Tag Info

Hot answers tagged

13

PPTP is a tunneling protocol just like L2TP is - it does not provide security. PPTP uses MPPE for encryption which may have some disadvantages compared to IPSEC (which is commonly used with L2TP). IPSEC can also be used on its own as a tunneling protocol and this is pretty common. An advantage with IPSEC in general would be if it's used with certificates ...


11

OS X has a built in PPTP client. http://www.bol.ucla.edu/services/vpn/pptp/docs/macosx.html#leopardpp


7

The main Advantage of OpenVPN in a Win only environment is the use of UDP as underlying bearer since this avoids the 'TCP meltdown problem' see http://sites.inka.de/bigred/devel/tcp-tcp.html for more Info about TCP in TCP. hth, cheerio Steve


7

If you're that concerned about it, why not go for peace of mind and set up an openvpn connection? They are quite simple to set up, and if anything were to go wrong (as far as a compromise is concerned), using a more secure set up will help prove you weren't criminally negligent. It's a sad but real truth that you need to cover you butt when dealing with ...


6

PPTP uses a relatively simple encapsulation mechanism and uses the RC4 stream cipher which is relatively cheap in terms of CPU load. L2TP has a much more complex encapsulation mechanism with potentially up to 6 layers of encapsulation with the encapsulated IPSec tunnel using typically 3DES or (more recently) AES encryption. 3DES is relatively efficient when ...


5

That sums it up.


5

The availability of clients for OpenVPN is more wide than that of SSTP (at least, right now). I can buy an IP phone with an embedded OpenVPN client, for example. AFAIK, Microsoft didn't back-port the SSTP client to Windows XP (which, initially, they said they would), so that cuts off a large client-base. In contrast, though, SSTP doesn't require the ...


5

What is the openVPN based on ? SSL/TLS can the packets of openVPN be routed by ubuntu server? Yep, of course!


5

open %APPDATA%\Microsoft\Network\Connections\Pbk\rasphone.pbk using notepad Search for UseRasCredentials=1 Replace with UseRasCredentials=0 Save it, from then on local windows auth will work as well. You will have to redo this everytime you add a new VPN connection however


5

The current wisdom is that IPSec is better, but no (known) full exploits exist for PPTP, so it's still commonly used. IPSec is certainly newer, and has more optional extras, and (IMHO) broader support. Lot of people criticize that PPTP sends some unencrypted control packets, but, again, this hasn't resulted in a big exploit, it just makes people think that ...


5

It should be noted that a new attack on MS-CHAPv2 by Moxie Marlinspike and David Hulton makes PPTP tunnels less desirable. Based on this I would go with an IPSEC or SSL VPN based tunnel for remote access. More info: Infosecurity Article Covering Attack IT Security Article Covering Attack


5

Do not to use DHCP to assign an IP, and specify a range manually instead for the incoming connection. Thats what fixed it for me.


5

What you've essentially done is setup a VPN AND setup RDP access through the firewall (opening port 3389 to the world). You shouldn't allow RDP access through the firewall at all if you want to limit it to VPN users. Disable that rule completely for RDP. Then...A user will VPN in using the VPN tunnel you setup and THEN rdp into "system A". The VPN puts ...


4

iThingies are picky about what exactly they need when it comes to VPN. The problem is basically, the defaults most VPN servers use for IPSec is too insecure for iThingies. Has some good tips: Error connecting to Sonicwall L2TP VPN from iPad/iPhone I had a very similar problem getting iThingies to talk to a SonicWall, and had to make some significant ...


4

What exactly is NAT "healing". What you're likely running into is a firewall timeout issue. The firewall is probably killing sessions in it's state table that have been idle for a long period of time in order to make room in the state table for other connections and to release any resources being consumed by the idle session. ...


4

We use pfSense and m0nowall for this - simple to use web-based admin. You can use an old PC with a Disk on Module in the IDE connector or a single-board-computer like ALIX from pcengines. Found this solution to be cheap and reliable.


