I'm trying to setup a VPN connection to a EC2 instance running windows server 2003. But I can't get it working. I get this error in the event log on the server.

A connection between the VPN server and the VPN client xxx.xxx.xxx.xxx has been established, but the VPN connection cannot be completed. The most common cause for this is that a firewall or router between the VPN server and the VPN client is not configured to allow Generic Routing Encapsulation (GRE) packets (protocol 47). Verify that the firewalls and routers between your VPN server and the Internet allow GRE packets. Make sure the firewalls and routers on the user's network are also configured to allow GRE packets. If the problem persists, have the user contact the Internet service provider (ISP) to determine whether the ISP might be blocking GRE packets.

So the client does connect, but because of not being able to send GRE packets, it fails. As far as I understand the GRE packets is blocked by Amazon, but is there any way to open this up? Is this the same as the ICMP option in creating security groups? I have tried adding ICMP 47 as mentioned in the error message. But it had no effect.

Any help is appreciated.

4 Answers 4


Adding GRE to Amazon Security Group is very easy but somewhat hidden. In your case, to allow PPTP VPN inbound connection to EC2 instance, create a rule in Security Group as follows:

  1. Select "Custom protocol rule" in the "Create a new rule" drop-down menu.
  2. Enter "47" in the "Protocol" field.
  3. Enter CIDR (IP range) for the clients subnets (for testing only, leave it to, and change it to a specific network later on.)
  4. Add to rule.

As soon as you add the rule, you will see "GRE" being added specifically in the rules window.

See this screenshot.


You may have to look at l2tp instead since pptp needs GRE (Protocol 47) allowed and I believe that is not possible on EC2


Can you install OpenVPN on these instances? You might have more luck with that...

  • +1 for OpenVPN in the EC2 cloud. We use it extensively.
    – lukecyca
    Sep 25, 2009 at 16:17

Security groups for regular EC2 instances can only have rules applied for TCP, UDP and ICMP.

To resolve the problem, start your instance in a VPC. Security groups for VPC instances can be written for any protocol, though you may need to use the command line ec2-authorize tool to create the rule.

This should be sufficient to open up GRE for your VPC instances:

ec2-authorize security_group_name -P 47 -O access_key -W secret_key <any other options>

You must log in to answer this question.