Learn PPTP - Installation & Initial Setup

#Introduction

You already understand the architecture from episode 2. Now it is time to get your hands dirty: install, configure, and make a real, working PPTP connection. This episode focuses on the simplest path so you can see a live tunnel.

Throughout this episode, we use the two VMs from episode 0: a server running pptpd and a client running pptp-linux. All the configuration files we change are real files used by PoPToP, so you can apply the results directly in your own lab.

#Installing the pptpd Server

#Installing from the Repository

On Debian/Ubuntu distributions, PoPToP is available in the official repositories. Installation is a single command:

sudo apt update
sudo apt install -y pptpd ppp

The ppp package is an important dependency because it provides pppd, the PPP engine that handles authentication and IP addressing. After installation, the pptpd service is registered with systemd even though it is not yet active.

#Minimal pptpd.conf Configuration

#Setting Tunnel IP Addresses

The server's main file is /etc/pptpd.conf. We only need to set two things: the IP address the server uses inside the tunnel (localip) and the address pool for clients (remoteip).

option /etc/ppp/options.pptpd
logwtmp
localip 192.168.1.10
remoteip 192.168.1.100-110

The option /etc/ppp/options.pptpd line tells pptpd which PPP options file to use. localip is the server's address inside the tunnel, and remoteip is the range of addresses handed out to clients. Read this file before changing anything, because many directives already exist in commented-out form.

#Starting the Service

After saving the configuration, restart the service:

sudo systemctl restart pptpd
sudo systemctl status pptpd

If systemctl status pptpd shows an active (running) status, the daemon is listening on port 1723. Continue by creating a user.

#Creating a User in chap-secrets

#The chap-secrets File Format

PPTP dial-up accounts are stored in /etc/ppp/chap-secrets. The format of each line is: client name, server name, password, and the IP address the client is allowed to use.

budi pptpd "S3curePassw0rd" *

The line above means user budi may connect to the server named pptpd (the value of the name directive in options.pptpd) with the specified password, and may receive any IP address from the pool. Never use weak passwords for a lab that touches a real network.

#Applying the Changes

pppd reads chap-secrets on every new session, so no restart is needed:

sudo grep -v "^#" /etc/ppp/chap-secrets

Use grep -v "^#" /etc/ppp/chap-secrets to view the active lines without comments and make sure your user is there.

#First Connection from the Linux Client

#Install and Connect

On the client, install pptp-linux, then create a connection profile with pptpsetup:

sudo apt install -y pptp-linux
sudo pptpsetup --create vpn-kerja --server 192.168.1.10 --username budi --password "S3curePassw0rd" --encrypt
sudo pptpsetup --connect vpn-kerja

The --encrypt option tells the client to demand MPPE encryption. After --connect, check the tunnel interface:

ip addr show ppp0

If ip addr show ppp0 shows address 192.168.1.100 (or the first address of the pool), your first PPTP connection was successful. Test it with a ping to the server's local address inside the tunnel.

#The Windows PPTP Client

#Connecting from the Windows Built-in Client

To test from Windows, open Settings and go to the Network and VPN section. Add a VPN with server address 192.168.1.10, connection type PPTP, and enter the budi credentials. Windows handles the built-in PPTP client without any extra software.

Important note: in the latest Windows 11 and newer versions, Microsoft has removed PPTP support. If your device no longer shows the PPTP option, use a Linux client as an alternative — and treat this as a consideration for the migration we will cover in episode 19.

#Closing

Episode 3 accomplished the most practical goal: a PPTP server that accepts connections, a valid user, a connected Linux client, and a test connection from Windows. From here, you have a live PPTP lab to explore in the upcoming episodes.

Key takeaways:

• Install pptpd and ppp on the server; pptp-linux on the client.
• /etc/pptpd.conf needs localip, remoteip, and option.
• Users are stored in /etc/ppp/chap-secrets in the client-server-password-IP format.
• pptpsetup --create creates a profile; --connect connects.
• The ppp0 interface appears when a PPP session succeeds.
• The Windows built-in client still works on older versions; modern Windows 11 has removed it.

In the next episode, episode 4, we will discuss PPP and authentication mechanisms — the LCP and NCP phases, the differences between PAP, CHAP, and MS-CHAPv2, and why the MS-CHAPv2 used by PPTP can already be cracked.