4

You're on the right track. You need to set up an SSL VPN of some kind. We use a Sonicwall SSL VPN appliance. It allows for installation of the client directly from the logon page (very simple, any user can do it) as well as reverse proxy functionality for web apps and terminal services. http://www.sonicwall.com/us/products/Secure_Remote_Access.html ...


4

I am assuming you are talking about being behind a NAT, and trying to have multiple users connect to a remote VPN server, then I just managed to fix this on DD-WRT v24-sp2 (04/16/10): Apparently the kernel modules were missing which do the NAT translation for the GRE protocol - inserting them proved enough. I have added the following lines to the firewall ...


4

The following article may be of help: What’s the difference between PPTP VPN and OpenVPN? The conclusion at the end of the article is as follows: To sum up, if you are looking for high security and privacy you should choose OpenVPN. If you need easy-to-setup VPN, PPTP is a good choice. For mobile devices, PPTP is the only solution.


4

We use FreeBSD as PPTP terminator because of fully in-kernel PPTP implementation, so it has no overhead for copying packets to and from userspace for en/decapsulation. Quad-core Xeon with hyperthreading handles near 400 users and 250Mbit of PPTP traffic in peak with load average near 2.5, but it needs good Intel network adapters to handle packets with low ...


3

as far as i know, the problems were mainly due to insecure password algorithms being used. as long as you stay away from weak passwords and older algorithms you should be fine. as Bruce Schneier put it in his Analysis: Microsoft has improved PPTP to correct the major security weaknesses de- scribed in [SM98]. However, the fundamental weakness of the ...


3

This question doesn't really make sense. PPTP and the internet are two different things. Are you saying that you're connecting to a PPTP VPN, and when you do that, your internet is dropping to 200Kbps? What happens when you join a VPN is that the OS assumes you want to send all traffic over this PPTP link and sets it to be your default gateway. This means ...


3

There has been some time that has passed since PPTP's initial inception and rollout. These days there are also a number of application protocols which are secure within themselves (where there was not in the past). If that is the case with your specific deployment, then PPTP may adequately serve as the initial/external delivery transport.


3

This could be a firewall problem. Check that you are allowing the correct traffic into your VPN Server, specifically you need to permit TCP 1723 and Protocol 47 (GRE) before PPTP will work correctly. The problem you see in your log can be caused by GRE not being correctly relayed from your firewall. You might also need to add mppe-stateful to your ...


3

You don't really seem to have the GRE protocol enabled, from what I can see. You have port 47 TCP allowed, but that's not the same. Your rc.local rules regarding GRE seem fine but are probably being overwritten, so add those rules in your firewall system proper. You also have a DROP policy for forwarding packets - add this rule as a mininum: iptables -A ...


3

Your VPN connection uses MPPE encryption, but according to router's page http://www.draytek.co.uk/products/vigor2830.html - MPPE have no hardware support. Try to setup something else as encryption protocol (AES/DES/3DES). IMHO it is available only with L2TP protocol.


3

My understanding of poptop (the pptpd server) is that you are unable to specify a port number for the server without patching the source and recompiling. Having a look over the source seems to suggest similar [welby@blackpudding pptpd-1.3.4]$ fgrep PPTP_PORT -R . ./pptpmanager.c: address.sin_port = htons(PPTP_PORT); ./pptpdefs.h:#define ...


3

With 2048/512 kbit/s, you are most likely restricted by bandwidth, not by your routers hardware.


3

Those iptables rules don't allow traffic to the VPN server, so the VPN can't be established. You need the following rules in the OUTPUT chain before the final DROP rule, where 1.2.3.4 is the IP address of the VPN server. These allow TCP connections to port 1723 (the PPTP control channel) and GRE packets (the data channel). iptables --append OUTPUT ...


3

PPTP uses PPP and GRE tunneling - quite old protocols, especially GRE which may be awkward to pass by some routers. It uses TCP port 1723. OpenVPN is more flexible - it may be set up on any UDP or TCP port. OpenVPN uses OpenSSL library with all its goods. I don't see any reason any of them could not be routed by Ubuntu server. OpenVPN is for you if: you ...



Only top voted, non community-wiki answers of a minimum length are eligible