Documentation
VyOS Documentation
VPN on VyOS
PPTP Server - Legacy VPN (Deprecated)

PPTP Server - Legacy VPN (Deprecated)

CRITICAL SECURITY WARNING

PPTP (Point-to-Point Tunneling Protocol) is an obsolete and insecure VPN technology with numerous well-known critical vulnerabilities. VyOS implements PPTP only for backwards compatibility with legacy systems.

Using PPTP for new deployments or any application that requires real security is STRONGLY DISCOURAGED.

Use instead:

  • WireGuard - a modern, fast, secure VPN protocol
  • OpenVPN - proven, flexible, widely supported
  • IPsec/IKEv2 - standardized, enterprise-grade VPN
  • L2TP/IPsec - better than PPTP, but also becoming outdated

Overview

What PPTP is

PPTP (Point-to-Point Tunneling Protocol):

  • Developed by Microsoft in 1999
  • One of the first VPN protocols
  • Encapsulates PPP (Point-to-Point Protocol) frames in a GRE (Generic Routing Encapsulation) tunnel
  • Uses TCP 1723 for the control channel and GRE (IP Protocol 47) for the data channel
  • MPPE (Microsoft Point-to-Point Encryption) for encryption

Known PPTP vulnerabilities

Critical security problems:

  1. Weak encryption:

    • MPPE is based on the RC4 cipher (obsolete)
    • Encryption keys are derived from MS-CHAPv2 hashes (weak)
    • Effective key length is only 128 bits (for MPPE-128)

  2. MS-CHAPv2 vulnerabilities:

    • MS-CHAPv2 authentication can be cracked in seconds with modern GPUs
    • DES encryption (used in MS-CHAPv2) is considered fully compromised
    • Dictionary and rainbow table attacks are highly effective

  3. No Perfect Forward Secrecy (PFS):

    • Compromise of a single key exposes all traffic
    • Past sessions cannot be protected

  4. Bit-flipping attacks:

    • RC4 is susceptible to bit-flipping attacks
    • Encrypted data can be modified without detection

  5. NAT traversal problems:

    • GRE does not work well through NAT
    • Special support is required on routers (PPTP passthrough)

Public vulnerabilities:

  • 2012: Moxie Marlinspike and CloudCracker demonstrated cracking MS-CHAPv2 in 23 hours
  • 2012: Microsoft acknowledged that PPTP “can no longer be considered secure”
  • NSA: The Snowden documents revealed that the NSA can decrypt PPTP traffic

Why VyOS still supports PPTP

The only valid reasons:

  1. Legacy hardware - old equipment with PPTP-only clients
  2. Backwards compatibility - migration from older systems
  3. Non-security scenarios - testing, lab environments without sensitive data
  4. Temporary bridge - a stopgap during migration to a modern VPN

Do NOT use PPTP if:

  • Sensitive data is transmitted
  • Real security is required
  • Alternatives exist (they almost always do)
  • Compliance regulations apply (PCI DSS, HIPAA, and GDPR prohibit PPTP)

PPTP architecture

Components

  1. PPTP Server (PNS - PPTP Network Server) - VyOS
  2. PPTP Client (PAC - PPTP Access Concentrator)
  3. Control Connection - TCP 1723
  4. Data Tunnel - GRE (IP Protocol 47)
  5. PPP Session - authentication and IP assignment

Connection process

  1. TCP Connection - the client connects to the server on TCP 1723
  2. Control Channel - the PPTP control connection is established
  3. GRE Tunnel - a GRE tunnel is created for data
  4. PPP Negotiation - LCP (Link Control Protocol) negotiation
  5. Authentication - PAP/CHAP/MSCHAP/MSCHAP-v2
  6. IPCP - IP Control Protocol assigns an IP address
  7. MPPE Negotiation - if encryption is enabled
  8. Data Transfer - data transfer begins

Ports and protocols used

  • TCP 1723 - PPTP control channel (required)
  • GRE (IP Protocol 47) - PPTP data tunnel (required)
  • UDP 500/4500 - NOT used (that is IPsec)
  • UDP 1701 - NOT used (that is L2TP)

Important: PPTP requires both - TCP 1723 AND GRE (protocol 47).

Migrating away from PPTP

Migration plan

Step 1: Assessment

# View current PPTP users
show pptp-server sessions

# View the configuration
show configuration vpn pptp remote-access

Step 2: Choose an alternative

ScenarioRecommendationReason
Windows/iOS/Android clientsL2TP/IPsecBuilt-in clients
Maximum performanceWireGuardModern, fast
Legacy compatibilityOpenVPNBroad support
Enterprise deploymentIPsec/IKEv2Standardized
Mobile usersWireGuard/IKEv2Best roaming

Step 3: Parallel deployment

# Keep PPTP running
# Add a new VPN method (for example, WireGuard)
set interfaces wireguard wg0 address '10.10.10.1/24'
set interfaces wireguard wg0 port '51820'
set interfaces wireguard wg0 private-key 'XXXXXXXX'

# Peer configuration
set interfaces wireguard wg0 peer CLIENT1 public-key 'YYYYYYYY'
set interfaces wireguard wg0 peer CLIENT1 allowed-ips '10.10.10.2/32'

commit
save

# Notify users about the migration

Step 4: Testing

  • Test the new VPN with a small group of users
  • Make sure all features work
  • Document the connection procedure for users

