Share via

Azure Windows Server VPN fails due to GRE protocol blocked

Rakri Aizat 0 Reputation points
2026-04-09T07:49:09.38+00:00

I deployed a VPN endpoint using Windows Server 2012 R2 on Azure for our company remote staff, but now when users try to dial in, it throws this error saying the tunnel starts but then fails because GRE (protocol 47) isnt getting through. I’ve already wasted half a day on this and my manager keeps pinging me because the sales team cant access internal tools, so kinda desperate here. What could be blocking this and how do I fix it in a corporate network setup?

Windows for business | Windows Server | Devices and deployment | Configure application groups
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jason Nguyen Tran 14,595 Reputation points Independent Advisor
    2026-04-09T09:14:33.6533333+00:00

    Hi Rakri Aizat,

    Based on the errors you mentioned (0x800759D9 and m_spHelper->ReadCreds failed), the issue is most likely related to how the RD Gateway is handling identity and credentials after your company’s IT renovation.

    One common cause is that the RD Gateway server’s SSL certificate is either expired, mismatched, or not trusted by the client. When this happens, MSTSC will show the login window but fail to pass credentials through, resulting in no traffic. Another possibility is that the Connection Authorization Policies (CAP) or Resource Authorization Policies (RAP) were changed during the renovation, which can block valid users from connecting.

    To troubleshoot, I recommend verifying that the RD Gateway certificate is valid and trusted on your laptop, and checking that CAP/RAP policies still allow your account. Restarting the RD Gateway service after confirming these settings often helps. You should also confirm that TCP 443 and UDP 3391 are open end‑to‑end, since those ports are required for RD Gateway traffic. If direct RDP to the host works but RDP via the gateway fails, that’s a clear sign the gateway configuration is the root cause.

    In short, the countermeasures are: validate the SSL certificate, review CAP/RAP policies, confirm port connectivity, and restart the gateway service. This should restore proper identity handling and allow your remote staff to connect again. I hope this helps you move forward quickly. If you find this answer helpful, please consider clicking Accept Answer so others can benefit too.

    Jason.

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.