Tag Info

Hot answers tagged

13

PPTP is a tunneling protocol just like L2TP is - it does not provide security. PPTP uses MPPE for encryption which may have some disadvantages compared to IPSEC (which is commonly used with L2TP). IPSEC can also be used on its own as a tunneling protocol and this is pretty common. An advantage with IPSEC in general would be if it's used with certificates ...


7

The main Advantage of OpenVPN in a Win only environment is the use of UDP as underlying bearer since this avoids the 'TCP meltdown problem' see http://sites.inka.de/bigred/devel/tcp-tcp.html for more Info about TCP in TCP. hth, cheerio Steve


7

If you're that concerned about it, why not go for peace of mind and set up an openvpn connection? They are quite simple to set up, and if anything were to go wrong (as far as a compromise is concerned), using a more secure set up will help prove you weren't criminally negligent. It's a sad but real truth that you need to cover you butt when dealing with ...


6

PPTP uses a relatively simple encapsulation mechanism and uses the RC4 stream cipher which is relatively cheap in terms of CPU load. L2TP has a much more complex encapsulation mechanism with potentially up to 6 layers of encapsulation with the encapsulated IPSec tunnel using typically 3DES or (more recently) AES encryption. 3DES is relatively efficient when ...


5

The availability of clients for OpenVPN is more wide than that of SSTP (at least, right now). I can buy an IP phone with an embedded OpenVPN client, for example. AFAIK, Microsoft didn't back-port the SSTP client to Windows XP (which, initially, they said they would), so that cuts off a large client-base. In contrast, though, SSTP doesn't require the ...


5

The current wisdom is that IPSec is better, but no (known) full exploits exist for PPTP, so it's still commonly used. IPSec is certainly newer, and has more optional extras, and (IMHO) broader support. Lot of people criticize that PPTP sends some unencrypted control packets, but, again, this hasn't resulted in a big exploit, it just makes people think that ...


5

open %APPDATA%\Microsoft\Network\Connections\Pbk\rasphone.pbk using notepad Search for UseRasCredentials=1 Replace with UseRasCredentials=0 Save it, from then on local windows auth will work as well. You will have to redo this everytime you add a new VPN connection however


5

What you've essentially done is setup a VPN AND setup RDP access through the firewall (opening port 3389 to the world). You shouldn't allow RDP access through the firewall at all if you want to limit it to VPN users. Disable that rule completely for RDP. Then...A user will VPN in using the VPN tunnel you setup and THEN rdp into "system A". The VPN puts ...


4

iThingies are picky about what exactly they need when it comes to VPN. The problem is basically, the defaults most VPN servers use for IPSec is too insecure for iThingies. Has some good tips: Error connecting to Sonicwall L2TP VPN from iPad/iPhone I had a very similar problem getting iThingies to talk to a SonicWall, and had to make some significant ...


4

What exactly is NAT "healing". What you're likely running into is a firewall timeout issue. The firewall is probably killing sessions in it's state table that have been idle for a long period of time in order to make room in the state table for other connections and to release any resources being consumed by the idle session. ...


4

We use pfSense and m0nowall for this - simple to use web-based admin. You can use an old PC with a Disk on Module in the IDE connector or a single-board-computer like ALIX from pcengines. Found this solution to be cheap and reliable.


4

You're on the right track. You need to set up an SSL VPN of some kind. We use a Sonicwall SSL VPN appliance. It allows for installation of the client directly from the logon page (very simple, any user can do it) as well as reverse proxy functionality for web apps and terminal services. http://www.sonicwall.com/us/products/Secure_Remote_Access.html ...


4

It should be noted that a new attack on MS-CHAPv2 by Moxie Marlinspike and David Hulton makes PPTP tunnels less desirable. Based on this I would go with an IPSEC or SSL VPN based tunnel for remote access. More info: Infosecurity Article Covering Attack IT Security Article Covering Attack


4

I am assuming you are talking about being behind a NAT, and trying to have multiple users connect to a remote VPN server, then I just managed to fix this on DD-WRT v24-sp2 (04/16/10): Apparently the kernel modules were missing which do the NAT translation for the GRE protocol - inserting them proved enough. I have added the following lines to the firewall ...


4

We use FreeBSD as PPTP terminator because of fully in-kernel PPTP implementation, so it has no overhead for copying packets to and from userspace for en/decapsulation. Quad-core Xeon with hyperthreading handles near 400 users and 250Mbit of PPTP traffic in peak with load average near 2.5, but it needs good Intel network adapters to handle packets with low ...


