Reference Manual

HOW TO fix VPN connection problems.

VPN connections differ in the protocol which they use to tunnel IP packets through the Internet. Prior to Windows 2000, all Microsoft VPNs used the Point-to-Point Tunnelling Protocol PPTP, but several other tunnelling protocols are now in use, including L2TP and IPSec.

NAT32 fully supports PPTP-based and L2TP-based VPN connections, but IPSec-based connections are only supported if the VPN Server accepts Pass Through Mode connections (which is often not the case).

Irrespective of the type of VPN connection, the following changes to the Microsoft TCP/IP stack on your machine take effect for the duration of the connection:

• Your machine is given an IP address on the network of the VPN Server.
• Your machine is given a Default Gateway on the network of the VPN Server, but only if you check the Use default gateway on remote network checkbox in the Properties of the connection.
• Any previous Default Gateway on your machine is given a higher metric, which effectively stops Windows from using it. The gateway on the network of the VPN Server is used instead.
• The metric of the Network Route on private LAN adapters is also increased, thus making your private machines unreachable. This problem was corrected in Windows 2000 and later versions of the operating system.

The following problem occurs in Windows 9X VPNs:

Most Operating Systems use a Path MTU Discovery mechanism to detect non-standard MTU sizes on intermediate networks. PMTU Discovery works by setting the Don't Fragment flag in the IP Header of outgoing packets. If a gateway needs to forward such an IP packet over a network with a non-standard MTU, then instead of fragmenting it, the packet is discarded and an ICMP error message is sent back to the original source of the packet. The sender can then retransmit the IP packet, but this time with a shorter data field.

The mechanism works fine for IP packets, but it does not work for the GRE Packet type used to transfer data over PPTP VPNs.

A fix for this problem is to modify the IPMTU registry variable at the following location:

HKLM\System\CurrentControlSet\Services\Class\Net

Locate each Net key which contains the string "Dial-Up Adapter" in its DriverDesc variable. Then set the IPMTU variable for each such adapter to 1400 bytes and reboot Windows.

The main symptoms of this problem are that Web pages fail to load completely, or that Outlook does not start correctly, or that Outlook starts but can send and receive only short Emails.

SEE ALSO

VPN Clients, VPN Servers, VPN Sharing