Step 5: Migrate users

  • Move users over gradually (in batches)
  • Keep PPTP active as a fallback
  • Monitor usage of both VPNs

Step 6: Decommission PPTP

# Once everyone has migrated
delete vpn pptp remote-access

# Remove firewall rules
delete firewall ipv4 input filter rule XXX  # PPTP rules

commit
save

VPN protocol comparison table

CriterionPPTPL2TP/IPsecOpenVPNWireGuardIPsec/IKEv2
SecurityVery weakGoodExcellentExcellentExcellent
PerformanceMediumMediumGoodExcellentGood
Built-in clientsYes (deprecated)YesNoPartialYes (iOS/macOS)
NAT traversalPoorGood (NAT-T)ExcellentExcellentGood
Setup complexitySimpleMediumMediumSimpleComplex
Mobile roamingPoorMediumGoodExcellentExcellent
Firewall friendlyPoor (GRE)MediumExcellentGoodMedium
2025 recommendationNOLegacy onlyYesYES (top)Yes

Basic configuration (NOT for production)

Minimal PPTP server

WARNING: The following configuration is NOT SECURE and is provided for reference only.

# PPTP server with local authentication
set vpn pptp remote-access authentication mode 'local'

# Users (weakly protected!)
set vpn pptp remote-access authentication local-users username testuser password 'testpass'
set vpn pptp remote-access authentication local-users username alice password 'AlicePass123!'
set vpn pptp remote-access authentication local-users username bob password 'BobPass456!'

# Client IP pool
set vpn pptp remote-access client-ip-pool start '192.168.250.10'
set vpn pptp remote-access client-ip-pool stop '192.168.250.50'

# Gateway IP (VyOS)
set vpn pptp remote-access gateway-address '192.168.250.1'

# Outside address (VyOS WAN IP)
set vpn pptp remote-access outside-address '203.0.113.1'

# DNS for clients
set vpn pptp remote-access name-server '8.8.8.8'
set vpn pptp remote-access name-server '1.1.1.1'

# Firewall for PPTP
set firewall ipv4 input filter rule 150 action accept
set firewall ipv4 input filter rule 150 destination port 1723
set firewall ipv4 input filter rule 150 protocol tcp
set firewall ipv4 input filter rule 150 description 'PPTP control channel'

set firewall ipv4 input filter rule 151 action accept
set firewall ipv4 input filter rule 151 protocol gre
set firewall ipv4 input filter rule 151 description 'PPTP data tunnel (GRE)'

# NAT for PPTP clients
set nat source rule 150 outbound-interface name eth0
set nat source rule 150 source address 192.168.250.0/24
set nat source rule 150 translation address masquerade

commit
save

Verifying the PPTP server

# Active sessions
show pptp-server sessions

# Statistics
show pptp-server statistics

# accel-ppp logs (PPTP backend)
sudo journalctl -u accel-ppp@pptp -b 0

# Live log monitoring
sudo journalctl -u accel-ppp@pptp -f

# Verify that PPTP is listening on 1723
sudo netstat -tlnp | grep 1723

Example output of show pptp-server sessions:

Interface | Username  | IP Address      | Calling Station | Uptime    | RX/TX
----------+-----------+-----------------+-----------------+-----------+-------------
pptp0     | alice     | 192.168.250.10  | 198.51.100.50   | 00:15:32  | 1.2M/3.4M
pptp1     | bob       | 192.168.250.11  | 198.51.100.51   | 01:23:45  | 5.6M/12.1M

Authentication

Local authentication

Users are stored in the VyOS configuration (plaintext passwords in the config!):

set vpn pptp remote-access authentication mode 'local'

# Add users
set vpn pptp remote-access authentication local-users username user1 password 'Pass1!'
set vpn pptp remote-access authentication local-users username user2 password 'Pass2!'

# Static IP addresses for specific users
set vpn pptp remote-access authentication local-users username user1 static-ip '192.168.250.10'

# Disable a user (delete)
delete vpn pptp remote-access authentication local-users username user1

commit

Problems with local authentication:

  • Passwords are visible in show configuration (base64, easy to decode)
  • No centralized management
  • No audit trail
  • Scaling is problematic

RADIUS authentication

Centralized authentication (recommended for production, although PPTP itself is not recommended):

set vpn pptp remote-access authentication mode 'radius'

# Primary RADIUS server
set vpn pptp remote-access authentication radius server 192.168.1.10 key 'RadiusSecret123!'

# Secondary RADIUS server (failover)
set vpn pptp remote-access authentication radius server 192.168.1.11 key 'RadiusSecret123!'

