Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When two people (on their notebooks) try to VPN to our office, only the first user gets a connection. the second user always times out.

Is it possible for VPN to allow two or more people, using / sharing the same EXTERNAL PUBLIC IP to connect/authenticate?

Now for some specifics (cause those two statements are very broad).

  1. I'm not in the IT Dept. I'm a developer. Our IT Dept don't really care (sigh) so it's up to me to fix this crap.
  2. Our office is all Microsoft shop stuff -> servers and clients. We also have a firewall (watchguard brand?) and some other crazy setups (yes i know, it's very vague :( ).

So i'm wondering -> is it possible for multiple users, from the same public IP, to connect via VPN to a windows server? i'm under the impression -> yes.

But it is possible that this only happens when the clients (who are all behind the single, public IP .. otherwise they will have their OWN ip's) need to have UPnP running or something?

this is killing me and i need to start asking the right questions cause these guys don't know what they are doing and i can't work without this happening.

I know this is a vauge question with so many 'if-what's-etc' but maybe some questions/suggestions from you guys might start to lead to solving this problem.


  1. Network Connection: WAN Miniport (PPTP)
share|improve this question
IPSec or PPTP? . – Mark Henderson Jan 12 '10 at 3:37
PPTP. OP updated. – Pure.Krome Jan 12 '10 at 3:46
up vote 0 down vote accepted

UPnP? No.

It's most likely an issue with GRE packets. I've seen a lot of problems on networks when sending GRE packets and basic routers that just can't handle it.

Are the users in question behind a corporate-level firewall, or something like a home firewall? If it's a home firewall, you might want to check to see if its PPTP Passthrough is enabled (if it has that feature).

If it's a corporate firewall, then it could be GRE rules (this is assuming it's a PPTP VPN), or a thousand other things I'm afraid!

share|improve this answer
Ok. lets try going down the GRE packet scenario. Remember, the first client can connect without a problem ... while the second client can't .. after someone has a connection established ...... from the same public ip address. So, what type of things should we be checking in the firewall, etc? – Pure.Krome Jan 12 '10 at 3:47
Good question. No idea to be honest, I was thinking out loud. Where's Evan Anderson when you need him... – Mark Henderson Jan 12 '10 at 3:51
Evan ..... paging Even Anderson. Please stand up. please :) – Pure.Krome Jan 12 '10 at 4:15

How many PPTP ports are configured on the server? Can two users from different locations (different public ip addresses) connect simultaneously? What remote access policies are configured on the server? How is the firewall rule configured? Is the server configured to use DHCP to assign ip addresses to the VPN clients or is it configured with a static ip address pool? How many ip addresses are available for VPN clients?

I was thinking it was a NAT issue on the client side, but I don't think that's it as I'm able to make a simultaneous VPN connection from two different computers at home to my VPN server at work (W2K3 PPTP).

share|improve this answer
Not sure about how the PPTP ports are configured. i'm going to have to figure this out AND try from two public ip's... Next >> "What remote access policies are configured on the server?" er .. not sure either. Is there something specific that I should be looking for? I know each user can connect to the VPN by them selves.... >> "How is the firewall rule configured?" Also, not sure. Is this about the GRE packets/ports? what should it be? what should i be looking for? (yes, i know that's a general statement .. but some general ideas/clues to drive me in the right direction....) – Pure.Krome Jan 12 '10 at 4:17
The easiest thing to do at this point is to have two different users connect simultaneously from two different public ip addresses. If that works you can rule out the corporate firewall and the server as the cause of the problem (if I'm thinking correctly). – joeqwerty Jan 12 '10 at 4:21

I don't think you can have multiple PPTP connections apparently come from the same internet IP without special support in the firewall for it.

In Juniper Netscreens, the vocabulary to look for is "Dial-Up Ip Pool" or "DIP Pool". These are pre-allocated external IP addresses which are assigned to internal PPTP clients as they become active -- as in, you don't pre-map an IP to client, you assign a pool of (say) three IPs -- these IPs are different from the firewall's external IP -- and those IPs are allocated to the first three PPTP connections, getting released as the PPTP connections are concluded.. The size of the pool is the limit of concurrent PPTP connections through the firewall.

(Sorry, that looks more incoherent than normal but it might give you some terms to search on.)

share|improve this answer

I'm pretty sure the Router is the problem, not configured correctly.

Are these remote people logging in from the same location on their end? if so, it may be worth looking into getting another watchguard and configuring a PTP through them, instead of the Server, as it sounds like it is, but,

In the end, show this thread to their boss, as this is definately their problem, not yours.

share|improve this answer

I'm not an expert in GRE's inner workings, but I don't think GRE supports session identifiers. I believe the protocol simply identifies the endpoints, which in this case are the same at both ends. So the server would think the initial laptop is sending a duplicate (though wrong encryption key) packets.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.