Avoid ISP blocking VPN connection

Question

I have rented a Virtual Private Server and I have set up a VPN (of type PPTP) following this simple tutorial.

It seems that the VPN server is set up correctly, and the VPS administrators told me that everything is correct in their side, and other customers have set up VPNs without problem...

But I can't connect to the VPN from my Windows 7 PC. I get an error: 800: Unable to establish the VPN connection. The VPN server may be unreachable, or security parameters may not be configured properly for this connection.

It seems that my ISP (Sky UK) is blocking the connection or something like that, although I have adde a firewall exception on port 1723 in my router... In fact I asked my ISP and they say they do not support VPN and can´t provide any help with that...

Is there any way to avoid such blocking, if any?

---

If it's useful, I have run Ms PortQuery on my PC with: portquery -n my.vpn.ip.address -p tcp -o 1723 and the result is the port is FILTERED.

Also, if I check my ports with YouGetSignal online port checker, it says the port 1723 is closed on my IP...

Answer 1

PPTP can be blocked by ISPs because it (1) runs exclusively on port 1723 and (2) uses non-standard GRE packets which are easily identifiable. See PPTP on Wikipedia.

The solution is using OpenVPN protocol instead of PPTP. Here's a tutorial by BestVPN that covers setting up OpenVPN on a linux VPS.

There are increasing degrees of obfuscation that can make OpenVPN traffic pass under your ISP's radar. Ordered from easiest implementation/detection (they correlate) to most difficult:

1. Default Configuration - Just install open VPN. It runs on TCP Port 80 by default, same as regular web traffic. Many operators block encrypted packets on this port, so this is the probably the first step covered in the ISP's VPN-blocking strategy.
2. Use TCP Port 443 - Running OpenVPN through TCP 443 (same as HTTPS/SSL traffic in the browser) is the next step. This puts your encrypted VPN traffic in the same bucket as the data you exchange with secure sites such as your bank. Certain deep packet inspection methods can filter out VPN traffic on this port, so your ISP might have that covered too.
3. Obfsproxy - Easier than it sounds. It's a a project developed by Tor to allow access to relays being blocked, but works for VPN traffic as well. Needs to be installed on both VPN server and client machine.
4. Via SSL Tunnel - Now the bigger guns. Using stunnel one can send one's VPN traffic through a second layer of SSL encryption, effectively masking VPN traffic as standard SSL traffic. This method is imperceptible to known deep packet inspection methods.
5. Via SSH Tunnel - Stealth Bomber. Even in highly censored environments, SSH will almost always go through, as it is a core functionality of modern server architecture and the censorship tactics themselves involve SSH.

These methods are covered in another tutorial by BestVPN here.

You can start with a plain vanilla OpenVPN setup. If it works for your ISP, all done. Otherwise, try each step in order, checking back to see if you can get through after each configuration change. Note that SSL/SSH tunneling methods are more secure than Obfsproxy, but do cause a performance hit from the double encryption.