# RADIUS settings
set vpn pptp remote-access authentication radius timeout 5
set vpn pptp remote-access authentication radius acct-timeout 5

# Source address for RADIUS requests
set vpn pptp remote-access authentication radius source-address '192.168.1.1'

# RADIUS accounting
set vpn pptp remote-access authentication radius acct-timeout 3

# NAS Identifier for RADIUS
set vpn pptp remote-access authentication radius nas-identifier 'vyos-pptp'

commit

RADIUS VSA (Vendor-Specific Attributes) for dynamic IP:

  • Framed-IP-Address - static IP for the user
  • Framed-Route - push routes to the client

Authentication protocols

Security hierarchy (from least to most secure):

  1. PAP (Password Authentication Protocol) - plaintext passwords
  2. CHAP (Challenge-Handshake Authentication Protocol) - challenge-response
  3. MSCHAP (Microsoft CHAP) - improved CHAP
  4. MSCHAP-v2 - improved MSCHAP (but still crackable)
# Require MSCHAP-v2 only (the least-bad option)
set vpn pptp remote-access authentication protocols pap disable
set vpn pptp remote-access authentication protocols chap disable
set vpn pptp remote-access authentication protocols mschap disable
set vpn pptp remote-access authentication protocols mschap-v2 enable

# Or via require (alternative syntax)
set vpn pptp remote-access authentication require 'mschap-v2'

commit

Important: Even MSCHAP-v2 is considered insecure in 2025. It is merely the “least bad” option for PPTP.

Per-protocol configuration

# Allow everything (least secure)
set vpn pptp remote-access authentication protocols pap enable
set vpn pptp remote-access authentication protocols chap enable
set vpn pptp remote-access authentication protocols mschap enable
set vpn pptp remote-access authentication protocols mschap-v2 enable

# CHAP and MSCHAP-v2 only
set vpn pptp remote-access authentication protocols pap disable
set vpn pptp remote-access authentication protocols chap enable
set vpn pptp remote-access authentication protocols mschap disable
set vpn pptp remote-access authentication protocols mschap-v2 enable

# MSCHAP-v2 only (recommended for PPTP, but PPTP itself is not recommended)
set vpn pptp remote-access authentication protocols pap disable
set vpn pptp remote-access authentication protocols chap disable
set vpn pptp remote-access authentication protocols mschap disable
set vpn pptp remote-access authentication protocols mschap-v2 enable

commit

MPPE encryption

What MPPE is

MPPE (Microsoft Point-to-Point Encryption):

  • Developed by Microsoft for PPTP
  • Based on the RC4 stream cipher (obsolete, insecure)
  • Keys are derived from MS-CHAP authentication
  • Key length: 40-bit, 56-bit, or 128-bit

Security problems:

  • RC4 has known vulnerabilities (bias in the keystream)
  • 40-bit and 56-bit are easily broken by brute force
  • Even 128-bit MPPE is not secure enough by modern standards
  • No data authentication
  • Susceptible to bit-flipping attacks

Configuring MPPE

# Require 128-bit encryption (the least-bad option)
set vpn pptp remote-access authentication mppe 'require-128'

# Other options (NOT recommended)
set vpn pptp remote-access authentication mppe 'require'     # Any MPPE (40/56/128)
set vpn pptp remote-access authentication mppe 'prefer'      # Prefer MPPE
set vpn pptp remote-access authentication mppe 'deny'        # Disable MPPE (plaintext!)

commit

MPPE options:

ValueDescriptionSecurity
require-128Require 128-bit MPPELeast bad
requireRequire any MPPE (40/56/128)Very bad
preferPrefer MPPE, but allow plaintextCritically bad
denyDisable MPPE (plaintext)NEVER use this

Recommendation: If you are FORCED to use PPTP, use require-128. But better still - do not use PPTP at all.

MPPE key rotation

MPPE rotates keys automatically:

  • A new key every 256 packets (by default)
  • A mitigation for some RC4 attacks
  • Does NOT solve the fundamental problems of RC4

Client IP Pool configuration

Basic IP pool

# Simple range
set vpn pptp remote-access client-ip-pool start '192.168.250.10'
set vpn pptp remote-access client-ip-pool stop '192.168.250.100'

# Gateway IP (VyOS IP in the PPTP network)
set vpn pptp remote-access gateway-address '192.168.250.1'

commit

Pool size calculation:

  • Start: 192.168.250.10
  • Stop: 192.168.250.100
  • Number of IPs: 100 - 10 + 1 = 91 addresses
  • Maximum concurrent clients: 91

Subnet for PPTP clients

# Dedicated /24 network for PPTP
# Network: 192.168.250.0/24
# Gateway: 192.168.250.1 (VyOS)
# Pool: 192.168.250.10-192.168.250.254

set vpn pptp remote-access client-ip-pool start '192.168.250.10'
set vpn pptp remote-access client-ip-pool stop '192.168.250.254'
set vpn pptp remote-access gateway-address '192.168.250.1'

# Firewall for the PPTP subnet
set firewall ipv4 forward filter rule 200 action accept
set firewall ipv4 forward filter rule 200 source address 192.168.250.0/24
set firewall ipv4 forward filter rule 200 description 'PPTP clients to LAN'

# NAT
set nat source rule 150 source address 192.168.250.0/24
set nat source rule 150 outbound-interface name eth0
set nat source rule 150 translation address masquerade

commit

Static IPs for users

# User with a fixed IP
set vpn pptp remote-access authentication local-users username admin password 'AdminPass!'
set vpn pptp remote-access authentication local-users username admin static-ip '192.168.250.5'

# Another user with a fixed IP
set vpn pptp remote-access authentication local-users username monitor password 'MonitorPass!'
set vpn pptp remote-access authentication local-users username monitor static-ip '192.168.250.6'

# All other users receive an IP from the pool
set vpn pptp remote-access client-ip-pool start '192.168.250.10'
set vpn pptp remote-access client-ip-pool stop '192.168.250.100'

commit

Important: Static IPs must not overlap with the pool range.

