> Source: [sk181903](https://support.checkpoint.com/results/sk/sk181903)

# sk181903 - PPTP GRE Connection Doesn't Work with Destination NAT

| Property | Value |
|----------|-------|
| Solution ID | sk181903 |
| Date Created | 2024-01-30 |
| Last Modified | 2024-07-30 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * The PPTP Sever behind Check Point Security Gateway with manual destination NAT configured on multiple ISP links can't be dialed in with the following error.  

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk181903/PPTP_Connection_Error202401300955022.jpg)  

* The firewall log and traffic capture show that the outgoing GRE traffic from the PPTP server sending out through a wrong interface with wrong nated source IP address, it's not sticky to the incoming GRE traffic from the PPTP client.  

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk181903/PPTP_GRE_REPLY202401300958343.jpg)

## Cause

The PPTP data connections are opened in the `pptp_code` handler, which is run as an SPII inspection, that run in the VM inbound chain module. In R80 and earlier, the NAT on the chain happened also in the VM and before the SPII, so the handler was getting the connection after NAT, and all the data connection preparations were done according to this connection.  

At some point the NAT was moved to the post VM chain module, so now it runs after the SPII, and the handler gets the connection before NAT, so it did not open the data connections correctly. In particular, it opened the S2C connection with the wrong IP.  

<br />

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).
**Important Notes:**

* "**Non Compliant PPTP**" option is still required to be enabled with **Accept** action in the `Inspection Settings`. For more details, kindly please refer to:  
  [sk60793 - Configuring Security Gateways to allow connection to PPTP server while using Hide-NAT (GRE and Hide-NAT support)](https://support.checkpoint.com/results/sk/sk60793)
* You must use the predefined service "**`pptp-tcp`**" in the Access Control rule to match the PPTP traffic allowed, the custom TCP service on port 1723 won't work for this feature.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content