Multilink PPP (MP) is supported in order to provide MRRU (the ability to transmit full-sized 1500 and larger packets) and bridging over PPP links (using Bridge Control Protocol (BCP) that allows the sending of raw Ethernet frames over PPP links). This way it is possible to setup bridging without EoIP. The bridge should either have an administratively set MAC address or an Ethernet-like interface in it, as PPP links do not have MAC addresses.
PPTP includes PPP authentication and accounting for each PPTP connection. Full authentication and accounting of each connection may be done through a RADIUS client or locally.
MPPE 40bit RC4 and MPPE 128bit RC4 encryption are supported.
PPTP traffic uses TCP port 1723 and IP protocol GRE (Generic Routing Encapsulation, IP protocol ID 47), as assigned by the Internet Assigned Numbers Authority (IANA). PPTP can be used with most firewalls and routers by enabling traffic destined for TCP port 1723 and protocol 47 traffic to be routed through the firewall or router.
PPTP connections may be limited or impossible to setup though a masqueraded/NAT IP connection. Please see the Microsoft and RFC links listed below for more information.
Quick example
This example demonstrates how to set up PPTP client with username "pptp-hm", password "123" and server 10.1.101.100
/interface pptp-client add name=pptp-hm user=pptp-hm password=123 connect-to=10.1.101.100 disabled=no
/interface pptp-client print detail
Flags: X - disabled, R - running
0 name="pptp-hm" max-mtu=1460 max-mru=1460 mrru=disabled
connect-to=10.1.101.100 user="pptp-hm" password="123"
profile=default-encryption add-default-route=no dial-on-demand=no
allow=pap,chap,mschap1,mschap2
PPTP Server
Sub-menu: /interface pptp-server
This sub-menu shows interfaces for each connected PPTP clients.
An interface is created for each tunnel established to the given server. There are two types of interfaces in PPTP server's configuration
Static interfaces are added administratively if there is a need to reference the particular interface name (in firewall rules or elsewhere) created for the particular user.
Dynamic interfaces are added to this list automatically whenever a user is connected and its username does not match any existing static entry (or in case the entry is active already, as there can not be two separate tunnel interfaces referenced by the same name).
Dynamic interfaces appear when a user connects and disappear once the user disconnects, so it is impossible to reference the tunnel created for that use in router configuration (for example, in firewall), so if you need persistent rules for that user, create a static entry for him/her. Otherwise it is safe to use dynamic configuration.
To enable PPTP server:
/interface pptp-server server set enabled=yes
/interface pptp-server server print
enabled: yes
max-mtu: 1460
max-mru: 1460
mrru: disabled
authentication: mschap2,mschap1
keepalive-timeout: 30
default-profile: default
Monitoring
Monitor command can be used to monitor status of the tunnel on both client and server.
/interface pptp-client monitor 0
status: "connected"
uptime: 7h24m18s
idle-time: 6h21m4s
encoding: "MPPE128 stateless"
mtu: 1460
mru: 1460
Application Examples
Connecting Remote Client
The following example shows how to connect a computer to a remote office network over a PPTP encrypted tunnel giving that computer an IP address from the same network that the remote office has (without any need of bridging over EoIP tunnels).
Consider following setup:
Office router is connected to internet through ether1. Workstations are connected to ether2. Laptop is connected to the internet and can reach Office router's public IP (in our example it is 192.168.80.1).
First step is to create a user
/ppp secret add name=Laptop service=pptp password=123 local-address=10.1.101.1 \
remote-address=10.1.101.100
/ppp secret print detail
Flags: X - disabled
0 name="Laptop" service=pptp caller-id="" password="123" profile=default
local-address=10.1.101.1 remote-address=10.1.101.100 routes==""
Notice that the PPTP local address is the same as the router's address on the local interface and the remote address is from the same range as the local network (10.1.101.0/24).
Next step is to enable the PPTP server and the PPTP client on the laptop.
/interface pptp-server server set enabled=yes
/interface pptp-server server print
enabled: yes
max-mtu: 1460
max-mru: 1460
mrru: disabled
authentication: mschap2
keepalive-timeout: 30
default-profile: default
PPTP client from the laptop should connect to routers public IP which in our example is 192.168.80.1.
(Consult the respective manual on how to set up a PPTP client with the operating system software you are using).
At this point (when PPTP client is successfully connected) if you try to ping any workstation form the laptop, the ping will time out because the Laptop is unable to get ARPs from workstations. The solution is to set up proxy-arp on the local interface.
/interface ethernet set Office arp=proxy-arp
/interface ethernet print
Flags: X - disabled, R - running
# NAME MTU MAC-ADDRESS ARP
0 R ether1 1500 00:30:4F:0B:7B:C1 enabled
1 R ether2 1500 00:30:4F:06:62:12 proxy-arp
After proxy-arp is enabled, the remote client can successfully reach all workstations in the local network behind the router.
Site-to-Site PPTP
The following is an example of connecting two Intranets using PPTP tunnel over the Internet.
Consider following setup:
Office and Home routers are connected to the internet through ether1, workstations and laptops are connected to ether2. Both local networks are routed through a PPTP client, thus they are not in the same broadcast domain. If both networks should be in the same broadcast domain then you need to use BCP and bridge the PPTP tunnel with the local interface.
First step is to create a user
/ppp secret add name=Home service=pptp password=123 local-address=172.16.1.1 \
remote-address=172.16.1.2 routes="10.1.202.0/24 172.16.1.2 1"
/ppp secret print detail
Flags: X - disabled
0 name="Home" service=pptp caller-id="" password="123" profile=default
local-address=172.16.1.1 remote-address=172.16.1.2 routes=="10.1.202.0/24 172.16.1.2 1"
Notice that we set up PPTP server's PPP secret where a route is added automatically whenever the client connects. If this option is not set, then you will need to add static routing on the server to route traffic between the two sites through the PPTP tunnel. (See PPP User Database for more info on routes variable).
Next step is to enable the PPTP server on the office router and configure the PPTP client on the Home router.
/interface pptp-server server set enabled=yes
/interface pptp-server server> print
enabled: yes
max-mtu: 1460
max-mru: 1460
mrru: disabled
authentication: mschap2
keepalive-timeout: 30
default-profile: default
/interface pptp-client add user=Home password=123 connect-to=192.168.80.1 disabled=no
/interface pptp-client print
Flags: X - disabled, R - running
0 name="pptp-out1" max-mtu=1460 max-mru=1460 mrru=disabled connect-to=192.168.80.1 user="Home"
password="123" profile=default-encryption add-default-route=no dial-on-demand=no
allow=pap,chap,mschap1,mschap2
Now we need to add the route to reach the local network behind the Home router
/ip route add dst-address=10.1.101.0/24 gateway=pptp-out1
Now after the tunnel is established and routes are set, you should be able to ping remote network.
0 Response to "PPTP"
Post a Comment