can't use as SSTP VPN for large files

[OmlineEditor]

I compiled version 1.13.0 from sources and installed it on Debian 12. I configured SSTP VPN, everything works, I can connect, I can download small files through this VPN, everything downloads well and even small sites open.

but if I try to download something big, it freezes and breaks off when the length of the downloaded file is 139264 byte.

configuration (comments removed)

[modules]
log_file
sstp
auth_mschap_v2
chap-secrets
ippool

[core]
log-error=/var/log/accel-ppp/core.log
thread-count=1

[common]

[ppp]
verbose=1
min-mtu=1280
mtu=1400
mru=1400
ipv4=require
ipv6=deny
ipv6-intf-id=0:0:0:1
ipv6-peer-intf-id=0:0:0:2
ipv6-accept-peer-intf-id=1
lcp-echo-interval=20
lcp-echo-timeout=120
unit-cache=1

[auth]

[pptp]
verbose=1

[pppoe]
verbose=1
called-sid=mac
interface=eth0

[l2tp]
verbose=1

[sstp]
verbose=1
port=442
cert-hash-proto=sha1,sha256
accept=ssl
ssl-protocol=tls1.2,tls1.3
ssl-pemfile=/etc/ssl/certs/ssl-cert-snakeoil.pem
ssl-keyfile=/etc/ssl/private/ssl-cert-snakeoil.key
timeout=60
ip-pool=sstppool

[ipoe]
verbose=1
username=ifname
lease-time=600
max-lease-time=3600
shared=0
ifcfg=1
mode=L2
start=dhcpv4
interface=eth0

[dns]

[wins]

[radius]
nas-identifier=accel-ppp
nas-ip-address=127.0.0.1
gw-ip-address=192.168.100.1
server=127.0.0.1,testing123,auth-port=1812,acct-port=1813,req-limit=50,fail-timeout=0,max-fail=10,weight=1
dae-server=127.0.0.1:3799,testing123
verbose=1

[client-ip-range]
# Below is my IP
10.10.10.0/24

[ip-pool]
gw-ip-address=192.168.0.1
attr=Framed-Pool
192.168.5.2-255
192.168.0.2-255,name=sstppool
192.168.2.1-255,name=pool2
192.168.3.1-255,name=pool3
192.168.4.1-255,name=pool4,next=pool1
192.168.4.0/24

[log]
log-file=/var/log/accel-ppp/accel-ppp.log
log-emerg=/var/log/accel-ppp/emerg.log
log-fail-file=/var/log/accel-ppp/auth-fail.log
log-debug=/var/log/accel-ppp/debug.log
copy=1
level=5

[log-pgsql]
conninfo=user=log
log-table=log

[pppd-compat]
verbose=1
radattr-prefix=/var/run/radattr

[chap-secrets]
gw-ip-address=192.168.100.1
chap-secrets=/etc/ppp/chap-secrets
encrypted=0

[shaper]
up-limiter=police
down-limiter=tbf
verbose=1
 
[snmp]
master=0
agent-name=accel-ppp

[connlimit]
limit=10/min
burst=3
timeout=60

[ipv6-pool]
fc00:0:1::/48,64
fc00:0:2::/48,64,name=pool1
fc00:0:3::/48,64,name=pool2,next=pool1
delegate=fc00:1::/36,48
delegate=fc00:2::/36,48,name=pool3
delegate=fc00:3::/36,48,name=pool4,next=pool3

[ipv6-dns]
 
[ipv6-dhcp]
verbose=1
pref-lifetime=604800
valid-lifetime=2592000
route-via-gw=1

the client is configured on Mikrotik, All my settings are identical to those for other clients and everything works.

log files are empty at the time of glitches when downloading a large file.

where is the error and why can't I download large files?

[svlobanov]

@OmlineEditor please run tcpdump on sstp and external interfaces and check that you don't have ip-fragmented packets. If you have it, then play with MTU/MSS settings

[OmlineEditor]

play with MTU/MSS settings

changing MTU/MSS doesn't help, I've already changed it before.

[svlobanov]

are you sure that you don't have ip-fragmented traffic?

