Point-to-Point Tunneling Protocol

It's June 1996. You've just invested a significant amount of money in a soup-to-nuts dial-in solution for your Windows NT network. You bought a Remote Access Service (RAS) server, multiport controller, a slew of high-end 28.8Kpbs modems, a host of analog lines, and the management capabilities to run it all. Sure, your average cost-per-port was a little high, and you have recurring costs for your analog lines and administration. But the best technology costs money, right?

Well, now it's a year later, and your prized dial-in solution is starting to look like a 1972 Vega compared with the newest 33.6Kbps and 56Kbps (X2) modem technologies. To upgrade, you have to justify replacing all those 28.8Kbps modems with faster units.

The communications field is moving so quickly that you can't predict what will be in the mainstream tomorrow. Corporate IS budgets, already strained by the short life cycle of PCs, can't keep up with the blazing speed of communications developments.

A solution worth looking into is Microsoft's Point-to-Point Tunneling Protocol (PPTP), which Microsoft has integrated with RAS in NT 4.0. (For more information about RAS, see Sean K. Daily, "What's New in Windows NT 4.0 RAS?," January 1997). PPTP lets you set up Virtual Private Networks (VPNs) that let remote users access corporate networks securely across the Internet. Opinions on whether to use this protocol vary greatly because of security and performance issues. But if you implement it correctly, PPTP can provide a low-cost, high-availability dial-in solution for your organization.

PPTP helps you put the mundane task of modem management into the hands of people who are experts at it--Internet Service Providers (ISPs). Just plug your RAS server into the Internet, configure the server to accept PPTP connections, assign a valid Internet IP address to the RAS server, then give that IP address to anyone who needs remote access.

OK, the process takes a few more steps than that scenario. But if you follow the steps I outline, you can get a basic PPTP VPN functioning and see how Microsoft's model works.

How Does It Work?
Imagine PPTP as a Dial-Up Networking (DUN) connection inside a DUN connection, or a pipe within a pipe. Your first connection, or pipe, is your Point-to-Point Protocol (PPP) connection to your ISP; your second connection is your PPTP connection, which tunnels through your first connection. Because the PPTP connection is a tunnel, you can route whatever packet types you want--including IPX and NetBEUI--through the tunnel over the Internet. Your ISP sees the traffic as IP packets, but when the packets reach your PPTP-configured RAS server, they leave the tunnel and enter your corporate network.

PPTP tunneling has particular significance if your IP network is using addresses that you haven't registered with InterNIC or addresses that InterNIC has reserved for private networks (such as the 10.x.x.x range). In either case, without PPTP, you could not successfully route to those addresses through the Internet. With PPTP, you can route into this type of network.

For this article, I assume that not everyone has a dedicated connection to the Internet and that many of you will use dial-up connectivity to test the configuration. Before you start, you need a fully functional RAS server on your network. Your server also must have either a dedicated or a dial-up PPP connection to the Internet through your ISP; a valid Internet IP address; and if you refer to your server by name instead of by IP address, a registered, fully qualified domain name. Your server's configuration must let dial-in clients use all the protocols available on your private network.

On the client side, the requirements are much lighter. You need an NT 4.0 client that is configured to access an ISP via PPP.

First, the Server
To get your RAS server ready to accept incoming PPTP traffic, install PPTP. In the Control Panel Network applet, select the Protocols tab and click Add. Choose Point To Point Tunneling Protocol, as shown in Screen 1. Next, in the PPTP Configuration dialog box, define the number of VPN connections you want to support. RAS can support up to 256 connections; you can always adjust this number later.

PPTP installation then launches Remote Access Setup, shown in Screen 2, where you add all your VPN devices to your RAS server, in the same way that you add modems. Select each device from the RAS Capable Devices list and click OK to add the device to your RAS configuration. Because you will use these VPN devices for inbound PPTP connections only, verify that you have configured each device to receive calls only.

Next, configure encryption for your PPTP connections--remember, your sensitive corporate data will travel through the Internet, which is a public network. In the Remote Access Setup dialog box, click Network and select Require Microsoft encrypted authentication and Require data encryption, shown in Screen 3. Note that the changes you make here affect all connections to your RAS server, including any dial-up connections. If you haven't configured some of your remote access clients to provide Microsoft-encrypted authorizations to the network, this encryption setting will isolate the remote access clients. In that case, consider implementing a secondary RAS server just for your PPTP connections.

If you have a direct connection to the Internet, for more security, you can enable PPTP filtering on your RAS server to block any non-PPTP packets from the server. Screen 4 shows how to enable filtering. On the Control Panel Network applet's Protocolstab, change your properties for TCP/IP. Click Advanced and select the check box Enable PPTP Filtering for the network adapter that is connected to the Internet. You need PPTP filtering only for direct connections to the Internet; you can't configure filtering for dial-up adapters. Be aware that your network adapter in your RAS server will ignore incoming ping and tracert packets once you have enabled PPTP filtering.

If your private internal network is strictly IPX or NetBEUI, you have finished your server configuration at this point and can proceed to client configuration. However, if your private network requires TCP/IP, you need to enable IP forwarding on your RAS server. As Screen 5 shows, go into the Control Panel Network applet and modify the properties for TCP/IP. Choose the Routing tab, and select Enable IP Forwarding.