...
Introduction
PPTP has many known security issues and we are not recommending to use it. However, this protocol is integrated into common operating systems and it is easy to set it up. PPTP can be useful in networks where security concerns are not considered.
PPTP traffic uses TCP port 1723 and IP protocol GRE (Generic Routing Encapsulation, IP protocol ID 47), as assigned by the Internet Assigned Numbers Authority (IANA). PPTP can be used with most firewalls and routers by enabling traffic destined for TCP port 1723 and protocol 47 traffic to be routed through the firewall or router. PPTP includes PPP authentication and accounting for each PPTP connection. Full authentication and accounting of each connection may be done through a RADIUS client or locally.
Configuration example
PPTP Client
| Code Block | ||
|---|---|---|
| ||
/interface pptp-client |
The following example demonstrates how to set up a PPTP client with username "PPTPuser", password "StrongPass" and server 172.16.16.1:
[admin@MikroTik] > interface pptp-client add name=PPTPuser user=PPTPuser password=StrongPass connect-to=172.16.16.1 disabled=no
[admin@MikroTik] > interface pptp-client print
Flags: X - disabled; R - running
0 name="PPTPuser" max-mtu=1450 max-mru=1450 mrru=disabled connect-to=172.16.16.1 user="PPTPuser" password="StrongPass" profile=default-encryption
keepalive-timeout=60 add-default-route=no dial-on-demand=no allow=pap,chap,mschap1,mschap2
PPTP Server
| Code Block | ||
|---|---|---|
| ||
/interface pptp-server |
An interface is created for each tunnel established to the given server. There are two types of interfaces in the L2TP server's configuration:
- Static interfaces are added administratively if there is a need to reference the particular interface name (in firewall rules or elsewhere) created for the particular user;
- Dynamic interfaces are added to this list automatically whenever a user is connected and its username does not match any existing static entry (or in case the entry is active already, as there can not be two separate tunnel interfaces referenced by the same name);
...
| Note |
|---|
| In both cases PPP users must be configured properly - static entries do not replace PPP configuration. |
...
Access Concentrator
...
| Code Block | ||
|---|---|---|
| ||
/[admin@MikroTik] > interface pptp-server server |
The PPTP server (access concentrator) supports multiple servers for each interface - with differing service names. The access concentrator name and PPTP service name are used by clients to identify the access concentrator to register with. The access concentrator name is the same as the identity of the router displayed before the command prompt. The identity may be set within the /system identity submenu.
To enable the PPTP server:
| Code Block | ||
|---|---|---|
| ||
[admin@MikroTik] > interface pptp-server server set enabled=yes |
...
[admin@MikroTik] > interface pptp-server server print |
...
enabled: yes |
...
max-mtu: 1450 |
...
max-mru: 1450 |
...
mrru: disabled |
...
authentication: mschap1,mschap2 |
...
keepalive-timeout: 30 default-profile: default-encryption |
Quick Example
PPTP Client
The following example demonstrates how to set up a PPTP client with username "MT-User", password "StrongPass" and server 192.168.62.2:
| Code Block | ||
|---|---|---|
|
...
[admin@MikroTik] > interface pptp-client add connect-to=192.168.62.2 disabled=no name=pptp-out1 password=StrongPass user=MT-User
[admin@MikroTik] > interface pptp-client print
Flags: X - disabled; R - running
0 R name="pptp-out1" max-mtu=1450 max-mru=1450 mrru=disabled connect-to=192.168.62.2 user="MT-User"
password="StrongPass" profile=default-encryption keepalive-timeout=60 add-default-route=no
dial-on-demand=no allow=pap,chap,mschap1,mschap2 |
PPTP Server
On the other side we simply enable the PPTP server and create a PPP secret for a particular user:
| Code Block | ||
|---|---|---|
| ||
[admin@MikroTik] > interface pptp-server server set enabled=yes
[admin@MikroTik] > ppp secret add local-address=10.0.0.1 name=MT-User password=StrongPass profile=default-encryption remote-address=10.0.0.5 service=pptp
[admin@MikroTik] > interface pptp-server print
Flags: D - dynamic; R - running
Columns: NAME, USER, MTU, CLIENT-ADDRESS, UPTIME, ENCODING
# NAME USER MTU CLIENT-ADDRESS UPTIM ENCODING
0 DR <pptp-MT-User> MT-User 1450 192.168.51.3 44m8s MPPE128 stateless |