The PPTP Server app is a cost effective way to provide road warrior VPN connectivity. The PPTP VPN client is built-in to Windows 2000, XP, 7, Vista and 10 and other non Microsoft operating systems. No extra software is required and ClearOS provides full password and data encryption.
<note warning>Since 2012, Microsoft, the creators of the PPTP VPN protocol, recommend you no longer use it because of security vulnerabilities. See Microsoft Security Advisory 2743314 and Wikipedia among other references. The suggested alternative for roadwarriors in ClearOS is OpenVPN.</note>
If your system does not have this app available, you can install it via the Marketplace.
You can find this feature in the menu system at the following location:
You must select a range of LAN IP addresses for the PPTP VPN connections. This range should be on the same network as your local area network. By default, the 7_ug_dhcp_server on ClearOS only uses IP addresses from x.x.x.100 and up. All addresses below this number are reserved for static use. We strongly suggest you use this sub-100 static range for PPTP.
The Microsoft Networking WINS server used by the PPTP client. Depending on your network configuration, you may need to specify the WINS settings in VPN client configuration.
The DNS server used by the PPTP client.
PPTP users must have a valid account with the PPTP option enabled. See the User Manager for more information. You can give the users access to PPTP here by using the <button>Edit Members</button> button or in the User Manager or Accounts Manger screens.
Almost every OS comes with a built-in PPTP client.
The PPTP client is built-in to Windows 10.
Note in Windows 10 there are a number of different ways of creating the VPN, like through the Control Panel > Network and Sharing Center
PPTP requires special software when passing through firewalls. This feature is included with ClearOS. However, there is one important restriction for PPTP pass-through mode: a PPTP server must not be running on the same gateway that has PPTP connections crossing it.
If you run a PPTP server on a ClearOS gateway, you will not be able to have people from behind the same gateway make reliable outbound PPTP connections to other servers. By default, the firewall will automatically disable PPTP pass-through when the firewall already allows connections to a PPTP server. You will see warning messages in the web-based configuration about these configuration issues.
Depending on the circumstances, you may be able to have both PPTP pass-through and a PPTP server running at the same time. To do this, you need to override the firewall behavior noted in the previous paragraph. In the /etc/clearos/firewall.conf file, add the following line:
Then restart the firewall with the following command:
/sbin/service firewall restart
PPTP requires special software when passing through gateways/firewalls. If you are having trouble connecting to a PPTP server, make sure any gateways/firewalls between your desktop and the ClearOS server support PPTP passthrough mode. If you see the following in the /var/log/messages log file on the ClearOS system, then it is likely a PPTP passthrough issue on the client side of the connection:
PTY read or GRE write failed
You can view log files via the web-based administration tool – go to <navigation>Reports|Performance and Resources|Log Viewer</navigation> in the menu.
Another quick way to diagnose the issue is by connecting to the PPTP server while connected directly to the local network. With a direct connection to the ClearOS PPTP server, you can eliminate the potential for the PPTP passthrough issue.
The PPTP protocol does not allow two VPN connections from the same remote IP address. In other words, if you have two people behind a gateway (for example, ClearOS) connecting to the same PPTP server, then the connection should fail. Note: it is fine to have two people behind a gateway connecting to different PPTP servers.
Some PPTP servers and gateways (including ClearOS) do make an exception for this shortcoming. However, some PPTP servers may strictly follow the standard below:
<note info>The PPTP RFC specifies in section 3.1.3 that there may only be one control channel connection between two systems. This should mean that you can only masquerade one PPTP session at a time with a given remote server, but in practice the MS implementation of PPTP does not enforce this, at least not as of NT 4.0 Service Pack 4. If the PPTP server you're trying to connect to only permits one connection at a time, it's following the protocol rules properly. Note that this does not affect a masqueraded server, only multiple masqueraded clients attempting to contact the same remote server.</note>
Step 1. Stop and start the PPTP Server app.
Step 2. Confirm firewall rules are configured correctly.
Step 3. Ensure Samba (smb, nmb, winbind) services are running in the Services (System > Settings > Services) app. These should all be started and enabled. If they are not enabled, they will not auto-start. PPTP relies on Samba to authenticate the user.
If you have completed these steps and your PPTP VPN still isn't working, you will need to contact ClearCenter Support. If you don't have a Business Gold or Platinum subscription, you will need to purchase a Per-Incident Support Ticket or upgrade to Business Gold or Platinum. For upgrade pricing, please contact 'email@example.com'.