Mikrotik V7 - PPTP not recommended

There is no cure, no medicine, case pass
pptp connections are considered it is suggested to use a more modern vpn protocol instead
vpn.jpg

It is true what the message says. Don’t use PPTP

@ziladar2024

not sure what u are expecting from protocol introduced at 1999

Wow!!! And we are still using HTTP that dates back to 1991!! And more, do you use email? It’s based on SMTP and dates back to 1971.

Don’t take me wrong, but the fact that a protocol or system is old is not any measure of its quality. As for PPTP it is really crap, full of problems, but you must take into context that it was developed primarily for… Windows! And at a time that MS wouldn’t give a 5hit about standards, interoperability, and, to a certain degree, security.

However, I can see some valid uses for PPTP (and for many other old/obsolete stuff), specially in the context of a internal networks. I known there are many other options, but as flawed as it is, it performs quite well.

That said I wish Mikrotik could make an option, per interface, to allow ignoring that message. It’s really bad to show it on the list of interfaces. The option could just move the warning to the interface details window.

Well, at least Mikrotik did not take the same road as Apple and still allow it to be used.

  1. You can use PPTP. It will only show a warning. There is no limitation.
  2. PPTP is known to be vulnerable and easily hackable. Recently some exploits were published. Nobody should use it anymore.

Are you implying that now they care, instead? :laughing:

There’s nothing inherently wrong with PPTP any more than with GRE or even older tunnels like IPIP from the mid-1980s, but they all require encryption to secure the connection. The primary reason why PPTP is considered insecure on ROS is that Mikrotik didn’t bother to implement stronger encryption methods like EAP-PEAP for MSCHAPv2.

Nobody should use it anymore.

.
Then call me “Mr Nobody”. :slight_smile:
Needed a VPN to pass through a complex LAN with not related traffic , for bringing Netflix to a smartTV , while the Netflix and other broadcast technologies should not detect it is VPN forwarded.
They issue a warning: like "something went wrong " if they detect VPN, and then stop the stream. A MTU of 1500bytes was essential for this hiding.

SSTP was too slow, PPTP was fast. PPTP+BCP and larger MTU (BCP combines PPTP sessions for larger MTU sizes) made it work.
Of course this all needs only LAN-security. Would not trust naked PPTP over WAN links.

There is nothing wrong with a warning. But don’t remove it from ROS.

Gotcha covered mon frere,

bwpl.jpg

bpwl for you case EoIP would be better, no?

I do know EoIP and VPLS as ways to get L2 over a L3 network. (E.g. when “AP-bridge + Station bridge” is not available) , but both need a larger MTU on the L3 carrier. (Wifi can go up to 2300bytes AFAIK, at least in the legacy WLAN). Smaller MTU in EoIP was detected by Netflix. “Something went wrong / Password invalid”. https://www.comparitech.com/blog/vpn-privacy/watch-netflix-with-vpn/

Not a fake-location VPN is used here, but just the TV set was on the other LAN, which only allowed limited internet volumes.