Unexpected GRE behavior

[Moonwalker]

Greetings to all. Recently I’ve noticed a very strange thing from my Routerboard 1000 (firmware 2.20, RouterOS v.5). I was trying to set up PPTP VPN server (unsuccessfully) when our developers reported that they cannot connect to PPTP VPN server of our customer. Later we discovered that only one person could connect there (any of developers could do that but only one at a time).
After couple of hours we diagnosed that for some reason our Mikrotik refuses multiple GRE sessions between our IP address and customer’s one. We restored all settings that were changed for PPTP server setup but nothing changed. Only after complete restore from Mikrotik backup everything worked

I did not touch any of the firewall rules and adding them for GRE passthrough did not help. Service port for PPTP was also enabled (disabling did not change anything).

So maybe somebody knew what the hell was that? But I really ask you not to propose L2TP instead of PPTP or some another useless advises. That is an actual problem and I need an actual solution if there is one. Thanx forward

[janisk]

on router on the client side nat router enable pptp helper in ‘/ip firewall service-port’ assuming server end is at your client.

btw, pptp is not the best for NATed networks, better opt for L2TP or SSTP

[Moonwalker]

I just asked not to propose using other VPN types And I wrote that PPTP service port was enabled ^)

So waiting for another ideas

[docmarius]

If you use a GRE connection from an address behind a NAT router, then all sessions will use the external IP.
If you try to create multiple connections from the inside network to the same target address, then the router can not make the decision to which inside IP the incoming GRE packets shall be routed, so depending on the router, it will use only one of them (first, last, it doesn’t matter and is implementation specific).
So basically you can’t have multiple GRE tunnels to the same target from behind a single IP NAT router without helper services which do stateful packet inspection.
Assign different external IPs to each user, and then you can do multiple connections to your customer.

[Moonwalker]

@docmarius

If you use a GRE connection from an address behind a NAT router, then all sessions will use the external IP.
If you try to create multiple connections from the inside network to the same target address, then the router can not make the decision to which inside IP the incoming GRE packets shall be routed, so depending on the router, it will use only one of them (first, last, it doesn’t matter and is implementation specific).
So basically you can’t have multiple GRE tunnels to the same target from behind a single IP NAT router without helper services which do stateful packet inspection.
Assign different external IPs to each user, and then you can do multiple connections to your customer.

Well it works fine now for a few months with NAT enabled We had to restore complete settings from backup. And still have no idea what was the reason of such behavior It’s definitely not because of NAT