Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've set up a Debian box as a PPTP VPN router for other computers on our network - the Debian box establishes a PPTP connection to a remote VPN service and then routes all Internet traffic via the VPN.

From the router itself I can access all websites, everything works fine.

But from other client computers on the network using the router as the default gateway, these machines can only access about 50% of websites for some reason. For example, I can access but not - yet both of these sites work fine when testing with a text-based browser directly on the router's command line.

From the other computers we can ping and traceroute to the non-working sites, it's just web access which won't load (the browser times out waiting for a response).

The following are the iptables rules we've used on the router to enable NAT:

iptables --table nat --append POSTROUTING -j MASQUERADE
iptables --append FORWARD --in-interface eth0 -j ACCEPT

Also IP forwarding has been enabled with:

echo 1 > /proc/sys/net/ipv4/ip_forward

If I disconnect the VPN on the Debian box and traffic routes through the DSL connection via the Debian router, all websites load properly from client computers - so this problem only occurs when the VPN is connected (though all sites can be accessed directly from the router when connected via the VPN so this rules out a problem with the VPN as such).

Does anyone have any suggestions as to what might be causing this and what I need to do to fix this?

share|improve this question
Are there any proxy settings set in the browser? – trpt4him Aug 5 '13 at 13:22
No proxy settings set - it's the same if I try from any browser on any computer or mobile device. Forgot to state in the original question: if I disconnect the VPN on the Debian box and the traffic routes through the DSL connection, all websites load properly. So it only occurs when the VPN is connected (but all sites load fine when accessed directly on the router via the VPN). – Chris Aug 5 '13 at 15:09
And is the same DNS server being used whether traffic is flowing through the VPN or direct through ISP? Most VPNs allow a separate DNS setting. You could try a IP to rule that out: – trpt4him Aug 5 '13 at 15:26
Thanks for your reply. Just tried the Speedtest IP with and without the VPN and it works both ways which is promising. The DNS is the same regardless of the VPN state - we have Dnsmasq running on the Debian box at and this is set as the primary/secondary DNS for all local DHCP clients connecting through the router ( is also the gateway address). DNS resolution via on client computers works fine with and without the VPN connected. – Chris Aug 5 '13 at 21:03
I'm wondering if some sites use a different protocol or some sort of proxy which doesn't work with my current iptables firewall setup? It is strange that 50% of sites do work, and 50% don't - but with the VPN disconnected it all works fine. – Chris Aug 8 '13 at 12:05
up vote 1 down vote accepted

Fixed this by clamping the MSS via IPTABLES as per section 7.15.2 in the guide at:

Just had to run this command to fix the problem:

iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

All sites now load properly via the VPN.

The solution was found after extensive searching online and eventually finding a similar user with the same issue at

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.