8

While trying to connect with the Windows VPN client, the client hangs at the "Verifying user name and password..." message for about 10 seconds, and then I get the following error message:

Error 619: A connection to the remote computer could not be established, so the port used for this connection was closed.

I can connect successfully using Windows 7 Professional 64-bit, but not with Windows 7 Home Premium 64-bit. Both machines are off the network I'm trying to VPN into and are on the same network. Windows Firewall is disabled on both machines. No antivirus on either machine, clean Windows installs.

I'm using Windows VPN client with the following settings:

  • Options tab: Unchecked "Include Windows logon domain"
  • Security tab: "Type of VPN" set to PPTP, "Data encryption" set to Optional, CHAP and MS-CHAP v2 checked
  • Networking tab: IPv6 disabled, use remote gateway disabled
  • Network IP(DHCP)/Subnet: 192.168.10.x 255.255.255.252

The server:

  • pptpd linux package running on Raspbian Wheezy OS
  • Network IP(Static)/Subnet: 192.168.1.x 255.255.255.0

pptpd.conf:

logwtmp

localip 192.168.1.161

remoteip 192.168.1.234-238,192.168.1.245

The router is a Linksys WRT160N v3 running DD WRT firmware with GRE 47 enabled and port 1723 forwarded correctly to the server.

What could be the problem and how can I fix it?

EDIT(NEW FINDINGS): When DMZ is enabled, the Windows Home machine can connect to the VPN, when disabled it can't. However, the Windows Professional machine can connect in both scenarios. What's even more frustrating is that even if I forward all ports(1-65535) to the server, the Home machine won't connect. The DMZ must do something that the Home Edition can't live without.

Improve this question
22
  • I'm still sad-facing over this one, anyone have any ideas? Also, thanks for the edit Indrek.
    – James
    Dec 28, 2012 at 14:25
  • Do you have anything useful in the Event Viewer?
    – harrymc
    Jan 1, 2013 at 11:29
  • (1) On Raspbian, check syslog or messages for difference when the two client connect. (2) Are both Windows running as standalone machines or inside a VM(VMware, VirtualBox, etc).
    – John Siu
    Jan 1, 2013 at 22:58
  • @harrymc Nothing showing up out of the ordinary in the Event Viewer
    – James
    Jan 2, 2013 at 2:41
  • @John Both Windows machines are standalone machines and are not VMs. Here's the messages in syslog from using the Windows Home Edition PPTP Client: pppd 2.4.5 started by root, uid 0; Using interface ppp0; COnnect: ppp0 <--> /dev/pts/1; Hangup (SIGHUP); Modem hangup; Connection terminated.; Exit.;
    – James
    Jan 2, 2013 at 2:47

5 Answers 5

Reset to default
5

I've finally found the holy grail:

http://www.jcsilva.com/2011/01/09/issues-with-dd-wrt-gre-forwarding-pptp/

This page says the following:

Issues With DD-WRT GRE Forwarding PPTP

A quick fix for DD-WRT not forwarding GRE PPTP packets.

Add the following commands to the startup commands (Administration->Commands):

/sbin/insmod xt_connmark
/sbin/insmod xt_mark
/sbin/insmod nf_conntrack_proto_gre
/sbin/insmod nf_conntrack_pptp
/sbin/insmod nf_nat_proto_gre
/sbin/insmod nf_nat_pptp

As a side note, I'm not sure why the Professional machine was able to connect correctly and at this point I don't really care now that I have a real solution that isn't enabling the DMZ.

Improve this answer
3
  • Perhaps a silly question: how do I access the startup commands? Specifically, where do I find the Administration panel?
    – clabacchio
    Apr 11, 2014 at 17:44
  • The web interface of your DD-WRT installation.
    – James
    Apr 15, 2014 at 19:13
  • Yeah sorry, I realized afterwards that it was referring to DD-WRT and not Windows. Perhaps because I was biased: I have the same problem but can't access the router settings (it's not mine).
    – clabacchio
    Apr 15, 2014 at 19:26
0
+100

Check pptpd options

In /etc/ppp/pptpd-options, check for following options

name pptpd
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
proxyarp
lock
nobsdcomp
#ms-dns <dns server ip>

Turn on debug on Raspbian

In /etc/pptpd.conf, add or un-comment

debug

In /etc/ppp/options, add or un-comment

debug

Restart pptpd.

Connect VPN with Win 7 Pro, then disconnect. Then connect VPN with Win 7 Home, wait for error. Compare the /var/log/syslog entries of the two connections.

Improve this answer
5
  • Try remove require-mppe-128 in /etc/ppp/pptpd-options for testing purpose.
    – John Siu
    Jan 3, 2013 at 7:05
  • Found something rather bazaar. I pointed my DMZ at the Pi server and now I can connect to the VPN using the Home machine. That is very strange since the Prof machine can connect to it just fine without the DMZ being enabled. But this is progress, hopefully this info can help finding the root cause.
    – James
    Jan 4, 2013 at 0:18
  • Thanks a lot for the assistance John, as my bounty is for not enough attention, I am giving it to you for your efforts in helping with the problem. Posted the solution for this giant headache. :)
    – James
    Jan 4, 2013 at 1:11
  • OMG, thank you! And I completely didn't think it was the dd-wrt as we restarted it. We just learn something new everyday.
    – John Siu
    Jan 4, 2013 at 1:45
  • Yeah, this was definitely a crazy one. I'm sure this question will save hours of time for someone later on down the road, heheh.
    – James
    Jan 4, 2013 at 2:43
0

There are a lot of network related features missing in Home Premium that are available in Professional and Ultimate versions. Features like joining a domain, VPN, RDP and some support for secure protocols are all missing in Home Premium. This could be the reason why you can connect with Professional and not with Home Premium.

Start from this link and you'll see what I mean. A quick search will show you the list of features missing in Home Premium as compared to Professional

http://windows.microsoft.com/en-US/Windows7/products/compare?T1=tab15

Improve this answer
2
  • Do you know what lack of feature would cause Home to work when the DMZ is enabled, but not work when it isn't? Mind you, the Professional works in both scenarios.
    – James
    Jan 4, 2013 at 0:23
  • Based on your new findings, I'm now confident it's something to do with missing features in Home. I wouldn't know which one for sure, though. However, on a broader picture, it's definitely some networking function. Kudos for finding a work around. I guess it's not worth looking any further now that you got it working.
    – Freckles
    Jan 4, 2013 at 4:07
0

Just in case someone gets Error 619 and accepted solution doesn't work - especially when given VPN connection worked in the past: sometimes Skype uses required ports and must be shut down / restarted

Improve this answer
0

For me solution was to go to regedit HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RasMan\Parameters\ and delete ProhibitIpSec parameter, then reboot the PC (changes apply only after reboot!), then try connect to VPN again.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .