====== PPTP tunnel pass-throughs ======

PPTP tunnels going through Internet Gate have to be specified explicitly in the VPN Pass-through field of the [[security profile]] page. [[wp>PPTP]]

:!: The most important rule to remember is that **two local clients are never allowed to contact the same remote server!**

You are recommended to specify **all three fields** for each row. (Ensures stability and reliability.) Though you can enter as many rows as you want, try to keep the number of rows low.

If remote server IP is not specified (empty field), the specified local client can access any remote server – except servers accessed by other local clients. NOTE: only one such row is allowed to be entered – multiple rows with only local client IP specified are not allowed!

If local client IP is not specified (empty field), the specified remote server can be accessed by any of the local clients – but only by one client at a time.

If neither local client IP nor remote server IP is specified, any local client can access any remote server – but this mode often results in non-stable connections, and is therefore not recommended.

Even though it is possible to enter multiple incomplete rows (with missing IP addresses), such configurations might easily lead to side effects and non-working connections and is therefore not recommended.

It doesn't matter in what order you enter the rows.

The remote server is not allowed to be behind a NAT.

**PPTP** and **[[IPSec pass-through|IPSec]]** or **[[IPSec NAT-T pass-through|IPSec NAT-T]]** entries don't affect each other (even though they are entered into the same pass-through-list), thus you can ignore all IPSec and IPSec NAT-T entries when considering what PPTP entry combinations you can enter.

===== Recommendations =====

If you **only have one PPTP client** on your local network, enter its IP address into the Local client IP field, and leave Remote server IP empty.

If you have **multiple PPTP clients** on your local network, enter multiple complete lines specifying for each client its IP address and the IP address of the server it connects to. Make sure no two lines have same remote server IP-s in them.

===== Examples =====

To connect 192.168.0.31 to 50.11.69.17, and 192.168.0.32 to 100.23.65.77 enter:

PPTP , 192.168.0.31 , 50.11.69.17

PPTP , 192.168.0.32 , 100.23.65.77

To connect 192.168.0.31 to both remote servers enter:

PPTP, 192.168.0.31 , 50.11.69.17

PPTP, 192.168.0.31 , 100.23.65.77

or:

PPTP, 192.168.0.31 , (empty)

The difference is that while the first version only allows the client to connect to the two specified servers (and no others), the second version allows the client to connect to any remote server.

Watch out with rules:

PPTP, 192.168.0.31 , 50.11.69.17

PPTP, 192.168.0.32 , (empty)

Please note that 192.168.0.32 can access any remote PPTP server except 50.11.69.17 – as that one is reserved for client 192.168.0.31. It does not matter if client 192.168.0.31 is actually connected to the server right now or not – as it is a static pass-through through the firewall no other client can use it. To allow both clients to be able to reach server 50.11.69.17 you should instead enter rule:

PPTP, (empty) , 50.11.69.17

that allows any inside client to contact the remote server – but not two at the same time!

Please note that it is impossible to, at the same time, connect both 192.168.0.31 and 192.168.0.32 to remote server 50.11.69.17! The closest you can come is with rule:

PPTP, (empty) , 50.11.69.17

that allows any inside client to contact the remote server 50.11.69.17 – one at a time! If 192.168.0.31 is connected, connecting 192.168.0.32 makes 192.168.0.31 immediately loose its PPTP connection.

===== Errors =====

If you have entered illegal combination of rules the first non-conformant rule is marked with XXX. Please note that the reason for the error could be another rule before or after that rule that makes usage of the marked rule impossible. Read the information on this page carefully to solve the problem.

Incomplete VPN pass-through rules (with one or both IP addresses missing) can, in certain combinations, result in other behaviour than you might have expected. Always try to fill in as many of the fields as possible.

In the examples above, if you enter:

PPTP, 192.168.0.31 , 50.11.69.17

PPTP, 192.168.0.32 , 50.11.69.17

you will get an error, as two pass-through tunnels are not allowed to go to the same remote server.
===== The other way around - PPTP server on the LAN =====

It is possible to have one single PPTP server on the LAN to be connected by one ore more remote PPTP clients. 
If so, first configure the PPTP pass-through as if the server on the LAN was a client:

{{:web_gui:pptp-server.jpg|}}

(In this example, the PPTP server is assumed to sit on the local IP address 192.168.0.9)\\ 
Leave the **Remote server IP** empty.

Then add "dport == pptp and proto == tcp modify static daddr 192.168.0.9" as an **additional rule** set on the WAN interface:

{{:web_gui:pptp-servadd.jpg|}}

If your WAN interface is ADSL, choose "LINE" instead in the first column.

It is recommended to add the additional rule above instead of using the tcp port redirection fields.
Adding a tcp port redirection would create two firewall rules instead of one.