1

I've set up a Debian box as a PPTP VPN router for other computers on our network - the Debian box establishes a PPTP connection to a remote VPN service and then routes all Internet traffic via the VPN.

From the router itself I can access all websites, everything works fine.

But from other client computers on the network using the router as the default gateway, these machines can only access about 50% of websites for some reason. For example, I can access www.bbc.co.uk but not www.speedtest.net - yet both of these sites work fine when testing with a text-based browser directly on the router's command line.

From the other computers we can ping and traceroute to the non-working sites, it's just web access which won't load (the browser times out waiting for a response).

The following are the iptables rules we've used on the router to enable NAT:

iptables --table nat --append POSTROUTING -j MASQUERADE
iptables --append FORWARD --in-interface eth0 -j ACCEPT

Also IP forwarding has been enabled with:

echo 1 > /proc/sys/net/ipv4/ip_forward

If I disconnect the VPN on the Debian box and traffic routes through the DSL connection via the Debian router, all websites load properly from client computers - so this problem only occurs when the VPN is connected (though all sites can be accessed directly from the router when connected via the VPN so this rules out a problem with the VPN as such).

Does anyone have any suggestions as to what might be causing this and what I need to do to fix this?

Improve this question
9
  • Are there any proxy settings set in the browser?
    – trpt4him
    Aug 5, 2013 at 13:22
  • No proxy settings set - it's the same if I try from any browser on any computer or mobile device. Forgot to state in the original question: if I disconnect the VPN on the Debian box and the traffic routes through the DSL connection, all websites load properly. So it only occurs when the VPN is connected (but all sites load fine when accessed directly on the router via the VPN).
    – Chris
    Aug 5, 2013 at 15:09
  • And is the same DNS server being used whether traffic is flowing through the VPN or direct through ISP? Most VPNs allow a separate DNS setting. You could try a speedtest.net IP to rule that out: 216.146.46.10
    – trpt4him
    Aug 5, 2013 at 15:26
  • Thanks for your reply. Just tried the Speedtest IP with and without the VPN and it works both ways which is promising. The DNS is the same regardless of the VPN state - we have Dnsmasq running on the Debian box at 192.168.1.3 and this is set as the primary/secondary DNS for all local DHCP clients connecting through the router (192.168.1.3 is also the gateway address). DNS resolution via 192.168.1.3 on client computers works fine with and without the VPN connected.
    – Chris
    Aug 5, 2013 at 21:03
  • I'm wondering if some sites use a different protocol or some sort of proxy which doesn't work with my current iptables firewall setup? It is strange that 50% of sites do work, and 50% don't - but with the VPN disconnected it all works fine.
    – Chris
    Aug 8, 2013 at 12:05

1 Answer 1

Reset to default
1

Fixed this by clamping the MSS via IPTABLES as per section 7.15.2 in the guide at:

http://tldp.org/HOWTO/IP-Masquerade-HOWTO/mtu-issues.html

Just had to run this command to fix the problem:

iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

All sites now load properly via the VPN.

The solution was found after extensive searching online and eventually finding a similar user with the same issue at http://ubuntuforums.org/showthread.php?t=1699264.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .