PPTP Passthrough

Hi guys…

So I have a client and they have a Mikrotik RB2011iL sitting inside my network. It is connected to a CCR which is the border router

The client reached out to me today asking if I can setup a VPN on their router as they have 1 staff working from home for over 2 months

I’ve enabled PPTP server, configured secrets & profiles but I am only using the DHCP pool of the router and not a separate pool for the teleworker

The reason being is that the router has IPSec connection to the client’s Cisco ASA in Australia and would only accept connections from the configured subnet on my side hence I need to use the same pool as for the teleworkers

On the public facing router (CCR) I have configured a NAT rule for port 1723 to the IP of the router and there are increments to the counters when I’m trying to connect to the VPN connection using a Windows machine

I’ve checked the logs on the client’s router as well and this is what I am getting:

12:11:34 pptp,ppp,debug <82>: LCP lowerdown
12:11:34 pptp,ppp,debug <82>: LCP down event in initial state
12:11:34 pptp,info TCP connection established from x.x.x.x
12:11:34 pptp,debug received too big control message, disconnecting
12:11:34 pptp,ppp,debug <83>: LCP lowerdown
12:11:34 pptp,ppp,debug <83>: LCP down event in initial state

I’ve tried creating a filter rule also inside the client’s router:

chain=input action=accept protocol=tcp dst-port=1723 log=no log-prefix=“”

Counters get incremented whenever I try to connect but could not establish the PPTP connection

Can you help me what’s wrong or what I have not done to make this work?

Thank you

PPTP only uses this port for connection negotiation. The actual data are then tunneled over the GRE protocol, and that beast is not NAT-friendly at all. Also be aware (and make your client aware) that PPTP is not secure at all.