]: pptpd-logwtmp.so ip-up ppp0 mtc 183.62.136.251
Dec 26 02:20:49 ip-172-31-14-72 pppd[1226]: Script /etc/ppp/ip-up started (pid 1252)
Dec 26 02:20:49 ip-172-31-14-72 pppd[1226]: Script /etc/ppp/ip-up finished (pid 1252), status = 0x0

Best Answer

After I restarted the VPS from EC2 Management Console, the VPS got another new public ip, then the issue is solved. That's very strange. I think that's relate to AWS's complicate network setup.

Related Solutions

PPTP VPN – users cannot access internet via the server

A proxy server is typically an applicaiton-layer function. I believe that when you say "act like a proxy" you're really saying "route their traffic across the VPN to that server which will, in turn, route the traffic to its default gateway and ultimately to the Internet".

I'd start with a "tracert" (or OS equivalent command) from a client while connected to the VPN to an Internet address and see where the traffic is going.

It's fairly commonplace in the Microsoft VPN client for users to untick the "Use default gateway on remote network" (set in the "Advanced" settings of TCP/IP on the VPN connection) which will cause only traffic bound for the remote VPN subnet to cross the VPN. Have you checked to see that no one has unticked that box on the clients?

Typically the Microsoft VPN client will "push down" the DNS and WINS settings from the VPN server to the client computers. If the clients are having an inability to access web sites with a browser, for example, it may be that they are routing traffic down the VPN tunnel but that the DNS server being "pushed down" can't resolve Internet names.

Viewing the routing table on a client while connected with the "route print" command will also help figure out what's going on. There should be two default-gateway (0.0.0.0 with a subnet mask of 0.0.0.0) entries on a client that's configured to route all traffic down the VPN-- one for the client's on-subnet default gateway, and one "pointing" to the VPN tunnel.

Edit:

If you want all the traffic from the VPN clients to cross the VPN and egress to the Internet from the VPN "hub" then leave the "Use default gateway on remote network" checkbox ticked on the client computers.

I would suspect that you're having a name resolution problem. I'd connect a client to the VPN and do the following:

tracert -d (your favorite Internet IP address here)

You can use any IP address you want in that command, so long as it's something that's really reachable. Heck, use the IP address of "star.slashdot.org"-- I've already used it in some examples on here... >smile&lt 216.34.181.48

That will show you the route that packets are taking. It's important to use an IP address in that command so that you aren't relying on DNS.

If that looks okay (i.e. you see the packets cross the VPN and leave through the VPN "hub" Internet connection) then give DNS a shot:

nslookup star.slashdot.org

You should get back something like:

C:\>nslookup star.slashdot.org
Server:  the-name-of-the-VPN-server's-DNS-server
Address:  the-ip-address-of-the-VPN-server's-DNS-server

Non-authoritative answer:
Name:    star.slashdot.org
Address:  216.34.181.48

If you get back something nasty like this then the remote DNS server isn't configured to resolve Internet names.

*** the-name-of-the-VPN-server's-DNS-server can't find star.slashdot.org: Non-existent domain

If you get back something like this then the VPN server doesn't have a valid DNS server specified:

C:\>nslookup star.slashdot.org
Server:  [the-ip-address-of-the-VPN-server's-DNS-server]
Address:  the-ip-address-of-the-VPN-server's-DNS-server

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to [the-ip-address-of-the-VPN-server's-DNS-server] timed-out

Windows – Can’t establish PPTP VPN windows 8/8.1

I had the same problem. I could connect from iPhone, even from one Win 8.1 Pro desktop machine but not from two laptops running Win 8.1 all connected to the same network. Disabled firewall but no luck.

I accessed the VPN server via its numeric IP address (IPv4). That seemed to be the problem. After I added the VPN server IP to my hosts file and gave it a name I could connect instantly using that name.

Best Answer

Related Solutions

PPTP VPN – users cannot access internet via the server

Windows – Can’t establish PPTP VPN windows 8/8.1

Related Topic