Summary
PPTP (Point to Point Tunnel Protocol) supports encrypted tunnels over IP. The MikroTik RouterOS implementation includes support fot PPTP client and server.
General applications of PPTP tunnels:
PPTP (Point to Point Tunnel Protocol) supports encrypted tunnels over IP. The MikroTik RouterOS implementation includes support fot PPTP client and server.
General applications of PPTP tunnels:
* For secure router-to-router tunnels over the Internet* To link (bridge) local Intranets or LANs (when EoIP is also used)* For mobile or remote clients to remotely access an Intranet/LAN of a company (see PPTP setup for Windows for more information)
Each PPTP connection is composed of a server and a client. The MikroTik RouterOS may function as a server or client – or, for various configurations, it may be the server for some connections and client for other connections. For example, the client created below could connect to a Windows 2000 server, another MikroTik Router, or another router which supports a PPTP server.DescriptionPPTP is a secure tunnel for transporting IP traffic using PPP. PPTP encapsulates PPP in virtual lines that run over IP. PPTP incorporates PPP and MPPE (Microsoft Point to Point Encryption) to make encrypted links. The purpose of this protocol is to make well-managed secure connections between routers as well as between routers and PPTP clients (clients are available for and/or included in almost all OSs including Windows).
PPTP includes PPP authentication and accounting for each PPTP connection. Full authentication and accounting of each connection may be done through a RADIUS client or locally.
MPPE 40bit RC4 and MPPE 128bit RC4 encryption are supported.
PPTP traffic uses TCP port 1723 and IP protocol GRE (Generic Routing Encapsulation, IP protocol ID 47), as assigned by the Internet Assigned Numbers Authority (IANA). PPTP can be used with most firewalls and routers by enabling traffic destined for TCP port 1723 and protocol 47 traffic to be routed through the firewall or router.
PPTP connections may be limited or impossible to setup though a masqueraded/NAT IP connection. Please see the Microsoft and RFC links at the end of this section for more information.PPTP Client SetupSubmenu level : /interface pptp-clientProperty Descriptionname (name; default: pptp-out1) - interface name for referencemtu (integer; default: 1460) - Maximum Transmit Unit. The optimal value is the MTU of the interface the tunnel is working over decreased by 40 (so, for 1500-byte ethernet link, set the MTU to 1460 to avoid fragmentation of packets)mru (integer; default: 1460) - Maximum Receive Unit. The optimal value is the MTU of the interface the tunnel is working over decreased by 40 (so, for 1500-byte ethernet link, set the MRU to 1460 to avoid fragmentation of packets)connect-to (IP address)- the IP address of the PPTP server to connect touser (string)- user name to use when logging on to the remote serverpassword (string; default: "")- user password to use when logging to the remote serverprofile (name; default: default) - profile to use when connecting to the remote serveradd-default-route (yes no; default: no) - whether to use the server which this client is connected to as its default router (gateway)ExampleTo set up PPTP client named test2 using username john with password john to connect to the 10.1.1.12 PPTP server and use it as the default gateway:
[admin@MikroTik] interface pptp-client> add name=test2 connect-to=10.1.1.12 \\... user=john add-default-route=yes password=john[admin@MikroTik] interface pptp-client> printFlags: X - disabled, R - running0 X name="test2" mtu=1460 mru=1460 connect-to=10.1.1.12 user="john"password="john" profile=default add-default-route=yes
[admin@MikroTik] interface pptp-client> enable 0
Monitoring PPTP ClientCommand name : /interface pptp-client monitorProperty DescriptionStatistics:
uptime (time) - connection time displayed in days, hours, minutes, and secondsencoding (string) - encryption and encoding (if asymmetric, separated with '/') being used in this connectionstatus (string) - status of the client:# Dialing – attempting to make a connection# Verifying password... - connection has been established to the server, password verification in progress# Connected – self-explanatory# Terminated – interface is not enabled or the other side will not establish a connection
ExampleExample of an established connection:
[admin@MikroTik] interface pptp-client> monitor test2uptime: 4h35sencoding: MPPE 128 bit, statelessstatus: Connected[admin@MikroTik] interface pptp-client>
PPTP Server SetupSubmenu level : /interface pptp-server server
[admin@MikroTik] interface pptp-server server> printenabled: nomtu: 1460mru: 1460authentication: mschap2default-profile: default[admin@MikroTik] interface pptp-server server>
DescriptionThe PPTP server supports unlimited connections from clients. For each current connection, a dynamic interface is created.Property Descriptionenabled (yes no; default: no) - defines whether PPTP server is enabled or notmtu (integer; default: 1460) - Maximum Transmit Unit. The optimal value is the MTU of the interface the tunnel is working over decreased by 40 (so, for 1500-byte ethernet link, set the MTU to 1460 to avoid fragmentation of packets)mru (integer; default: 1460) - Maximum Receive Unit. The optimal value is the MTU of the interface the tunnel is working over decreased by 40 (so, for 1500-byte ethernet link, set the MTU to 1460 to avoid fragmentation of packets)authentication (multiple choice: pap chap mschap1 mschap2; default: mschap2) - authentication algorithmdefault-profile (name; default: default) - default profile to useExampleTo enable PPTP server:
[admin@MikroTik] interface pptp-server server> set enabled=yes[admin@MikroTik] interface pptp-server server> printenabled: yesmtu: 1460mru: 1460authentication: mschap2default-profile: default[admin@MikroTik] interface pptp-server server>
PPTP Server UsersSubmenu level : /interface pptp-serverDescriptionThere are two types of items in PPTP server configuration - static users and dynamic connections. A dynamic connection can be established if the user database or the default-profile has its local-address and remote-address set correctly. When static users are added, the default profile may be left with its default values and only P2P user (in /ppp secret) should be configured. Note that in both cases P2P users must be configured properly.Property Descriptionname - interface nameuser - the name of the user that is configured statically or added dynamically
Statistics:
mtu - shows (cannot be set here) client's MTUclient-address - shows (cannot be set here) the IP of the connected clientuptime - shows how long the client is connectedencoding (string) - encryption and encoding (if asymmetric, separated with '/') being used in this connectionExampleTo add a static entry for ex1 user:
[admin@MikroTik] interface pptp-server> add user=ex1[admin@MikroTik] interface pptp-server> printFlags: X - disabled, D - dynamic, R - running# NAME USER MTU CLIENT-ADDRESS UPTIME ENC...0 DR ex 1460 10.0.0.202 6m32s none1 pptp-in1 ex1[admin@MikroTik] interface pptp-server>
In this example an already connected user ex is shown besides the one we just added.PPTP Router-to-Router Secure Tunnel ExampleThe following is an example of connecting two Intranets using an encrypted PPTP tunnel over the Internet.
There are two routers in this example:
* [HomeOffice]Interface LocalHomeOffice 10.150.2.254/24Interface ToInternet 192.168.80.1/24
* [RemoteOffice]Interface ToInternet 192.168.81.1/24Interface LocalRemoteOffice 10.150.1.254/24
Each router is connected to a different ISP. One router can access another router through the Internet.
On the PPTP server a user must be set up for the client:
[admin@HomeOffice] ppp secret> add name=ex service=pptp password=lkjrhtlocal-address=10.0.103.1 remote-address=10.0.103.2[admin@HomeOffice] ppp secret> print detailFlags: X - disabled0 name="ex" service=pptp caller-id="" password="lkjrht" profile=defaultlocal-address=10.0.103.1 remote-address=10.0.103.2 routes==""
[admin@HomeOffice] ppp secret>
Then the user should be added in the PPTP server list:
[admin@HomeOffice] interface pptp-server> add user=ex[admin@HomeOffice] interface pptp-server> printFlags: X - disabled, D - dynamic, R - running# NAME USER MTU CLIENT-ADDRESS UPTIME ENC...0 pptp-in1 ex[admin@HomeOffice] interface pptp-server>
And finally, the server must be enabled:
[admin@HomeOffice] interface pptp-server server> set enabled=yes[admin@HomeOffice] interface pptp-server server> printenabled: yesmtu: 1460mru: 1460authentication: mschap2default-profile: default[admin@HomeOffice] interface pptp-server server>
Add a PPTP client to the RemoteOffice router:
[admin@RemoteOffice] interface pptp-client> add connect-to=192.168.80.1 user=ex \\... password=lkjrht disabled=no[admin@RemoteOffice] interface pptp-client> printFlags: X - disabled, R - running0 R name="pptp-out1" mtu=1460 mru=1460 connect-to=192.168.80.1 user="ex"password="lkjrht" profile=default add-default-route=no
[admin@RemoteOffice] interface pptp-client>
Thus, a PPTP tunnel is created between the routers. This tunnel is like an Ethernet point-to-point connection between the routers with IP addresses 10.0.103.1 and 10.0.103.2 at each router. It enables 'direct' communication between the routers over third party networks.
To route the local Intranets over the PPTP tunnel – add these routes:
[admin@HomeOffice] > ip route add dst-address 10.150.1.0/24 gateway 10.0.103.2[admin@RemoteOffice] > ip route add dst-address 10.150.2.0/24 gateway 10.0.103.1
On the PPTP server it can alternatively be done using routes parameter of the user configuration:
[admin@HomeOffice] ppp secret> print detailFlags: X - disabled0 name="ex" service=pptp caller-id="" password="lkjrht" profile=defaultlocal-address=10.0.103.1 remote-address=10.0.103.2 routes==""
[admin@HomeOffice] ppp secret> set 0 routes="10.150.1.0/24 10.0.103.2 1"[admin@HomeOffice] ppp secret> print detailFlags: X - disabled0 name="ex" service=pptp caller-id="" password="lkjrht" profile=defaultlocal-address=10.0.103.1 remote-address=10.0.103.2routes="10.150.1.0/24 10.0.103.2 1"
[admin@HomeOffice] ppp secret>
Test the PPTP tunnel connection:
[admin@RemoteOffice]> /ping 10.0.103.110.0.103.1 pong: ttl=255 time=3 ms10.0.103.1 pong: ttl=255 time=3 ms10.0.103.1 pong: ttl=255 time=3 msping interrupted3 packets transmitted, 3 packets received, 0% packet lossround-trip min/avg/max = 3/3.0/3 ms
Test the connection through the PPTP tunnel to the LocalHomeOffice interface:
[admin@RemoteOffice]> /ping 10.150.2.25410.150.2.254 pong: ttl=255 time=3 ms10.150.2.254 pong: ttl=255 time=3 ms10.150.2.254 pong: ttl=255 time=3 msping interrupted3 packets transmitted, 3 packets received, 0% packet lossround-trip min/avg/max = 3/3.0/3 ms
To bridge a LAN over this secure tunnel, please see the example in the 'EoIP' section of the manual. To set the maximum speed for traffic over this tunnel, please consult the 'Queues' section.
Connecting a Remote Client via PPTP TunnelThe following example shows how to connect a computer to a remote office network over PPTP encrypted tunnel giving that computer an IP address from the same network as the remote office has (without need of bridging over eoip tunnels)
Please, consult the respective manual on how to set up a PPTP client with the software You are using.
The router in this example:
* [RemoteOffice]Interface ToInternet 192.168.81.1/24Interface Office 10.150.1.254/24
The client computer can access the router through the Internet.