Outside address

# IP address on which PPTP listens (usually the WAN IP)
set vpn pptp remote-access outside-address '203.0.113.1'

# Or listen on a specific interface
set vpn pptp remote-access outside-address '192.0.2.1'

commit

IPv6 support

PPTP supports IPv6 through PPP, but this is rarely used and even less secure.

IPv6 configuration

# Enable IPv6 for PPTP clients
set vpn pptp remote-access ppp-options ipv6 'allow'

# IPv6 pool for clients
set vpn pptp remote-access client-ipv6-pool prefix '2001:db8:pptp::/64'
set vpn pptp remote-access client-ipv6-pool mask '96'

# IPv6 prefix delegation (if needed)
set vpn pptp remote-access client-ipv6-pool delegate '2001:db8:pptp-delegated::/56'

commit

IPv6 interface identifiers

# Interface ID for IPv6
set vpn pptp remote-access ppp-options ipv6-interface-id '::1'
set vpn pptp remote-access ppp-options ipv6-peer-interface-id '::2'

commit

Important: IPv6 support in PPTP is experimental and not recommended for production.

Rate limiting

Per-user bandwidth limits

# Bandwidth shaping for a user
set vpn pptp remote-access authentication local-users username user1 password 'Pass1!'
set vpn pptp remote-access authentication local-users username user1 rate-limit download '10000'
set vpn pptp remote-access authentication local-users username user1 rate-limit upload '5000'

# user2 without limits
set vpn pptp remote-access authentication local-users username user2 password 'Pass2!'

commit

Units:

  • Download/upload in Kbit/s
  • 10000 = 10 Mbit/s download
  • 5000 = 5 Mbit/s upload

RADIUS-based rate limiting

RADIUS can return VSA (Vendor-Specific Attributes) for rate limiting:

FreeRADIUS example (radreply table):

username | attribute          | op | value
---------+--------------------+----+-------
alice    | Filter-Id          | := | 10000/5000
bob      | Filter-Id          | := | 50000/25000

VyOS applies the rate limits from RADIUS automatically.

Session management

Maximum sessions

# Limit the number of concurrent connections
set vpn pptp remote-access max-concurrent-sessions 50

commit

Important: Set this to match the IP pool size and CPU resources.

Session timeout

# Idle timeout (disconnect on inactivity)
set vpn pptp remote-access idle 1800  # 1800 seconds = 30 minutes

# Session timeout (maximum session duration)
set vpn pptp remote-access session-timeout 28800  # 28800 seconds = 8 hours

commit

Connection limits per user

# RADIUS can limit the number of concurrent sessions per user
# Configured on the RADIUS server, not on VyOS

# FreeRADIUS example (radgroupcheck):
# groupname | attribute              | op | value
# ----------+------------------------+----+-------
# users     | Simultaneous-Use       | := | 1

Advanced configuration

MTU and MRU

# MTU (Maximum Transmission Unit)
set vpn pptp remote-access mtu 1400

# MRU (Maximum Receive Unit) - usually equal to MTU
set vpn pptp remote-access mru 1400

commit

Recommendation: MTU 1400 or lower for PPTP (GRE + PPP overhead).

MTU calculation:

  • Ethernet MTU: 1500 bytes
  • IP header: 20 bytes
  • GRE header: 24 bytes
  • PPP header: 8 bytes
  • MPPE overhead: 4-8 bytes
  • Optimal PPTP MTU: 1400-1430 bytes

PPP options

# LCP echo for keepalive
set vpn pptp remote-access ppp-options lcp-echo-failure 3
set vpn pptp remote-access ppp-options lcp-echo-interval 30

# LCP echo-timeout
set vpn pptp remote-access ppp-options lcp-echo-timeout 30

commit

LCP keepalive:

  • Interval: the interval between echo requests (seconds)
  • Failure: the number of unanswered echoes after which the session is disconnected
  • Timeout: how long to wait for a reply

DNS and WINS

# DNS servers for PPTP clients
set vpn pptp remote-access name-server '192.168.1.1'
set vpn pptp remote-access name-server '8.8.8.8'
set vpn pptp remote-access name-server '1.1.1.1'

# WINS servers (for Windows clients)
set vpn pptp remote-access wins-server '192.168.1.100'
set vpn pptp remote-access wins-server '192.168.1.101'

commit

Client-to-client routing

By default, PPTP clients can communicate with each other through VyOS:

# Block client-to-client (if isolation is needed)
# Firewall rule to block it
set firewall ipv4 forward filter rule 201 action drop
set firewall ipv4 forward filter rule 201 source address 192.168.250.0/24
set firewall ipv4 forward filter rule 201 destination address 192.168.250.0/24
set firewall ipv4 forward filter rule 201 description 'Block PPTP client-to-client'

commit

Logging

# Enable verbose logging
set vpn pptp remote-access ppp-options logging level debug

# Log specific events
set vpn pptp remote-access ppp-options logging level info

commit

Log levels:

  • debug - maximum detail
  • info - standard information
  • warning - warnings and errors only
  • error - errors only