3

as far as i know, the problems were mainly due to insecure password algorithms being used. as long as you stay away from weak passwords and older algorithms you should be fine. as Bruce Schneier put it in his Analysis: Microsoft has improved PPTP to correct the major security weaknesses de- scribed in [SM98]. However, the fundamental weakness of the ...


3

This question doesn't really make sense. PPTP and the internet are two different things. Are you saying that you're connecting to a PPTP VPN, and when you do that, your internet is dropping to 200Kbps? What happens when you join a VPN is that the OS assumes you want to send all traffic over this PPTP link and sets it to be your default gateway. This means ...


3

This could be a firewall problem. Check that you are allowing the correct traffic into your VPN Server, specifically you need to permit TCP 1723 and Protocol 47 (GRE) before PPTP will work correctly. The problem you see in your log can be caused by GRE not being correctly relayed from your firewall. You might also need to add mppe-stateful to your ...


3

You don't really seem to have the GRE protocol enabled, from what I can see. You have port 47 TCP allowed, but that's not the same. Your rc.local rules regarding GRE seem fine but are probably being overwritten, so add those rules in your firewall system proper. You also have a DROP policy for forwarding packets - add this rule as a mininum: iptables -A ...


3

Since your router is Linux, I assume it must also have an SSH server on it. So here's what I do when I need a quick-and-dirty (but secure) tunnel to browse the web with: First, I log in to my VPS via SSH, like this: ssh -N -D 1080 my-vps.example.com Next, I fire up my FireFox web browser and configure it to use the SOCKS proxy server that my SSH ...


3

The following article may be of help: What’s the difference between PPTP VPN and OpenVPN? The conclusion at the end of the article is as follows: To sum up, if you are looking for high security and privacy you should choose OpenVPN. If you need easy-to-setup VPN, PPTP is a good choice. For mobile devices, PPTP is the only solution.


3

If you can use the IP addresses but not the names, it means that the DNS is not working. Set the following in /etc/ppp/options (on the server): ms-dns 208.67.222.222 ms-dns 208.67.220.220 to use opendns, or easier to remember, Google public dns: ms-dns 8.8.8.8 ms-dns 8.8.4.4 Those servers are anycasted around the world and are pretty reliable, ...


3

You're work and home networks are setup on the same subnet (192.168.1.0/24) You are going to need to switch one of them to another subnet otherwise the machines will never be able to route out to the machines on the other network, as they think they are local. If you still can't talk after you switch the subnet at one location, post back here and we can ...


3

You're almost certainly using an OpenVZ-based VPS. In this case, the host must enable the ppp kernel module (and anything else you might need) for you. Open a support ticket with your hosting provider. If they are unable or unwilling to make this change for you, buy another VPS, that doesn't use OpenVZ, so that you can choose your own kernel modules.


3

You should probably use IKEv2 as a primary if you have Windows Vista/7 clients and 2008r2 servers, with a fallback to SSTP if for whatever reason UDP port 500 is blocked at the client's site. SSTP has a severe performance problem in that you get TCP-in-TCP for most data traffic. This causes the "inner" TCP layer to be mis-informed about the actual packet ...


3

VPN Client Test Check you can ping from client to vpn server ping 10.0.0.1 Check you can ping google by IP ping 8.8.8.8 Check you can ping google by name ping google.com If 1 failed, pptp has issue. If 1,2 succeeded but 3 failed, it is dns issue. Goto Step 1 in next section. If 1 succeeded but 2 failed, properly routing issue. Goto Step 2 in next ...


3

There has been some time that has passed since PPTP's initial inception and rollout. These days there are also a number of application protocols which are secure within themselves (where there was not in the past). If that is the case with your specific deployment, then PPTP may adequately serve as the initial/external delivery transport.


3

Your VPN connection uses MPPE encryption, but according to router's page http://www.draytek.co.uk/products/vigor2830.html - MPPE have no hardware support. Try to setup something else as encryption protocol (AES/DES/3DES). IMHO it is available only with L2TP protocol.


3

My understanding of poptop (the pptpd server) is that you are unable to specify a port number for the server without patching the source and recompiling. Having a look over the source seems to suggest similar [welby@blackpudding pptpd-1.3.4]$ fgrep PPTP_PORT -R . ./pptpmanager.c: address.sin_port = htons(PPTP_PORT); ./pptpdefs.h:#define ...


3

Those iptables rules don't allow traffic to the VPN server, so the VPN can't be established. You need the following rules in the OUTPUT chain before the final DROP rule, where 1.2.3.4 is the IP address of the VPN server. These allow TCP connections to port 1723 (the PPTP control channel) and GRE packets (the data channel). iptables --append OUTPUT ...



Only top voted, non community-wiki answers of a minimum length are eligible