Suddenly VPN disconnected and can't reconnect no longer on kernel 3.18.1, so I try to install kernel 3.18.2 but my problem still exist. But I can connect to VPN with 3.14 kernel easily.

The output of syslog:

Jan 11 17:43:51 DEMON NetworkManager[7443]: <info> Starting VPN service 'pptp'...
Jan 11 17:43:51 DEMON NetworkManager[7443]: <info> VPN service 'pptp' started (org.freedesktop.NetworkManager.pptp), PID 8741
Jan 11 17:43:51 DEMON NetworkManager[7443]: <info> VPN service 'pptp' appeared; activating connections
Jan 11 17:43:51 DEMON NetworkManager[7443]: <info> VPN plugin state changed: starting (3)
Jan 11 17:43:51 DEMON NetworkManager[7443]: <info> VPN connection 'VPN connection 1' (Connect) reply received.
Jan 11 17:43:51 DEMON pppd[8742]: Plugin /usr/lib/pppd/2.4.5/nm-pptp-pppd-plugin.so loaded.
Jan 11 17:43:51 DEMON pppd[8742]: pppd 2.4.5 started by root, uid 0
Jan 11 17:43:51 DEMON pppd[8742]: Using interface ppp0
Jan 11 17:43:51 DEMON pppd[8742]: Connect: ppp0 <--> /dev/pts/25
Jan 11 17:43:51 DEMON pptp[8747]: nm-pptp-service-8741 log[main:pptp.c:314]: The synchronous pptp option is NOT activated
Jan 11 17:43:51 DEMON NetworkManager[7443]:    SCPlugin-Ifupdown: devices added (path: /sys/devices/virtual/net/ppp0, iface: ppp0)
Jan 11 17:43:51 DEMON NetworkManager[7443]:    SCPlugin-Ifupdown: device added (path: /sys/devices/virtual/net/ppp0, iface: ppp0): no ifupdown configuration found.
Jan 11 17:43:51 DEMON NetworkManager[7443]: <warn> /sys/devices/virtual/net/ppp0: couldn't determine device driver; ignoring...
Jan 11 17:43:51 DEMON pptp[8761]: nm-pptp-service-8741 log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 1 'Start-Control-Connection-Request'
Jan 11 17:43:51 DEMON pptp[8761]: nm-pptp-service-8741 log[ctrlp_disp:pptp_ctrl.c:739]: Received Start Control Connection Reply
Jan 11 17:43:51 DEMON pptp[8761]: nm-pptp-service-8741 log[ctrlp_disp:pptp_ctrl.c:773]: Client connection established.
Jan 11 17:43:52 DEMON pptp[8761]: nm-pptp-service-8741 log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 7 'Outgoing-Call-Request'
Jan 11 17:43:52 DEMON pptp[8761]: nm-pptp-service-8741 log[ctrlp_disp:pptp_ctrl.c:858]: Received Outgoing Call Reply.
Jan 11 17:43:52 DEMON pptp[8761]: nm-pptp-service-8741 log[ctrlp_disp:pptp_ctrl.c:897]: Outgoing call established (call ID 0, peer's call ID 37038).
Jan 11 17:43:53 DEMON vnstatd[1509]: Interface "ppp0" enabled.
Jan 11 17:43:55 DEMON kernel: [  921.480993] [UFW BLOCK] IN=wlan0 OUT= MAC=74:de:2b:02:0b:da:50:1c:bf:61:6f:41:08:00 SRC=192.168.0.1 DST=192.168.74.15 LEN=55 TOS=0x00 PREC=0x00 TTL=63 ID=64925 PROTO=47 
Jan 11 17:43:55 DEMON kernel: [  922.096723] [UFW BLOCK] IN=wlan0 OUT= MAC=74:de:2b:02:0b:da:50:1c:bf:61:6f:41:08:00 SRC=192.168.0.1 DST=192.168.74.15 LEN=54 TOS=0x00 PREC=0x00 TTL=63 ID=64926 PROTO=47 
Jan 11 17:43:57 DEMON kernel: [  923.911774] [UFW BLOCK] IN=wlan0 OUT= MAC=74:de:2b:02:0b:da:50:1c:bf:61:6f:41:08:00 SRC=192.168.0.1 DST=192.168.74.15 LEN=55 TOS=0x00 PREC=0x00 TTL=63 ID=64927 PROTO=47 
Jan 11 17:44:16 DEMON kernel: [  943.116984] [UFW BLOCK] IN=wlan0 OUT= MAC=74:de:2b:02:0b:da:50:1c:bf:61:6f:41:08:00 SRC=192.168.0.1 DST=192.168.74.15 LEN=54 TOS=0x00 PREC=0x00 TTL=63 ID=64937 PROTO=47 
Jan 11 17:44:22 DEMON pppd[8742]: LCP: timeout sending Config-Requests
Jan 11 17:44:22 DEMON pppd[8742]: Connection terminated.
Jan 11 17:44:22 DEMON NetworkManager[7443]: <warn> VPN plugin failed: 1
Jan 11 17:44:22 DEMON NetworkManager[7443]:    SCPlugin-Ifupdown: devices removed (path: /sys/devices/virtual/net/ppp0, iface: ppp0)
Jan 11 17:44:22 DEMON pppd[8742]: Modem hangup
Jan 11 17:44:22 DEMON pptp[8747]: nm-pptp-service-8741 warn[decaps_hdlc:pptp_gre.c:204]: short read (-1): Input/output error
Jan 11 17:44:22 DEMON pptp[8747]: nm-pptp-service-8741 warn[decaps_hdlc:pptp_gre.c:216]: pppd may have shutdown, see pppd log
Jan 11 17:44:22 DEMON pptp[8761]: nm-pptp-service-8741 log[callmgr_main:pptp_callmgr.c:234]: Closing connection (unhandled)
Jan 11 17:44:22 DEMON pptp[8761]: nm-pptp-service-8741 log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 12 'Call-Clear-Request'
Jan 11 17:44:22 DEMON pppd[8742]: Exit.
Jan 11 17:44:22 DEMON NetworkManager[7443]: <warn> VPN plugin failed: 1
Jan 11 17:44:22 DEMON pptp[8761]: nm-pptp-service-8741 log[call_callback:pptp_callmgr.c:79]: Closing connection (call state)
Jan 11 17:44:22 DEMON NetworkManager[7443]: <warn> VPN plugin failed: 1
Jan 11 17:44:22 DEMON NetworkManager[7443]: <info> VPN plugin state changed: stopped (6)
Jan 11 17:44:22 DEMON NetworkManager[7443]: <info> VPN plugin state change reason: 0
Jan 11 17:44:22 DEMON NetworkManager[7443]: <info> Policy set '4r@z31' (wlan0) as default for IPv4 routing and DNS.
Jan 11 17:44:22 DEMON NetworkManager[7443]: <warn> error disconnecting VPN: Could not process the request because no VPN connection was active.
Jan 11 17:44:23 DEMON vnstatd[1509]: Interface "ppp0" disabled.
Jan 11 17:44:28 DEMON NetworkManager[7443]: <info> VPN service 'pptp' disappeared

UPDATE

My problem solved by disabling ufw, could you please help me to solve this conflict of firewall and vpn?

UPDATE 2

So I try to add

-A ufw-before-input -p 47 -j ACCEPT
-A ufw-before-output -p 47 -j ACCEPT

into /etc/ufw/before.rules but my problem still exist.

up vote 34 down vote accepted

This is caused by a change for security reason in kernel 3.18 [1]. There are two ways to fix this.

First approach is adding this rule to the file /etc/ufw/before.rules before the line # drop INVALID packets ...

-A ufw-before-input -p 47 -j ACCEPT

Second approach is manually loading the nf_conntrack_pptp module. You can do this by running

sudo modprobe nf_conntrack_pptp

To load this module on every boot on Ubuntu, add it to the file /etc/modules.

  • 3
    First approach worked for me, thanks... – Daniyal Feb 14 '15 at 12:22
  • 2
    Don't forget to restart ufw to reload the new configuration. – RedPixel Aug 7 '15 at 12:54
  • 1
    You save my life!!! – Allen Sep 16 '15 at 6:49
  • 1
    @wwwhizz You mean sudo ufw reload ? That seems to do it, once I found the correct part of the file to add that rule to. – NoBugs Sep 25 '15 at 3:16
  • I wonder, how could this sort of thing be done through the gufw ui? – Fuzzy Analysis Jan 27 at 0:05

For more recent versions of ufw a solution is instead:

sudo ufw allow proto gre from [PPTP gateway IP address]
sudo systemctl restart ufw
  • 3
    Answers should be as complete as possible and stand on their own - if you just want to add something to an existing answer please use a comment. – guntbert Jun 21 '17 at 18:55
  • @Draco woah there! There is no call to insult other users. And we expect all users to act with civility here. – terdon Jul 18 at 10:43
  • I'll just mention for future visitors: this solution is complete and not intended to be added on to any of the others. – Dzamo Norton Jul 18 at 16:30

Add nf_conntrack_pptp to /etc/modules-load.d/pptp.conf

One liner

echo nf_conntrack_pptp | sudo tee /etc/modules-load.d/pptp.conf

Explanation

The accepted answer works for me, especially the 2nd suggestion--loading the nf_conntrack_pptp kernel module--as opposed to modifying my iptables firewall. My laptop firewall is otherwise unmodified. sudo ufw enable without exceptions is nice and clean. But I don't like editing /etc/modules by hand... future package upgrades may have conflicts. /etc/modules-load.d/ provides an upgrade-friendly and more easily automatable way to load the module.

See also

Is there a ".d" directory to use to load modules at boot time, opposed to /etc/modules?

Parting shot: Do not use PPTP!

Try openvpn instead.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.