Learn PPTP - Client Configuration & Profiles

#Introduction

The server was set up neatly in episode 9. Now we cross over to the client side: how different operating systems create and manage PPTP connections. This episode covers the approaches most commonly seen in the field — from peers files on Linux to PowerShell on Windows.

Every platform has its own character and its own traps. Understanding all of these approaches lets you help users on any platform, including explaining why modern platforms no longer support PPTP.

#Linux: Profile Files in /etc/ppp/peers

#Creating a Profile Manually

The most transparent way on Linux is to write the peers profile file manually. This file holds all the pppd options for a particular connection:

pty "pptp 192.168.1.10 --nolaunchpppd"
name budi
password "password-rahasia"
remotename vpn-kerja
require-mppe-128
persist
maxfail 0
defaultroute

The pty line is the heart of this profile: it runs the pptp binary as pppd's peer, and --nolaunchpppd prevents pptp from launching its own pppd. require-mppe-128 demands encryption, and defaultroute directs all traffic into the tunnel.

#Connecting the Profile

Connect with a command that also displays the pppd log on screen:

sudo pppd call vpn-kerja

pppd call vpn-kerja reads the /etc/ppp/peers/vpn-kerja file. If you want to see negotiation details, add debug to the profile or run it as pppd call vpn-kerja debug.

#Disconnecting

To disconnect, send a signal to the pppd process or use the killall command:

sudo killall pppd

sudo killall pppd stops all pppd sessions, including the active PPTP tunnel. If you only want to end one session, sudo pkill -f pptp is an alternative that also targets the paired pptp process.

#Using pptpsetup

#The Fast Way to Create a Profile

pptpsetup is a helper that writes the peers file for you. Its command form is the same as in episode 3:

sudo pptpsetup --create vpn-kerja --server 192.168.1.10 --username budi --password "password-rahasia" --encrypt

The --encrypt option automatically adds require-mppe-128 to the profile. pptpsetup's advantage is simplicity; its disadvantage is that the generated profile is hidden and the password is stored in plaintext in /etc/ppp/chap-secrets.

#NetworkManager PPTP

#Connecting from the GUI

Desktop distributions use NetworkManager, and a network-manager-pptp plugin integrates PPTP into the GUI. You simply add a new VPN, choose the PPTP type, fill in the gateway and credentials, and save it.

sudo apt install -y network-manager-pptp-gnome

After installing network-manager-pptp-gnome, the PPTP option appears in NetworkManager's VPN type list. This GUI approach is the most convenient for end users.

#Windows: PowerShell and GPO

#Creating a Connection with PowerShell

On Windows versions that still support PPTP, you can create a VPN profile with a single PowerShell command:

Add-VpnConnection -Name "VPN Kerja" -ServerAddress "192.168.1.10" -TunnelType Pptp -AuthenticationMethod MSChapv2 -EncryptionLevel RequireEncryption -RememberCredential

The Add-VpnConnection cmdlet with -TunnelType Pptp creates a PPTP VPN profile. For large-scale deployment, the same profile can be distributed through Group Policy so users simply click the VPN icon in the taskbar.

#Removing and Distributing Profiles

To remove an unused profile, use Remove-VpnConnection -Name "VPN Kerja". To verify, Get-VpnConnection lists the profiles along with their tunnel type and the encryption level requested:

Get-VpnConnection

The output of Get-VpnConnection shows whether the profile really is of type Pptp and whether encryption is demanded via RequireEncryption. This is useful when auditing devices before migrating to a modern VPN.

#Windows 11 Note

Windows 11 and Windows Server 2022 removed PPTP support. If your organization still uses PPTP, devices on newer operating systems need an alternative — and this is one of the main drivers of the migration discussed in episode 19.

#macOS, iOS, and Android

#Support That Has Been Removed

Apple removed PPTP support from macOS starting with 10.12 Sierra and from iOS starting with version 10. Android also removed its built-in PPTP client in modern versions. As a result, modern Apple and Android devices cannot connect to PPTP servers without third-party apps.

Third-party apps providing PPTP clients still exist, but their use is not recommended given PPTP's proven weak security. For modern environments, steer toward OpenVPN, WireGuard, or IKEv2.

#Closing

Episode 10 mapped the PPTP client side across all major platforms: peers files and pptpsetup on Linux, NetworkManager, PowerShell and GPO on Windows, and the removed support status on macOS, iOS, and Android.

Key takeaways:

• Peers profiles in /etc/ppp/peers are the most transparent way on Linux.
• pppd call nama-profil connects a profile manually.
• pptpsetup creates profiles quickly but stores passwords in plaintext.
• NetworkManager needs the network-manager-pptp plugin.
• Older Windows uses Add-VpnConnection with -TunnelType Pptp.
• Modern macOS, iOS, and Android have removed built-in PPTP support.

In the next episode, episode 11, we will discuss RADIUS integration and user management — using the radius.so plugin in pppd, connecting FreeRADIUS as a backend, LDAP integration, and using accounting for session monitoring.