1

I've followed this tutorial to build a VPN on EC2:

PPTP VPN on Amazon EC2

But when I run these steps, I always fail to connect to EC2 through VPN. Every time, the system confirms a connection, but eventually the system stops and reports a failure.

In the log: /var/log/messages, I can see:

pppd 2.4.5 started by ec2-user, uid 0
Using interface ppp0
Connect: ppp0 <--> /dev/pts/0
Modem hangup

I am confused on these items:

  • What kind of IP should I input to /etc/pptpd.conf? My IP domain is 192.168.0.xxx. I input 192.168.0.1 and 192.168.0.2-100 to /etc/pptpd.conf. Will this be a check point?
  • How to check if I have enabled port 1723 on EC2?

Can anybody give me some ideas on how to debug this case?

Improve this question
5
  • another question is: what is the server name? should i take EC2 public DNS as vpn hostname? – skyworld Jun 25 '17 at 7:28
  • Is there a firewall and/or proxy on client or server side? – Ortomala Lokni Jun 25 '17 at 10:22
  • I use win10 and i have installed macfee to defend virus. But I'm sure it is ok because i can access other VPN servers. – skyworld Jun 25 '17 at 11:49
  • What about Amazon EC2 Security Groups? – Ortomala Lokni Jun 25 '17 at 11:55
  • i have set security group to enable all traffics from any port, but still fail – skyworld Jun 25 '17 at 13:20
2

PPTP uses two different protocols, TCP port 1723 is used for initial setup, but the data streams use GRE -- Generic Route Encapsulation -- which is neither TCP nor UDP -- it's IP protocol number 47.

You need to create a security group rule to allow GRE traffic. This requires that your instance be in a VPC, since EC2 Classic security groups do not support a rule like this.

TCP 1723 seems to be open, or you wouldn't be seeing the log entries.

Improve this answer
10
  • 1
    @skyworld Note also that macOS Sierra no longer support PPTP because of numerous security vulnerabilities, you should maybe consider using something more recent such as OpenVPN. – Ortomala Lokni Jun 25 '17 at 21:05
  • @OrtomalaLokni that is, unfortunately, a very good point. – Michael - sqlbot Jun 25 '17 at 23:24
  • Hi Michael, I'm not sure if this command is what you are discussing: "iptables -A INPUT -p gre -j ACCEPT", i have tried this command but still failed for login – skyworld Jun 26 '17 at 12:03
  • Hi Ortomala, thanks for your reminder. What i need now is just to build a VPN so that I can access google to search some documents. PPTP should be enough for me. – skyworld Jun 26 '17 at 12:05
  • @skyworld no. I'm referring to the EC2 security group that controls external access to your instance. – Michael - sqlbot Jun 26 '17 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.