PPTP extras

• This how-to describes the most common PPTP tuning scenarios adapted for OpenWrt.
• Follow PPTP server for server setup and PPTP client for client setup.
• Follow PPTP protocol for protocol-specific interface options.
• Follow Random generator to overcome low entropy issues.

• Poptop PPTP server documentation

Install the necessary packages if you want to manage VPN settings using web interface.

# Install packages
opkg update
opkg install luci-proto-ppp
/etc/init.d/rpcd restart

Navigate to LuCI → Network → Interfaces to configure PPTP.

Provide PPTP passthrough for LAN clients over your router.

# Install packages
opkg update
opkg install kmod-nf-nathelper-extra
/etc/init.d/firewall restart

Provide static IP address allocation on VPN server.

# Configure VPN service
rm -f /tmp/etc/chap-secrets
uci set pptpd.client.remoteip="192.168.6.2"
uci commit pptpd
/etc/init.d/pptpd restart

Implement plain routing between server side LAN and client side LAN assuming that:

• 192.168.1.0/24 - server side LAN
• 192.168.2.0/24 - client side LAN

Set up static address allocation on VPN server, add route to client side LAN.

cat << "EOF" > /etc/ppp/ip-up
#!/bin/sh
case ${IPREMOTE} in
(192.168.6.2) ip route add 192.168.2.0/24 via ${IPREMOTE} dev ${IFNAME} ;;
esac
EOF
chmod +x /etc/ppp/ip-up

Consider VPN network as private and assign VPN interface to LAN zone on VPN client, add route to server side LAN.

uci del_list firewall.wan.network="vpn"
uci add_list firewall.lan.network="vpn"
uci commit firewall
/etc/init.d/firewall restart
uci -q delete network.lan_vpn
uci set network.lan_vpn="route"
uci set network.lan_vpn.interface="vpn"
uci set network.lan_vpn.target="192.168.1.0/24"
uci set network.lan_vpn.gateway="192.168.6.1"
uci commit network
/etc/init.d/network restart

If VPN gateway is not your LAN gateway. Implement plain routing between LAN network and VPN network assuming that:

• 192.168.1.0/24 - LAN network
• 192.168.1.2/24 - VPN gateway
• 192.168.6.0/24 - VPN network

Add port forwarding for VPN server on LAN gateway.

uci -q delete firewall.pptp
uci set firewall.pptp="redirect"
uci set firewall.pptp.name="Redirect-PPTP"
uci set firewall.pptp.src="wan"
uci set firewall.pptp.src_dport="1723"
uci set firewall.pptp.dest="lan"
uci set firewall.pptp.dest_ip="192.168.1.2"
uci set firewall.pptp.family="ipv4"
uci set firewall.pptp.proto="tcp"
uci set firewall.pptp.target="DNAT"
uci commit firewall
/etc/init.d/firewall restart

Add route to VPN network via VPN gateway on LAN gateway.

uci -q delete network.vpn
uci set network.vpn="route"
uci set network.vpn.interface="lan"
uci set network.vpn.target="192.168.6.0/24"
uci set network.vpn.gateway="192.168.1.2"
uci commit network
/etc/init.d/network restart

Set up multi-client VPN server. Use unique credentials for each client.

# Configure VPN service
uci -q delete pptpd.client1
uci set pptpd.client1="login"
uci set pptpd.client1.username="USERNAME1"
uci set pptpd.client1.password="PASSWORD1"
uci commit pptpd
/etc/init.d/pptpd restart

Automated VPN server installation.

opkg update
opkg install libustream-mbedtls
URL="https://openwrt.org/_export/code/docs/guide-user/services/vpn/pptp"
cat << EOF > pptp-server.sh
$(uclient-fetch -O - "${URL}/server?codeblock=0")
$(uclient-fetch -O - "${URL}/server?codeblock=1")
$(uclient-fetch -O - "${URL}/server?codeblock=2")
EOF
sh pptp-server.sh