How to understand who is blocking packets on a specific port?

Question

Network administration

There are two computers A and B. When computer A (a server with Windows Server 2008 R2) was, roughly speaking, on the same network - at the time of configuration, it accepted incoming VPN connections. Moreover, I tested different scenarios, when A and B were both on the same local network, and B was knocking over the Internet. Then I moved A to the place of its combat operation (that is, nothing changed on the server) and the connections are now not established. Could it be that this provider somehow cuts traffic to VPN ports (1723)? Although, for example, I connect to it freely via RDP. Computer A is now connected to the Internet directly via a PPPoE connection (temporarily, until there is a router, in the future, a router will connect to the Internet and distribute it, as usual).
I'm a mediocre networker, I sin either on the provider, or it's something else, and as a fallback - wait until the router appears, organize port forwarding on it, suddenly it will work.
And in general, ideally, on the topic of the question, is it possible to use tracert, or rather its analogues on OS X, to identify at what stage of the route traffic is cut to the VPN port? The network utility in Mac Os does not see any open port at all on computer A, although the same RDP port 3389 is open.
UPD: Looks like I figured out what the reason is. Since the computer is still connected directly without a router and uses ICS Internet Sharing, the routing configured to receive VPN does not work. I'm waiting for the router to be installed

Answer 1

traceroute -P TCP -p 1723 IP
But most likely the problem is not the port blocking. PPTP uses the GRE protocol in addition to the TCP / 1723 port, if your provider uses NAT, then it requires special NAT support for GRE, if it is not there, then the connection will not be established. If you are asked and accepted a login with a password, and then the connection is not established, then this is the problem. Possible solutions are to use SSTP instead of PPTP (in Mac OS X, you most likely need to install a third-party client).

Answer 2

The provider can easily cut 1723 if it is a mobile provider. For them, this is generally in the order of things. It is also very common to block 1723 in hotels. You can put wireshark and see if anything comes at the moment the connection starts.