[ previous ] [ next ] [ threads ]
 
 From:  "Jeff Scott" <scott at advbiol dot com>
 To:  <m0n0wall at lists dot m0n0 dot ch>
 Subject:  PPTP Client behind m0n0 = Remote Desktop MTU/Fragmentation Problem
 Date:  Tue, 21 Mar 2006 09:46:01 -0500
Hi all,

I believe this issue (or a related one) has been brought up before.  But, I don't think I've seen a
solid solution or even a solid explanation.

I am connecting to our m0n0 1.21 PPTP server at work.  My home machine is also behind a m0n0wall
1.21.  I switched my home machine to m0n0 about 4 months ago.  Originally, I was running GTA's
GNATBox Light Floppy Firewall (This is also built on FreeBSD). 

When I first switched, I could connect to the VPN just fine. But, Remote Desktop would act like it
was starting and then just hang at a blank screen (Never getting the logon prompt)  Eventually, it
times out and gives an error.  From past experiences with Microsoft's ISA Firewall, I recognized
this symptom as a MTU/Fragmentation issue.  (In ISA's case, a hotfix corrected the problem)

At that time, I played around with creating LAN rules specific for PPTP and checking the "Allow
Fragmented Packets" checkbox.  I am unclear now if that actually did the trick or not.  I remember
that it just "started working", so I left the rules alone.

Now out of the blue, this problem has re-emerged.  I have rebooted several times both m0n0walls,
attempted unchecking/rechecking the Allow Fragmented Packets.  All to no avail.  Finally, I booted
my home firewall back up to GNATBox Light.  After that, Remote Desktop works fine.

It appears that my home m0n0wall is having trouble with PPTP pass-through.  Although, I have no idea
why it worked fine for 4 months.  Unless the MTU of a router in the path from my home (cable
internet) through the Internet to my company has changed (Which is obviously out of my control).

I did try lowering the MTU on the WAN interface to 1000.  That did not do anything.  But, I'm not
sure if I needed to reboot everything for that to really take effect.  Or do I need to try something
like 500.  I also did not try playing with the MTU on my computer either.

Any insight would be appreciated!

Thanks,

Jeff