[OmlineEditor]

I can't check the fragmentation.
to check I rebooted the server and everything stopped working.
I can't connect to the SSTP server.
I also noticed that there used to be a ppp0 interface, but now it's gone, there's only lo and eth0

in the logs this is:

[2024-09-21 00:35:23.978] sstp: new connection from 10.10.10.10:12345
[2024-09-21 00:35:23.978] sstp: starting
[2024-09-21 00:35:23.978] sstp: started
[2024-09-21 00:35:24.041] : : recv [HTTP <SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1>]
[2024-09-21 00:35:24.041] : : recv [HTTP <Content-Length: 18446744073709551615>]
[2024-09-21 00:35:24.041] : : recv [HTTP <Host: 0.0.0.0>]
[2024-09-21 00:35:24.041] : : send [HTTP <HTTP/1.1 200 OK>]
[2024-09-21 00:35:24.041] : : send [HTTP <Date: Fri, 20 Sep 2024 21:35:24 GMT>]
[2024-09-21 00:35:24.041] : : send [HTTP <Content-Length: 18446744073709551615>]
[2024-09-21 00:35:24.066] : : recv [SSTP SSTP_MSG_CALL_CONNECT_REQUEST]
[2024-09-21 00:35:24.067] : : send [SSTP SSTP_MSG_CALL_CONNECT_ACK]
[2024-09-21 00:35:24.067] : : lcp_layer_init
[2024-09-21 00:35:24.067] : : auth_layer_init
[2024-09-21 00:35:24.067] : : ccp_layer_init
[2024-09-21 00:35:24.067] : : ipcp_layer_init
[2024-09-21 00:35:24.067] : : ipv6cp_layer_init
[2024-09-21 00:35:24.067] : : ppp establishing
[2024-09-21 00:35:24.067] : 562af882e4bff45f: lcp_layer_start
[2024-09-21 00:35:24.067] : 562af882e4bff45f: send [LCP ConfReq id=56 <auth MSCHAP-v2> <mru 1400> <magic 2035eeaa>]
[2024-09-21 00:35:27.067] : 562af882e4bff45f: fsm timeout 9
[2024-09-21 00:35:27.067] : 562af882e4bff45f: send [LCP ConfReq id=56 <auth MSCHAP-v2> <mru 1400> <magic 2035eeaa>]
[2024-09-21 00:35:30.067] : 562af882e4bff45f: fsm timeout 8
[2024-09-21 00:35:30.067] : 562af882e4bff45f: send [LCP ConfReq id=56 <auth MSCHAP-v2> <mru 1400> <magic 2035eeaa>]
[2024-09-21 00:35:33.067] : 562af882e4bff45f: fsm timeout 7
[2024-09-21 00:35:33.067] : 562af882e4bff45f: send [LCP ConfReq id=56 <auth MSCHAP-v2> <mru 1400> <magic 2035eeaa>]
[2024-09-21 00:35:33.096] : 562af882e4bff45f: recv [LCP ConfReq id=26 <magic 7799ffad>]
[2024-09-21 00:35:33.096] : 562af882e4bff45f: send [LCP ConfAck id=26]
[2024-09-21 00:35:33.134] : 562af882e4bff45f: sstp: read: Input/output error
[2024-09-21 00:35:33.134] : 562af882e4bff45f: disconnecting
[2024-09-21 00:35:33.158] : 562af882e4bff45f: terminate
[2024-09-21 00:35:33.158] : 562af882e4bff45f: sstp: ppp: finished
[2024-09-21 00:35:33.158] : 562af882e4bff45f: lcp_layer_free
[2024-09-21 00:35:33.158] : 562af882e4bff45f: auth_layer_free
[2024-09-21 00:35:33.158] : 562af882e4bff45f: ccp_layer_free
[2024-09-21 00:35:33.158] : 562af882e4bff45f: ipcp_layer_free
[2024-09-21 00:35:33.158] : 562af882e4bff45f: ipv6cp_layer_free
[2024-09-21 00:35:33.158] sstp: disconnected

what happened and how to fix it?
i just changed the config a little and rebooted the server.
the config seems normal i don't see any problems with it.

[DmitriyEshenko]

Did you keep only mschapv2 in your mikrotik profile?
Also, what about firewall? Maybe some icmp messages dropped and it can not negotiate window size, when you are trying to receive large files

[OmlineEditor]

Did you keep only mschapv2 in your mikrotik profile?

yes, i only use mschap v2

Also, what about firewall? Maybe some icmp messages dropped and it can not negotiate window size, when you are trying to receive large files

Everything is fine, the firewall doesn't block anything, I didn't touch it when setting it up.

ppp0 interface disappeared, is this normal for SSTP server?

