Learn PPTP - Routing & IP Forwarding

#Introduction

The PPTP connection could already be established in episode 3, but a tunnel without routes is just a dead end. For traffic to really flow — whether to the server's internal network or to the internet — you must understand PPTP's routing side.

Episode 7 covers address management in /etc/pptpd.conf, enabling IP forwarding, adding NAT, using proxy ARP, and understanding split tunneling from the client's perspective.

#Address Management in pptpd.conf

#The Role of localip and remoteip

These two directives determine the tunnel's address map. localip is the server's address inside the tunnel, while remoteip defines the pool handed out to clients:

localip 192.168.1.10
remoteip 192.168.1.100-110

With the configuration above, the server always uses 192.168.1.10 and clients receive addresses from the 192.168.1.100 to 192.168.1.110 range. This virtual subnet can be a new subnet or a segment taken from the internal network.

#Choosing the Right Subnet

If you want PPTP clients to access the server's LAN directly, make sure the virtual subnet does not collide with the physical subnet. If it collides, routing becomes ambiguous and troubleshooting will eat up your time.

#Enabling IP Forwarding

#The sysctl net.ipv4.ip_forward Setting

For the server to forward packets between interfaces (from tunnel to LAN), IP forwarding must be enabled:

sudo sysctl -w net.ipv4.ip_forward=1

To keep it after a reboot, write it to /etc/sysctl.conf or a file under /etc/sysctl.d/:

net.ipv4.ip_forward = 1

After saving the file, run sudo sysctl -p /etc/sysctl.d/99-pptp.conf to apply it without rebooting.

#NAT MASQUERADE

#Giving Clients Internet Access

If PPTP clients must reach the internet through the server, add a NAT rule on the outgoing interface:

sudo iptables -t nat -A POSTROUTING -s 192.168.1.100/28 -o eth0 -j MASQUERADE

The rule above makes traffic from PPTP clients (192.168.1.100/28) appear to come from the server's address when it leaves via eth0. Without this rule, clients can only reach addresses on the server's directly attached network.

#The FORWARD Chain

Do not forget to allow forwarding on the FORWARD chain:

sudo iptables -A FORWARD -i ppp+ -o eth0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o ppp+ -m state --state ESTABLISHED,RELATED -j ACCEPT

These two rules allow traffic to leave via the ppp+ interfaces and accept the return traffic. iptables -A FORWARD -i ppp+ -o eth0 -j ACCEPT is a common pattern covering all PPP interfaces at once.

#Proxy ARP

#Answering ARP on Behalf of Clients

The proxyarp option in options.pptpd makes the server answer ARP requests on behalf of clients' IP addresses on the LAN segment:

proxyarp

With proxyarp enabled, other devices on the LAN can send packets directly to a PPTP client without needing an extra static route. This is very helpful when the client subnet sits on the same network segment as the server.

#Split Tunneling on the Client

#The Split Tunneling Concept

Split tunneling is the practice of sending only part of the traffic through the tunnel, letting the rest use the direct internet connection. This approach reduces server load but is risky because traffic outside the tunnel is not subject to corporate policy inspection.

#Controlling Routes on the Client

On a Linux client, the peers profile file determines whether all traffic enters the tunnel (defaultroute) or only traffic to specific subnets:

nodefaultroute
route 10.0.0.0 255.255.255.0

The nodefaultroute line prevents pppd from replacing the default route, and route 10.0.0.0 255.255.255.0 directs only the 10.0.0.0/24 subnet into the tunnel. This pattern is the basis of the split tunneling you will see in many enterprise setups.

#Closing

Episode 7 connected the tunnel to the real network: address management with localip and remoteip, IP forwarding, NAT MASQUERADE, proxy ARP, and client route control for split tunneling.

Key takeaways:

• localip and remoteip define the address map inside the tunnel.
• IP forwarding must be enabled via sysctl for the server to forward packets.
• NAT MASQUERADE gives clients internet access through the server.
• The FORWARD chain must allow ppp to eth0 traffic and the reverse.
• The proxyarp option makes clients reachable from the server's LAN segment.
• nodefaultroute on the client enables controlled split tunneling.

In the next episode, episode 8, we will discuss logging and troubleshooting — reading pptpd and pppd logs, enabling debug mode, recognizing common issues such as blocked GRE and authentication failures, and tools like tcpdump.