Cannot connect to VPN via wi-fi hotspot

[capncreer]

I regularly connect to a remote server via a VPN.

I used to be able to connect to it via my Android 14 phone and its wi-fi hotspot but not any more. No messages, the VPN client (FortiClient) just fails to connect.

This is a seasonal thing, I use it when away from my desk during summer holidays. For the last several summers it has been fine, this year not. The VPN techies have looked hard, found nothing, and are now pointing the finger at EE.

Any ideas?

[Chris_B]

@capncreer  EE are not limiting you via your phones hotspot.  Can you connect to the web with or without the VPN via your phone’s hotspot? 
if you can there is nothing wrong with the phone’s hotspot and it’s working.    You need to test with and without the VPN. 

[capncreer]

Yes, I can access the internet and I agree the issue is unlikely to be ee-related but I had to ask in order to concentrate the VPN techies' minds.

Actually I think the issue is with the web server to  which the VPN is trying to connect because I can't send mail via its email host. Same techies!

Many thanks for your prompt help, much appreciated. 

[capncreer]

Hm, I just replaced my EE SIM with a GiffGaff and it worked perfectly.

So IMHO that means there is some incompatibility between EE and my web server.

[Leanne_T]

Hi there @capncreer 

Thanks for coming to the community. 

I would suggest getting back in touch with your VPN provider, to see if they can investigate this further for you. 

Leanne.

[capncreer]

No point.

VPN works with Giffgaff but not with EE so nothing wrong with VPN.

Problem is with EE!

[Chris_B]

@capncreer    And yet you can browse the web via the hotspot and the EE sim.  EE isn’t stopping you doing this.   It’s something else that’s causing this and you have put it used to work.  So something has changed somewhere but it’s not the network side as it’s working. 
have you tried doing this without the VPN to this server? 

[capncreer]

Thank you for your suggestions. This is what my VPN/Server techies said a few days ago

~~

Unfortunately there's nothing particularly salient in the log that provides any actionable diagnostic paths from either yours or our end - below are the verbose errors from the log with a reference to each, but they all just confirm that the VPN connection couldn't be established over the mobile carrier hotspot:

ssl_connect:-3 - this is an SSL/TLS handshake failure at the network level
tunnel_to_fgt error - confirming the tunnel couldn't be established
ras_loop(), waitResult=1 — the RAS (Remote Access Service) loop exits with a wait/timeout error

The pattern in the logs, which show a brief connection is established (likely when you see it hang at 98% in the VPN app) which then drops and then can't reconnect at all is a strong fingerprint of mobile carrier-side interference, specifically:

Idle/inactivity timeouts on the carrier's NAT - mobile carriers use aggressive NAT tables that can expire a TCP connection that isn't sending keepalive traffic frequently enough. Once the first session drops and a new source port is assigned, the SSL handshake itself may be getting blocked or mangled.

Deep Packet Inspection (DPI) or SSL inspection on the mobile network - some carriers inspect or interfere with sustained SSL tunnels, especially once they've been alive for a couple of minutes.

Carrier-level port 443 throttling or session limits - the ssl_connect:-3 on retry suggests the TCP connection may be establishing but the SSL layer is being reset or interfered with before the handshake completes.

An interesting test of the above, which would help pinpoint if it was an issue with the EE carrier specifically, or something within the tethered hotspot mechanics would be if you have access to an alternative mobile network that you can tether to? As if it works on a different carrier then at least it narrows down the issue to EE's network.

~~

Note the final paragraph which I subsequently tried by replacing my EE sim with a GiffGaff. The GiffGaff sim worked perfectly including being able to connect via the VPN.

As the techie said, this imho narrows down the issue to EE's network.

Whatever the technicalities, from my point of view I have one sim that works and another that doesn't. Choosing which to stay with is not difficult!

[Leanne_T · Accepted solution]

Hi @capncreer 

If you let the VPN tech team know you have tried another SIM card, they should be able to run further tests to see what could be causing this. If you would like to speak to our tech guides to get this checked at our end, please give us a call on 150. 

Thanks.

Leanne.