[DmitriyEshenko]

It is not normal, because pppX interface keeps active when session negotiate, in your case it can not. And it looks like that clients can not communicate with server in tunnel

[OmlineEditor]

the configuration is in the first message, what was done wrong there, why doesn't the ppp0 interface work?

[DmitriyEshenko]

Compare logs with successfully connection before. Try to disable and enable again connection on client side

[OmlineEditor]

I deleted the logs to make them easier to read, I don't have logs for a successful connection, which was the case before.

[OmlineEditor]

now the program does not respond and does not display an error message if there is no ppp0 interface. I ask the developer to add a check whether all interfaces are running and working properly, if there is no ppp0 interface like mine then an error message should be displayed.

[svlobanov]

have you checked accel-ppp logs? is there any information related to ppp0 interface? if no, please increase debug level and re-run

[OmlineEditor]

no information about ppp0, debugging level=5. After the reboot, we have the following data:

/var/log/accel-ppp/accel-ppp.log:

[2024-09-22 22:43:51]:  info: sstp: SSL/TLS support enabled, PROXY support disabled

/var/log/accel-ppp/debug.log:

[2024-09-22 22:43:51.250] accel-ppp version 1.13.0
[2024-09-22 22:43:51.261] sstp: SSL/TLS support enabled, PROXY support disabled

/var/log/accel-ppp/auth-fail.log and /var/log/accel-ppp/core.log and /var/log/accel-ppp/emerg.log - empty

[OmlineEditor]

at the time of launch, there is no check that the ppp0 interface is missing, there is a problem only at the time of connection, but it is too late, you need to enter a message earlier that there is no ppp0 interface

