Be careful upgrading to Jessie. The nf_conntrack_pptp kernel module is no longer loaded by default. If you happen to use netfilter's mod state to drop invalid packets, the tunnels will come up but no traffic will hit a wall.

This is not exactly well documented and the symptoms make for a nice trip down the iptables rabbit hole. (tcpdump shows the packets coming in, none of the log rules trigger, yet the packets vaporize. Add IPSec to the mix, and it equals some serious hairpulling.) The raw table + TRACE target are your friend, but that still does not isolate a direct cause. It did provide enough information to point Google in the right direction, though.