Viewing logs:

sudo journalctl -u accel-ppp@pptp -n 100    # last 100 lines
sudo journalctl -u accel-ppp@pptp -f         # follow (live)
sudo journalctl -u accel-ppp@pptp --since "1 hour ago"

Firewall configuration

Minimal firewall rules

# Allow the PPTP control channel (TCP 1723)
set firewall ipv4 input filter rule 150 action accept
set firewall ipv4 input filter rule 150 destination port 1723
set firewall ipv4 input filter rule 150 protocol tcp
set firewall ipv4 input filter rule 150 description 'PPTP control'

# Allow GRE (IP protocol 47) for PPTP data
set firewall ipv4 input filter rule 151 action accept
set firewall ipv4 input filter rule 151 protocol gre
set firewall ipv4 input filter rule 151 description 'PPTP data (GRE)'

commit

Restricting the source IP

# Allow PPTP only from specific networks
set firewall ipv4 input filter rule 150 action accept
set firewall ipv4 input filter rule 150 source address 198.51.100.0/24
set firewall ipv4 input filter rule 150 destination port 1723
set firewall ipv4 input filter rule 150 protocol tcp

set firewall ipv4 input filter rule 151 action accept
set firewall ipv4 input filter rule 151 source address 198.51.100.0/24
set firewall ipv4 input filter rule 151 protocol gre

commit

Rate limiting connections

# Rate limit on PPTP connections (protection against brute force)
set firewall ipv4 input filter rule 150 action accept
set firewall ipv4 input filter rule 150 destination port 1723
set firewall ipv4 input filter rule 150 protocol tcp
set firewall ipv4 input filter rule 150 recent count 5
set firewall ipv4 input filter rule 150 recent time minute 1

# Drop if the limit is exceeded
set firewall ipv4 input filter rule 149 action drop
set firewall ipv4 input filter rule 149 destination port 1723
set firewall ipv4 input filter rule 149 protocol tcp
set firewall ipv4 input filter rule 149 recent count 6
set firewall ipv4 input filter rule 149 recent time minute 1
set firewall ipv4 input filter rule 149 log enable

commit

NAT configuration

Source NAT for PPTP clients

# Masquerade for PPTP clients going out to the internet
set nat source rule 150 outbound-interface name eth0
set nat source rule 150 source address 192.168.250.0/24
set nat source rule 150 translation address masquerade

commit

Destination NAT (port forwarding for external PPTP clients)

If VyOS is behind another NAT router:

# On the upstream router:
# Forward TCP 1723 and GRE (IP protocol 47) to VyOS

# No VyOS configuration is required (PPTP listens on the outside-address)

Important: Many NAT routers have problems with GRE passthrough. You may need to enable “PPTP passthrough” in the router’s settings.

Client configuration

Windows client

Windows 10/11:

  1. Settings → Network & Internet → VPN
  2. Add a VPN connection
  3. VPN provider: Windows (built-in)
  4. Connection name: Company PPTP
  5. Server name or address: vpn.company.com or 203.0.113.1
  6. VPN type: Point to Point Tunneling Protocol (PPTP)
  7. Type of sign-in info: User name and password
  8. User name: testuser
  9. Password: testpass
  10. Save → Connect

PowerShell:

Add-VpnConnection -Name "Company PPTP" `
  -ServerAddress "vpn.company.com" `
  -TunnelType Pptp `
  -EncryptionLevel Required `
  -AuthenticationMethod MSChapv2 `
  -Force `
  -RememberCredential `
  -PassThru

# Connect
rasdial "Company PPTP" testuser testpass

# Disconnect
rasdial "Company PPTP" /disconnect

Linux client

Ubuntu/Debian:

# Installation
sudo apt-get install pptp-linux

# Configuration /etc/ppp/peers/company-pptp
pty "pptp vpn.company.com --nolaunchpppd"
name testuser
password testpass
remotename PPTP
require-mppe-128
file /etc/ppp/options.pptp
ipparam company-pptp

# /etc/ppp/options.pptp
lock
noauth
refuse-eap
refuse-pap
refuse-chap
refuse-mschap
nobsdcomp
nodeflate

# Connect
sudo pon company-pptp

# Verify
ip addr show ppp0
ip route

# Disconnect
sudo poff company-pptp

macOS client

  1. System Preferences → Network
  2. Click “+” to add connection
  3. Interface: VPN
  4. VPN Type: PPTP
  5. Service Name: Company PPTP
  6. Server Address: vpn.company.com
  7. Account Name: testuser
  8. Authentication Settings:
    • Password
    • Encryption: Maximum (128-bit)
  9. Advanced:
    • Send all traffic over VPN (optional)
  10. Apply → Connect

Android client

Warning: Android 12+ removed built-in PPTP support because of security problems.

Android 11 and earlier:

  1. Settings → Network & Internet → VPN
  2. Add VPN
  3. Name: Company PPTP
  4. Type: PPTP
  5. Server address: vpn.company.com
  6. Username: testuser
  7. Password: testpass
  8. Save → Connect

Android 12+: PPTP is not supported. Use OpenVPN or WireGuard.

iOS client

Warning: iOS 10+ removed built-in PPTP support.

Use alternative VPN protocols for iOS.

