NAT sometimes does not play nice with PPTP. Though SmallWall seems to work rather well. and modern OSes have less trouble then older ones.

Major “Gotcha!” If you are visiting a remote network where the network range is the same as the network range on the PPTP Network (your LAN network in most cases) then the PPTP tunnel will not work. E.g. You are using a WiFi connection in a local coffee shop and the network range it has put you in is 192.168.1.0/24. You try to connect to your home network via PPTP, but your home also uses 192.168.1.0/24. The tunnel/authentication to the PPTP server will happen, but no traffic will go across that tunnel due to the “confusion” in the TCP/IP stack on your workstation. This is not a SmallWall problem, but a limitation in TCP/IP routing.

To get around this use some odd network range at home. E.x. 192.168.88.0/24. Most people use 10.0.0.1 and 192.168.1.0 so try to set your home network differently. This will also help when you setup IPSEC tunnels between your house and say your friend’s house.

Some ISP's use unreasonably short DHCP lease times, like one hour. If the PPTP client machine gets a short lease from DHCP, it will lose internet connectivity after the lease expires. This is because all network traffic, including your DHCP renewal requests, are going across the VPN. Since it can't hit the local DHCP server through the VPN, when the lease expires your machine will release its IP address. This causes the loss of all connectivity. You have to disconnect from the PPTP (if it doesn't disconnect itself), renew your IP address, and reconnect. This is common on all hosts. If this happens, contact the administrator of your DHCP server (likely the client machine's ISP) and get the lease time lengthened.

The author has seen this situation numerous times, and in some cases, the ISP was willing to help and resolved the problem. Business class service is more likely to have responsive support. Consumer grade service is unlikely to understand what you are saying.

UPnP packets from your LAN do not make it to the PPTP network. This is more than likely because SmallWall does not support UPnP. (In English: those of use having dreams of accessing our ReplayTV ™ or other media devices that use UPnP can dream of other things for now. It is actually more secure to not have UPnP on a firewall, but some people overlook that so they can use voice chat software and DVRs.) You can still use those services, but auto discovery is not going to work. (But with the ability to register DHCP leases in the DNS, this is less of a problem then you might think.)

Old style Network Neighborhood in Windows does not work over PPTP connections because broadcasts are not forwarded across the PPTP connection. However, Active Directory network browsing works fine!