Fedora Core 3 + PPTP - NAT: Problems with multiple clients

Sander Eikelenboom S.Eikelenboom at stud.tue.nl
Fri Apr 15 14:53:57 CEST 2005

Hi Michael,

If packets would get mixed up, in my view the "call id's" should be mixed
up too, and this should be noticeable in the logs. Perhaps you could enable
the debugging and post the results of kern.log together with 2 tcpdumps of
both external and internal interfaces:

tcpdump -i eth0 -vvv -xx -s 0 ip host ip_addr_pptp_server > tcpdump-2.6.10+pptp+testcase-eth0.txt
tcpdump -i eth1 -vvv -xx -s 0 ip host ip_addr_pptp_server > tcpdump-2.6.10+pptp+testcase-eth1.txt

Where you should change "ip_addr_pptp_server" with the IP address to which
both clients try to connect to.
Please use the netfilter to bugzilla to file the bug (you can upload the
logs as attachments there).

This should give a complete overview of what is happening.

Don't know if it is possible for you, but you could try a patched vanilla
2.6.10 kernel too, to rule out the fedora kernel has some incompatible
patches for the pptp patch.


Sander Eikelenboom

I have a firewall which does NAT of outgoing connections. Several clients
behind this box must connect to the same external PPTP server. This did work
fine on a 2.4.27 kernel.

However, with the newest version of the PPTP conntrack/nat helper (from SVN,
Revision 3839) and Fedora Core 3 (2.6.10), this does no longer work (both
clients and server are unchanged, only the firewall is replaced). It applies
cleanly and I can connect to an external PPTP server from a single client:
everything works fine. But as soon as a second client behind the firewall
tries to connect to this server, problems occur. Either the connection does
not get established (most cases), or the first connection is broken
(rarely); completely working: never. It seems, that some packets get mixed
up between those two connections.

Is there any workaround for this or how to help the developers in resolving
the problem? I have enabled all the debugging (printk), but the resulting
log doesn't help (at least me).


More information about the netfilter mailing list