Configuration examples

Example 1: Basic PPTP for legacy devices

# PPTP remote access with local auth
set vpn pptp remote-access authentication mode 'local'
set vpn pptp remote-access authentication local-users username testuser password 'TestPass123!'
set vpn pptp remote-access authentication local-users username admin password 'AdminPass456!'
set vpn pptp remote-access authentication local-users username admin static-ip '192.168.250.5'

# Require MSCHAP-v2 and MPPE-128
set vpn pptp remote-access authentication protocols pap disable
set vpn pptp remote-access authentication protocols chap disable
set vpn pptp remote-access authentication protocols mschap disable
set vpn pptp remote-access authentication protocols mschap-v2 enable
set vpn pptp remote-access authentication mppe 'require-128'

# IP pool
set vpn pptp remote-access client-ip-pool start '192.168.250.10'
set vpn pptp remote-access client-ip-pool stop '192.168.250.100'
set vpn pptp remote-access gateway-address '192.168.250.1'
set vpn pptp remote-access outside-address '203.0.113.1'

# DNS
set vpn pptp remote-access name-server '192.168.1.1'
set vpn pptp remote-access name-server '8.8.8.8'

# MTU optimization
set vpn pptp remote-access mtu 1400
set vpn pptp remote-access mru 1400

# Session management
set vpn pptp remote-access max-concurrent-sessions 20
set vpn pptp remote-access idle 1800

# PPP options
set vpn pptp remote-access ppp-options lcp-echo-failure 3
set vpn pptp remote-access ppp-options lcp-echo-interval 30

# Firewall
set firewall ipv4 input filter rule 150 action accept
set firewall ipv4 input filter rule 150 destination port 1723
set firewall ipv4 input filter rule 150 protocol tcp
set firewall ipv4 input filter rule 150 description 'PPTP control'

set firewall ipv4 input filter rule 151 action accept
set firewall ipv4 input filter rule 151 protocol gre
set firewall ipv4 input filter rule 151 description 'PPTP data'

set firewall ipv4 forward filter rule 200 action accept
set firewall ipv4 forward filter rule 200 source address 192.168.250.0/24

# NAT
set nat source rule 150 outbound-interface name eth0
set nat source rule 150 source address 192.168.250.0/24
set nat source rule 150 translation address masquerade

commit
save

Example 2: PPTP with RADIUS authentication

# PPTP with RADIUS
set vpn pptp remote-access authentication mode 'radius'
set vpn pptp remote-access authentication radius server 192.168.1.10 key 'RadiusSecret123!'
set vpn pptp remote-access authentication radius server 192.168.1.11 key 'RadiusSecret123!'
set vpn pptp remote-access authentication radius timeout 5
set vpn pptp remote-access authentication radius acct-timeout 3
set vpn pptp remote-access authentication radius nas-identifier 'vyos-pptp-gw'
set vpn pptp remote-access authentication radius source-address '192.168.1.1'

# MSCHAP-v2 only
set vpn pptp remote-access authentication require 'mschap-v2'
set vpn pptp remote-access authentication mppe 'require-128'

# IP pool
set vpn pptp remote-access client-ip-pool start '10.99.0.10'
set vpn pptp remote-access client-ip-pool stop '10.99.0.250'
set vpn pptp remote-access gateway-address '10.99.0.1'
set vpn pptp remote-access outside-address '203.0.113.1'

# DNS and WINS
set vpn pptp remote-access name-server '192.168.1.1'
set vpn pptp remote-access name-server '8.8.8.8'
set vpn pptp remote-access wins-server '192.168.1.100'

# Session limits
set vpn pptp remote-access max-concurrent-sessions 100
set vpn pptp remote-access idle 3600
set vpn pptp remote-access session-timeout 28800

# PPP options
set vpn pptp remote-access mtu 1400
set vpn pptp remote-access ppp-options lcp-echo-failure 3
set vpn pptp remote-access ppp-options lcp-echo-interval 30

# Logging
set vpn pptp remote-access ppp-options logging level info

# Firewall (same as before)
# ...

commit
save

Example 3: PPTP with rate limiting

# PPTP with per-user bandwidth limits
set vpn pptp remote-access authentication mode 'local'

# User tier 1: 5 Mbit/s down, 2 Mbit/s up
set vpn pptp remote-access authentication local-users username user1 password 'Pass1!'
set vpn pptp remote-access authentication local-users username user1 rate-limit download '5000'
set vpn pptp remote-access authentication local-users username user1 rate-limit upload '2000'

# User tier 2: 10 Mbit/s down, 5 Mbit/s up
set vpn pptp remote-access authentication local-users username user2 password 'Pass2!'
set vpn pptp remote-access authentication local-users username user2 rate-limit download '10000'
set vpn pptp remote-access authentication local-users username user2 rate-limit upload '5000'

# Admin: unlimited
set vpn pptp remote-access authentication local-users username admin password 'AdminPass!'
set vpn pptp remote-access authentication local-users username admin static-ip '192.168.250.5'

# IP pool
set vpn pptp remote-access client-ip-pool start '192.168.250.10'
set vpn pptp remote-access client-ip-pool stop '192.168.250.50'
set vpn pptp remote-access gateway-address '192.168.250.1'
set vpn pptp remote-access outside-address '203.0.113.1'

