PPTP VPN Drop Connection issue

RouterOS General
1

Hi

Recently I doing a VPN PPTP site to site and the connection stablished and I can do Ping between LAN(Server) to LAN(Remote) and I can get access via SSH to Remote MKT but the issue it when I try to Connect to vía WinBox to Remote MKT the ping looses and the tunnel goes down and the same happends when I try a RDP from LAN to LAN. When this happened it, the tunnel delay about 1 minute stay ready again.

I tried with rules to Permit traffic (Forward) between sites on both sides
I configures server site the bridge mode to Proxy ARP

So I don’t what I missing, below I copy the configuration

####SERVER CONFIGURATION######

/ppp profile
add change-tcp-mss=yes comment=Perfil_VPN_PPTP dns-server=192.168.100.1 local-address=192.168.100.1 name=Profile_VPN remote-address=VPN
/ppp secret
add local-address=192.168.100.1 name=user1 password=test1 remote-address=192.168.100.51 service=pptp
add local-address=192.168.100.1 name=user2 password=test2 profile=Profile_VPN remote-address=192.168.100.50 routes=“192.168.88.0/24 192.168.100.50 1” service=pptp



/interface bridge
add admin-mac=CC:2D:E0:28:55:AD arp=proxy-arp auto-mac=no comment=Bridge_LAN name=bridge

/ip pool
add name=VPN ranges=192.168.100.50-192.168.100.60
add comment=LAN name=LAN ranges=192.168.100.2-192.168.100.126

/ip route> print
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit

DST-ADDRESS PREF-SRC GATEWAY DISTANCE

0 A S 0.0.0.0/0 192.168.1.254 1
2 ADC 192.168.1.0/24 192.168.1.65 ether1 0
3 ADS 192.168.88.0/24 192.168.100.50 1
5 ADC 192.168.100.0/25 192.168.100.1 bridge 0
6 ADC 192.168.100.50/32 192.168.100.1 0

/ip firewall filter
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related disabled=yes
add action=accept chain=forward connection-state=established,related connection-type=“”
add action=accept chain=input comment=“VPN” dst-port=1723 protocol=tcp
add action=accept chain=input comment=“VPN” protocol=gre
add action=accept chain=forward comment=“LAN to SalXX” dst-address=192.168.88.0/24 protocol=icmp src-address=192.168.100.0/25
add action=accept chain=forward comment=“Winbox SalXX” disabled=yes dst-address=192.168.100.50 dst-port=8291 protocol=tcp
add action=accept chain=forward comment=“LAN to SalXX” dst-address=192.168.88.0/24 src-address=192.168.100.0/25
add action=accept chain=forward comment=“LAN to SalXX” dst-address=192.168.100.0/25 src-address=192.168.88.0/24
add action=drop chain=forward comment=“Drop Packet Internet” dst-address=0.0.0.0/0 src-address=192.168.100.0/25
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=drop chain=input comment=“defconf: drop all from WAN” in-interface=ether1
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat connection-state=new in-interface=ether1
add action=drop chain=input comment=“Drop Default”

/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade” out-interface=ether1

###########################################################

2

At first glance it sounds to me as either exceeding the available bandwidth once you start sending some higher traffic volume through the tunnel, or hitting some bug related to packet fragmentation. So far I cannot imagine any other reason why ping traffic should get through whereas TCP should not. So before digging any further, can you try flood pinging with packet size about 1600 bytes to see whether it has the same effect?

3

Mikrotik sets a default MTU of 1460 B for the PPTP Tunnel… so how 1600 came up and why should the test be done with such a big MTU ? And not e.g. with 1461B …

4

It came up from pure laziness to look up the details. If fragmentation is related, it doesn’t matter whether you exceed the MTU by one byte or 140.

5

It came up from pure laziness

Ok cool, just wanted to know if there was a meaning behind it…

6

Hi

Thanks for all your suggests, Finally It works.

I had to call the ISP to check the INET Configuration with them and they reset something on his side and the VPN Works.

Thanks and regards.

7

Did you ask them what the fault was ?