up vote 0 down vote favorite
share [g+] share [fb]

Should you use PPTP or L2TP OR SSL for VPN connections?

Which ones are preferred?

link|improve this question
48% accept rate
4  
Yes, one of those is probably a good choice. – Zoredache Jun 19 '10 at 8:38
SSL is not a VPN protocol; did you mean OpenVPN's protocol? (which uses TLS for encryption and authentication) – grawity Jun 19 '10 at 19:30
@Zoredache: which one is best? – CraigJ Jun 19 '10 at 23:46
2  
Depends on what you need, and what you have. Unfortunately you have provided next to no details. – Zoredache Jun 20 '10 at 2:11
1  
OpenVPN is the fastest by far due to less overhead and if setup correctly can be extremely secure. given the choice i wouldn't use anything else. – Silverfire Oct 13 '11 at 23:07
show 2 more comments
feedback

1 Answer

up vote 2 down vote

PPTP is very simple to set up, but both Microsoft's original and v2 implementations use weak password hashing methods and have been demonstrated to be relatively easy to crack. There are extensions to PPTP such as EAP/TLS that help to mitigate some of these flaws, but they increase the complexity of implementation.

L2TP is much more secure, but can be hard to get through firewalls and NAT translation.

OpenVPN is a great open source VPN solution. It is NOT a browser-based VPN, but uses the OpenSSL libraries to securely establish and encrypt connections. There are lots of ways to implement it that lower the expertise required -- my personal favorite is pfSense, a FreeBSD-based firewall that is easy to install and configure via a browser-based management console and works great as an OpenVPN gateway (though it can also be a PPTP or L2TP gateway). The web interface even allows users to log in and download the OpenVPN client software package pre-configured specifically for their account as an exe installer or *nix config file. pfSense even runs great on almost any old beige box you might have kicking around waiting for the scrap heap.

link|improve this answer
@medm: your "relatively easy to crack" link mentions that the new version has addressed the major security weaknesses apart from "offline passwords guessing attacks", which means that if a strong password is used then it should be reasonably secure. – CraigJ Jun 20 '10 at 8:28
@Craig: This apparently depends on your definition of 'reasonably secure.' I don't consider the following conclusion at the end of the linked post be a ringing endorsement of PPTP, with or without a strong password: "These changes address most of the major security weaknesses of the orginal protocol. However, the revised protocol is still vulnerable to offline password-guessing attacks from hacker tools such as L0phtcrack. At this point we still do not recommend Microsoft PPTP for applications where security is a factor." – nedm Jun 21 '10 at 5:50
However, as @Zoredache pointed out, it depends entirely on your requirements. If you work in an industry with any sort of regulatory compliance threshold I would avoid PPTP, especially since there are alternatives that are relatively easy (and free!) to implement. Your question reads "Should you use PPTP or L2TP OR SSL for VPN connections?" and I can tell you confidently that I should not use PPTP. – nedm Jun 21 '10 at 5:53
@medm: their recommendation is worthless without an explanation, and all they have mentioned is 'offline password guessing attacks', which means that 14 char length password with number, alpha and symbols will require about 10,000 years to crack. I plan to be around that long, but do you? – CraigJ Jun 21 '10 at 7:38
-1, My $DEITY, people still think the Windows 95/98 version of PPTP is in use... It was replaced 10 years ago! The newer version is more secure than the short and easily guessed passwords users typically pick. – Chris S♦ Sep 10 '10 at 3:48
show 1 more comment
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.