# Standard settings
set vpn pptp remote-access authentication mppe 'require-128'
set vpn pptp remote-access name-server '8.8.8.8'
set vpn pptp remote-access mtu 1400

commit
save

Monitoring and diagnostics

Checking active sessions

# Show active PPTP sessions
show pptp-server sessions

# Example output:
# Interface | Username | IP Address      | Calling Station | Uptime    | RX/TX
# ----------+----------+-----------------+-----------------+-----------+-------------
# pptp0     | testuser | 192.168.250.10  | 198.51.100.50   | 00:15:32  | 1.2M/3.4M
# pptp1     | admin    | 192.168.250.5   | 198.51.100.51   | 01:23:45  | 5.6M/12.1M

# Detailed statistics
show pptp-server statistics

Log monitoring

# PPTP logs (accel-ppp backend)
sudo journalctl -u accel-ppp@pptp -b 0

# Last 50 lines
sudo journalctl -u accel-ppp@pptp -n 50

# Live log monitoring
sudo journalctl -u accel-ppp@pptp -f

# Over the last hour
sudo journalctl -u accel-ppp@pptp --since "1 hour ago"

# Grep for a specific user
sudo journalctl -u accel-ppp@pptp | grep "testuser"

# Errors only
sudo journalctl -u accel-ppp@pptp -p err

Checking connectivity

# On VyOS: ping a PPTP client
ping 192.168.250.10

# Check routing
show ip route

# Traceroute to the client
traceroute 192.168.250.10

# Netstat for PPTP connections
sudo netstat -tlnp | grep 1723

# Show GRE tunnels
sudo ip tunnel show

tcpdump for PPTP

# Capture the PPTP control channel (TCP 1723)
sudo tcpdump -i eth0 port 1723 -n -vv

# Capture GRE traffic (PPTP data)
sudo tcpdump -i eth0 proto gre -n

# Capture on the PPTP interface (decrypted data)
sudo tcpdump -i pptp0 -n

# Save to pcap for analysis in Wireshark
sudo tcpdump -i eth0 port 1723 or proto gre -w /tmp/pptp-capture.pcap

Performance testing

# On the client: iperf3 through PPTP
iperf3 -c 192.168.1.10 -t 30

# On VyOS check CPU usage
top
htop

# Network statistics
show interfaces pptp pptp0

Troubleshooting

Problem: Client cannot connect

Symptoms:

  • Connection timeout
  • “Unable to establish connection”

Causes:

  1. The firewall blocks TCP 1723 or GRE
  2. The NAT router blocks GRE
  3. The PPTP service is not running

Diagnostics:

# Verify that PPTP is listening
sudo netstat -tlnp | grep 1723

# Check the firewall
show firewall ipv4 input filter

# Logs
sudo journalctl -u accel-ppp@pptp -n 50

# Test from the client: telnet to TCP 1723
telnet vpn.company.com 1723

Solution:

# Firewall rules
set firewall ipv4 input filter rule 150 action accept
set firewall ipv4 input filter rule 150 destination port 1723
set firewall ipv4 input filter rule 150 protocol tcp

set firewall ipv4 input filter rule 151 action accept
set firewall ipv4 input filter rule 151 protocol gre

# Restart PPTP
restart pptp

commit

Problem: Authentication fails

Symptoms:

  • “Authentication failed”
  • “Invalid username or password”

Causes:

  1. Wrong username/password
  2. A different auth protocol is required
  3. RADIUS is unavailable

Diagnostics:

# Check the users
show configuration vpn pptp remote-access authentication

# Logs with auth details
sudo journalctl -u accel-ppp@pptp | grep -i "auth"

# RADIUS test (if used)
# On the RADIUS server: tail -f /var/log/freeradius/radius.log

Solution:

# Check the password
show configuration vpn pptp remote-access authentication local-users username testuser

# Allow all auth protocols (for diagnostics)
set vpn pptp remote-access authentication protocols pap enable
set vpn pptp remote-access authentication protocols chap enable
set vpn pptp remote-access authentication protocols mschap enable
set vpn pptp remote-access authentication protocols mschap-v2 enable

# Disable MPPE (for diagnostics, NOT for production)
delete vpn pptp remote-access authentication mppe

commit

Problem: Connected, but no network access

Symptoms:

  • The PPTP tunnel is UP
  • Ping to the gateway works
  • Ping to LAN resources does not work

Causes:

  1. The firewall blocks forwarding
  2. NAT is not configured
  3. Routing problems

Diagnostics:

# On VyOS: ping the client
ping 192.168.250.10

# On the client: ping the gateway
ping 192.168.250.1

# Check routing on the client
ip route  # Linux
route print  # Windows

# Firewall forward rules
show firewall ipv4 forward filter

Solution:

# Firewall for forwarding
set firewall ipv4 forward filter rule 200 action accept
set firewall ipv4 forward filter rule 200 source address 192.168.250.0/24

# NAT for PPTP clients
set nat source rule 150 source address 192.168.250.0/24
set nat source rule 150 outbound-interface name eth0
set nat source rule 150 translation address masquerade

commit

Problem: GRE does not pass through NAT

Symptoms:

  • The PPTP control connection is established (TCP 1723)
  • The GRE tunnel is not created
  • “GRE timeout” in the logs

Causes:

  • The NAT router does not support GRE passthrough
  • Multiple PPTP clients behind one NAT (GRE has no ports!)