On the PPTP server a user must be set up for the client:
[admin@RemoteOffice] ppp secret> add name=ex service=pptp password=lkjrhtlocal-address=10.150.1.254 remote-address=10.150.1.2[admin@RemoteOffice] ppp secret> print detailFlags: X - disabled0 name="ex" service=pptp caller-id="" password="lkjrht" profile=defaultlocal-address=10.150.1.254 remote-address=10.150.1.2 routes==""
[admin@RemoteOffice] ppp secret>
Then the user should be added in the PPTP server list:
[admin@RemoteOffice] interface pptp-server> add name=FromLaptop user=ex[admin@RemoteOffice] interface pptp-server> printFlags: X - disabled, D - dynamic, R - running# NAME USER MTU CLIENT-ADDRESS UPTIME ENC...0 FromLaptop ex[admin@RemoteOffice] interface pptp-server>
And the server must be enabled:
[admin@RemoteOffice] interface pptp-server server> set enabled=yes[admin@RemoteOffice] interface pptp-server server> printenabled: yesmtu: 1460mru: 1460authentication: mschap2default-profile: default[admin@RemoteOffice] interface pptp-server server>
Finally, the proxy APR must be enabled on the 'Office' interface:
[admin@RemoteOffice] interface ethernet> set Office arp=proxy-arp[admin@RemoteOffice] interface ethernet> printFlags: X - disabled, R - running# NAME MTU MAC-ADDRESS ARP0 R ToInternet 1500 00:30:4F:0B:7B:C1 enabled1 R Office 1500 00:30:4F:06:62:12 proxy-arp[admin@RemoteOffice] interface ethernet>
Test the PPTP tunnel connection:
[admin@RemoteOffice]> /ping 10.0.103.110.0.103.1 pong: ttl=255 time=3 ms10.0.103.1 pong: ttl=255 time=3 ms10.0.103.1 pong: ttl=255 time=3 msping interrupted3 packets transmitted, 3 packets received, 0% packet lossround-trip min/avg/max = 3/3.0/3 ms
Test the connection through the PPTP tunnel to the LocalHomeOffice interface:
[admin@RemoteOffice]> /ping 10.150.2.25410.150.2.254 pong: ttl=255 time=3 ms10.150.2.254 pong: ttl=255 time=3 ms10.150.2.254 pong: ttl=255 time=3 msping interrupted3 packets transmitted, 3 packets received, 0% packet lossround-trip min/avg/max = 3/3.0/3 ms
To bridge a LAN over this secure tunnel, please see the example in the 'EoIP' section of the manual. To set the maximum speed for traffic over this tunnel, please consult the 'Queues' section.
Connecting a Remote Client via PPTP TunnelThe following example shows how to connect a computer to a remote office network over PPTP encrypted tunnel giving that computer an IP address from the same network as the remote office has (without need of bridging over eoip tunnels)
Please, consult the respective manual on how to set up a PPTP client with the software You are using.
The router in this example:
* [RemoteOffice]Interface ToInternet 192.168.81.1/24Interface Office 10.150.1.254/24
The client computer can access the router through the Internet.
On the PPTP server a user must be set up for the client:
[admin@RemoteOffice] ppp secret> add name=ex service=pptp password=lkjrhtlocal-address=10.150.1.254 remote-address=10.150.1.2[admin@RemoteOffice] ppp secret> print detailFlags: X - disabled0 name="ex" service=pptp caller-id="" password="lkjrht" profile=defaultlocal-address=10.150.1.254 remote-address=10.150.1.2 routes==""
[admin@RemoteOffice] ppp secret>
Then the user should be added in the PPTP server list:
[admin@RemoteOffice] interface pptp-server> add name=FromLaptop user=ex[admin@RemoteOffice] interface pptp-server> printFlags: X - disabled, D - dynamic, R - running# NAME USER MTU CLIENT-ADDRESS UPTIME ENC...0 FromLaptop ex[admin@RemoteOffice] interface pptp-server>
And the server must be enabled:
[admin@RemoteOffice] interface pptp-server server> set enabled=yes[admin@RemoteOffice] interface pptp-server server> printenabled: yesmtu: 1460mru: 1460authentication: mschap2default-profile: default[admin@RemoteOffice] interface pptp-server server>
Finally, the proxy APR must be enabled on the 'Office' interface:
[admin@RemoteOffice] interface ethernet> set Office arp=proxy-arp[admin@RemoteOffice] interface ethernet> printFlags: X - disabled, R - running# NAME MTU MAC-ADDRESS ARP0 R ToInternet 1500 00:30:4F:0B:7B:C1 enabled1 R Office 1500 00:30:4F:06:62:12 proxy-arp[admin@RemoteOffice] interface ethernet>
