Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a client running on a VPN behind a NAT. The client becomes inaccessible after a while if it is not "active". The VPN software is PPTP and the OS of the client if Debian.

I'm unsure about the exact cause of what makes it inaccessible or if it is another piece of software that is causing the problem. But my current thing I am trying to figure out is if the NAT is healing and causing the client VPN to become inaccessible. Could this be causing the problem or should I look elsewhere?

share|improve this question
up vote 4 down vote accepted

What exactly is NAT "healing".

What you're likely running into is a firewall timeout issue. The firewall is probably killing sessions in it's state table that have been idle for a long period of time in order to make room in the state table for other connections and to release any resources being consumed by the idle session.

share|improve this answer
Yes, this is likely the cause. See if you can get the VPN software to periodically send keep-alive messages in order to prevent the NAT from timing out the session. – qqx Dec 1 '12 at 22:52
The keepalive settings are inside "/etc/ppp/options" or "/etc/ppp/ppp.conf" (I don't remember which). The values are named "lcp-echo-interval" and "lcp-echo-failure". I think they are just commented out on most Linux distribution. – Gregory MOUSSAT Dec 1 '12 at 23:33

VPN tunnels often shut down on inactivity. Cisco routers have a VPN tunnel keepalive function. Basically, you ping through the tunnel to test for connectivity and with Cisco products, the VPN client and router renegotiate the connection so the tunnel stays alive.

Sounds like you need to implement some similar tactic to keep low background traffic on the tunnel.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.