Solution:

  1. Enable “PPTP passthrough” on the NAT router
  2. Use only one PPTP client behind the NAT
  3. Better: Migrate to L2TP/IPsec (works through NAT with NAT-T)

Problem: Slow performance

Symptoms:

  • Low throughput
  • High latency
  • Packet loss

Causes:

  1. MTU problems (fragmentation)
  2. CPU overhead from MPPE encryption
  3. Network congestion

Diagnostics:

# On the client: MTU test
ping -M do -s 1400 192.168.250.1  # Linux
ping -f -l 1400 192.168.250.1     # Windows

# iperf3 test
iperf3 -c 192.168.1.10

# CPU usage on VyOS
top

Solution:

# MTU tuning
set vpn pptp remote-access mtu 1400
set vpn pptp remote-access mru 1400

# On the client (Windows):
# netsh interface ipv4 set subinterface "PPTP Connection" mtu=1400 store=persistent

# On the client (Linux):
# ip link set dev ppp0 mtu 1400

commit

Problem: Session disconnects randomly

Symptoms:

  • PPTP connects
  • Disconnects after a while with no obvious reason

Causes:

  1. Idle timeout too short
  2. LCP echo not answered (network issues)
  3. NAT session timeout

Solution:

# Increase the idle timeout
set vpn pptp remote-access idle 7200  # 2 hours

# Configure LCP keepalive
set vpn pptp remote-access ppp-options lcp-echo-failure 5
set vpn pptp remote-access ppp-options lcp-echo-interval 60

# Or disable the idle timeout (not recommended)
delete vpn pptp remote-access idle

commit

Security and best practices

Critical recommendations

  1. Do NOT use PPTP for production

    • Use WireGuard, OpenVPN, or IPsec
    • PPTP only for temporary legacy scenarios

  2. If you are FORCED to use PPTP:

    # Require MSCHAP-v2 (the least bad)
set vpn pptp remote-access authentication protocols pap disable
set vpn pptp remote-access authentication protocols chap disable
set vpn pptp remote-access authentication protocols mschap disable
set vpn pptp remote-access authentication protocols mschap-v2 enable

# Require 128-bit MPPE
set vpn pptp remote-access authentication mppe 'require-128'

  3. Strong passwords are mandatory:

    • At least 16 characters
    • Uppercase, lowercase, numbers, symbols
    • Avoid dictionary words
    • Use a password manager

  4. RADIUS instead of local auth:

    set vpn pptp remote-access authentication mode 'radius'
set vpn pptp remote-access authentication radius server 192.168.1.10 key 'LongRadiusSecret123!'

  5. Restrict the source IP:

    # Firewall for trusted networks only
set firewall ipv4 input filter rule 150 source address 198.51.100.0/24

  6. Rate limiting:

    # Protection against brute force
set firewall ipv4 input filter rule 150 recent count 5
set firewall ipv4 input filter rule 150 recent time minute 1

  7. Monitoring and alerting:

    # Check the logs regularly
sudo journalctl -u accel-ppp@pptp | grep -i "failed"

# Set up alerting for failed auth attempts

  8. Idle timeout:

    set vpn pptp remote-access idle 1800  # 30 minutes

  9. Plan your migration:

    • Document a plan to migrate to a modern VPN
    • Set a deadline for decommissioning PPTP
    • Notify users about the deprecation

Compliance considerations

PPTP does NOT comply with:

  • PCI DSS - prohibited for payment card data
  • HIPAA - insufficient for healthcare data
  • GDPR - not suitable for personal data protection
  • SOX - does not meet audit requirements

If your organization is subject to compliance regulations - PPTP is strictly prohibited.

Conclusion

PPTP is an obsolete and insecure VPN technology that must not be used for new deployments or any scenario that requires real security.

When PPTP is acceptable (extremely rare)

  1. Legacy hardware with no alternatives
  2. Temporary migration with a clear decommissioning plan
  3. Test/lab environments without sensitive data
  4. Non-security scenarios (for example, simple tunneling to bypass geo-restrictions on non-sensitive traffic)

Recommended alternatives

For new deployments:

  1. WireGuard - modern, fast, secure (top choice in 2025)
  2. OpenVPN - proven, flexible, widely supported
  3. IPsec/IKEv2 - enterprise-grade, standardized
  4. L2TP/IPsec - built-in clients, better than PPTP (but also becoming outdated)

Migration table:

ScenarioMigrate to
Remote access for all OSesWireGuard or OpenVPN
Windows/iOS/macOS built-in clientsL2TP/IPsec or IKEv2
Maximum performanceWireGuard
Enterprise with PKIOpenVPN or IPsec
Mobile users with roamingWireGuard or IKEv2
Legacy PPTP clientsL2TP/IPsec (temporarily) → WireGuard (final)

Final warning

VyOS provides PPTP for backwards compatibility only. The protocol has numerous critical security vulnerabilities and must not be used to protect sensitive information.

Start planning your migration to modern VPN protocols today.

For migration help, see the documentation:

Reviewed by OpenNix LLC · Last updated on
WireGuard VPN on VyOS - Setup and ExamplesFirewall