Learn PPTP - Server Configuration Deep Dive

#Introduction

The minimal configuration in episode 3 is enough to bring the tunnel up, but a production setup needs finer control. Episode 9 dives into every important directive in /etc/pptpd.conf and /etc/ppp/options.pptpd, so you can tune the server to your real needs.

You will learn what each option means, when to use it, and how to combine them into a solid configuration. By the end of this episode, you will be able to read someone else's PPTP configuration file and immediately understand the server's behavior.

#Diving into /etc/pptpd.conf

#The Most Important Directives

/etc/pptpd.conf is the main entry point of server configuration. Some of the most commonly used directives:

• option /etc/ppp/options.pptpd: specifies the PPP options file for pppd.
• logwtmp: records sessions to wtmp for accounting purposes.
• connections N: limits the number of concurrent connections.
• listen IP: binds the daemon to a specific interface or IP address.
• localip and remoteip: define the tunnel address map.

option /etc/ppp/options.pptpd
logwtmp
connections 50
listen 192.168.1.10
localip 192.168.1.10
remoteip 192.168.1.100-110

The connections 50 directive limits concurrent sessions to 50 — useful for preventing a single user from consuming all resources. listen 192.168.1.10 ensures the daemon only listens on the internal IP address, not on all interfaces.

#Diving into /etc/ppp/options.pptpd

#Controlling Authentication and Encryption

This file is the pppd options file used for all incoming sessions. Security comes first:

name pptpd
require-mschap-v2
require-mppe-128
refuse-pap
refuse-chap
refuse-eap
nobsdcomp

name pptpd matches the server column in chap-secrets. refuse-pap, refuse-chap, and refuse-eap close the weaker authentication methods, so only MS-CHAPv2 is accepted. nobsdcomp disables BSD compression, which can cause interoperability problems.

#Services for Clients

To make clients comfortable, add the network information that IPCP will send:

ms-dns 8.8.8.8
ms-dns 1.1.1.1
proxyarp

ms-dns tells clients which DNS servers to use once the tunnel is up. proxyarp (already covered in episode 7) makes client addresses ARP-able by devices on the server's LAN segment.

#IP Pool Management

#Flexible remoteip Patterns

remoteip supports several patterns at once — ranges with dashes and lists with commas:

remoteip 10.0.0.10-10.0.0.30,10.0.0.100

The configuration above creates a pool from 10.0.0.10 to 10.0.0.30 plus the fixed address 10.0.0.100. Addresses used by clients are picked sequentially from this pool by pptpd.

#Keeping Fixed Addresses

For specific users who need a fixed IP address, write the address in the fourth column of chap-secrets:

budi pptpd "password-rahasia" 10.0.0.100

The fourth column limits the addresses that user may use. This is useful for IP-based access policies on the other side.

#Syslog Integration

#Directing Logs to Their Own File

pppd and pptpd write to the daemon facility in syslog. If you want to separate PPTP logs, set up an rsyslog rule:

daemon.*     /var/log/pptp.log

After writing the file above, apply the change with sudo systemctl restart rsyslog. From then on, all daemon logs including pptpd and pppd go to /var/log/pptp.log. This makes long-term auditing and monitoring easier.

#Closing

Episode 9 rounded out your understanding of server configuration: the important directives in /etc/pptpd.conf, the security baseline and services in /etc/ppp/options.pptpd, IP pool management patterns, and log separation.

Key takeaways:

• option, logwtmp, connections, and listen are key pptpd.conf directives.
• require-mschap-v2 and require-mppe-128 are the security baseline.
• refuse-pap, refuse-chap, and refuse-eap close weak methods.
• ms-dns and proxyarp determine the services clients receive.
• remoteip supports ranges and lists; fixed addresses can be set per user.
• Daemon logs can be separated with an rsyslog rule.

In the next episode, episode 10, we will discuss client configuration and connection profiles — peers files in pptp-linux, using pptpsetup, NetworkManager, PowerShell Add-VpnConnection on Windows, and the PPTP support status on macOS, iOS, and Android.