[2024-09-22 22:50:40.450] sstp: new connection from 10.10.10.15:58842
[2024-09-22 22:50:40.450] sstp: starting
[2024-09-22 22:50:40.450] sstp: started
[2024-09-22 22:50:40.515] : : recv [HTTP <SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1>]
[2024-09-22 22:50:40.515] : : recv [HTTP <Content-Length: 18446744073709551615>]
[2024-09-22 22:50:40.515] : : recv [HTTP <Host: 0.0.0.0>]
[2024-09-22 22:50:40.515] : : send [HTTP <HTTP/1.1 200 OK>]
[2024-09-22 22:50:40.516] : : send [HTTP <Date: Sun, 22 Sep 2024 19:50:40 GMT>]
[2024-09-22 22:50:40.516] : : send [HTTP <Content-Length: 18446744073709551615>]
[2024-09-22 22:50:40.543] : : recv [SSTP SSTP_MSG_CALL_CONNECT_REQUEST]
[2024-09-22 22:50:40.543] : : send [SSTP SSTP_MSG_CALL_CONNECT_ACK]
[2024-09-22 22:50:40.543] : : lcp_layer_init
[2024-09-22 22:50:40.543] : : auth_layer_init
[2024-09-22 22:50:40.543] : : ccp_layer_init
[2024-09-22 22:50:40.543] : : ipcp_layer_init
[2024-09-22 22:50:40.543] : : ipv6cp_layer_init
[2024-09-22 22:50:40.543] : : ppp establishing
[2024-09-22 22:50:40.544] : 562af882e4c01f5a: lcp_layer_start
[2024-09-22 22:50:40.544] : 562af882e4c01f5a: send [LCP ConfReq id=24 <auth MSCHAP-v2> <mru 1400> <magic 6db4c28a>]
[2024-09-22 22:50:40.574] : 562af882e4c01f5a: recv [LCP ConfReq id=5 <magic 00e5b80f>]
[2024-09-22 22:50:40.574] : 562af882e4c01f5a: send [LCP ConfAck id=5]
[2024-09-22 22:50:41.633] : 562af882e4c01f5a: recv [LCP ConfReq id=6 <magic 00e5b80f>]
[2024-09-22 22:50:41.634] : 562af882e4c01f5a: send [LCP ConfAck id=6]
[2024-09-22 22:50:43.123] : 562af882e4c01f5a: recv [LCP ConfReq id=7 <magic 00e5b80f>]
[2024-09-22 22:50:43.123] : 562af882e4c01f5a: send [LCP ConfAck id=7]
[2024-09-22 22:50:43.546] : 562af882e4c01f5a: fsm timeout 9
[2024-09-22 22:50:43.546] : 562af882e4c01f5a: send [LCP ConfReq id=24 <auth MSCHAP-v2> <mru 1400> <magic 6db4c28a>]
[2024-09-22 22:50:43.573] : 562af882e4c01f5a: recv [LCP ConfAck id=24 <auth MSCHAP-v2> <mru 1400> <magic 6db4c28a>]
[2024-09-22 22:50:43.573] : 562af882e4c01f5a: lcp_layer_started
[2024-09-22 22:50:43.573] : 562af882e4c01f5a: auth_layer_start
[2024-09-22 22:50:43.573] : 562af882e4c01f5a: send [MSCHAP-v2 Challenge id=1 <2a30122189d79fef1f672b14cf5bd540>]
[2024-09-22 22:50:43.600] : 562af882e4c01f5a: recv [MSCHAP-v2 Response id=1 <c21bbb4d5fd62d99026f0a7263ef77>, <59d7bd4150bf3263b4c57beb36b04fcc887257c3cfa28a0>, F=0, name="vpnuser"]
[2024-09-22 22:50:43.603] ppp0: 562af882e4c01f5a: connect: ppp0 <--> sstp(10.10.10.15:58842)
[2024-09-22 22:50:43.603] ppp0: 562af882e4c01f5a: ppp connected
[2024-09-22 22:50:43.603] ppp0: 562af882e4c01f5a: send [MSCHAP-v2 Success id=1 "S=9FBFF9294491D98BCE1870F8DC0EF91B08FC32A0 M=Authentication succeeded"]
[2024-09-22 22:50:43.603] ppp0: 562af882e4c01f5a: vpnuser: authentication succeeded
[2024-09-22 22:50:43.603] ppp0: 562af882e4c01f5a: auth_layer_started
[2024-09-22 22:50:43.603] ppp0: 562af882e4c01f5a: ccp_layer_start
[2024-09-22 22:50:43.603] ppp0: 562af882e4c01f5a: ipcp_layer_start
[2024-09-22 22:50:43.603] ppp0: 562af882e4c01f5a: send [IPCP ConfReq id=97 <addr 192.168.0.1>]
[2024-09-22 22:50:43.603] ppp0: 562af882e4c01f5a: ipv6cp_layer_start
[2024-09-22 22:50:43.630] ppp0: 562af882e4c01f5a: recv [SSTP SSTP_MSG_CALL_CONNECTED]
[2024-09-22 22:50:43.630] ppp0: 562af882e4c01f5a: sstp: invalid Nonce
[2024-09-22 22:50:43.630] ppp0: 562af882e4c01f5a: send [SSTP SSTP_MSG_CALL_ABORT]
[2024-09-22 22:50:43.657] ppp0: 562af882e4c01f5a: sstp: read: Input/output error
[2024-09-22 22:50:43.657] ppp0: 562af882e4c01f5a: disconnecting
[2024-09-22 22:50:43.682] ppp0: 562af882e4c01f5a: terminate
[2024-09-22 22:50:43.683] ppp0: 562af882e4c01f5a: sstp: ppp: finished
[2024-09-22 22:50:43.683] ppp0: 562af882e4c01f5a: lcp_layer_free
[2024-09-22 22:50:43.683] ppp0: 562af882e4c01f5a: auth_layer_free
[2024-09-22 22:50:43.683] ppp0: 562af882e4c01f5a: ccp_layer_free
[2024-09-22 22:50:43.683] ppp0: 562af882e4c01f5a: ipcp_layer_free
[2024-09-22 22:50:43.683] ppp0: 562af882e4c01f5a: ipv6cp_layer_free
[2024-09-22 22:50:43.683] ppp0: 562af882e4c01f5a: ppp destablished
[2024-09-22 22:50:43.683] sstp: disconnected

[OmlineEditor]

the problem was solved by removing the server completely and reinstalling debian 12 and reinstalling the program accel-ppp.
where was the problem in the old version I can't understand