WARNING: PPTP IS AN INSECURE PROTOCOL! Not only has the encryption been breached, but it sends your authentication in clear text and is easily intercepted. It has been estimated that the amount of time required to brute-force the password is roughly equivalent to the time required to brute-force a single DES key. Consider using OpenVPN or another VPN architecture instead of PPTP!
I used this guide to set up a PPTP VPN server on my Ubuntu 12.04 server.
To summarize the main points in the link, though:
iptables can be used in place of ufw, but for the sake of easiness,
ufw is better if you don't know
sudo apt-get install pptpd ufw
2: Open the ports needed. The guide suggests 22 (SSH) and 1723 for the pptp vpn.
sudo ufw allow 22
sudo ufw allow 1723
sudo ufw enable
/etc/ppp/pptpd-options. Open the file with your favorite editor (mine's nano, so the command for me is
sudo nano /etc/ppp/pptpd-options), and comment out these lines by putting a
# before them, if you want this to work universally on all OSes:
You can comment this line if you want to disable encryption:
4: While editing
/etc/ppp/pptpd-options, add DNS servers for the VPN. This example uses OpenDNS servers:
/etc/pptpd.conf. Open the file with your favorite editor (mine's nano, so the command for me is
sudo nano /etc/pptpd.conf). You need to add the local VPN IPs for the system, so add:
If your system is a VPS, use the public IP for "localip". If it is not and is on a local network, use your computer's network IP. Use different IPs and ranges if these IPs exist on your subnet!
If you don't know your public IP of your VPS, find it by running
dig +short myip.opendns.com @resolver1.opendns.com
/etc/ppp/chap-secrets. Open the file with your favorite editor (mine's nano, so the command for me is
sudo nano /etc/ppp/chap-secrets), and add the auth data.
The format for
[Username] [Service] [Password] [Allowed IP Address]
An example would be:
sampleuser pptpd samplepassword *
7: Restart pptpd. Run this command in terminal:
sudo /etc/init.d/pptpd restart
/etc/sysctl.conf. Open the file with your favorite editor (mine's nano, so the command for me is
sudo nano /etc/sysctl.conf). Un-comment the following line (by removing the
# at the beginning of it) in
Reload the configuration:
sudo sysctl -p
9: This step assumes you have ufw.
/etc/default/ufw and change the option
10: This step assumes you have ufw.
/etc/ufw/before.rules, and add the following either at the beginning of
/etc/ufw/before.rules or just before the
*filter rules (recommended):
# NAT table rules
:POSTROUTING ACCEPT [0:0]
# Allow forward traffic to eth0
-A POSTROUTING -s 10.99.99.0/24 -o eth0 -j MASQUERADE
# Process the NAT table rules
If you have kernel version 3.18 and newer (you can check this by running
uname -r), also add the following lines before the
# drop INVALID packets ... line:
-A ufw-before-input -p 47 -j ACCEPT
11: Restart the firewall, to refresh the rule sets and to apply the rules we added to the
sudo ufw disable && sudo ufw enable
Warning: If you have other ports you need open, such as for HTTPS if your server hosts a website, you need to individually add those ports to the allowed list with
sudo ufw allow <PORT>