Managing VPNs with PPTP

Microsoft's Point-to-Point Tunneling Protocol (PPTP) is a network protocol for creating Virtual Private Networks. VPNs are virtual because they use software to form a connection over a public network (typically the Internet). VPNs are private because they encrypt the data they carry to prevent other users from reading the data as it traverses a public network. VPNs can tunnel or encapsulate other network protocols (e.g., IPX, NetBEUI) within the TCP/IP protocol.

VPNs can form permanent or dial-up connections between sites. To establish a permanent PPTP connection, you need to use Windows NT's Routing and Remote Access Service (RRAS) add-on. You typically use VPNs in dial-up situations in which an end user manually establishes a VPN to temporarily connect to a remote network. For example, an offsite employee might connect to the Internet through an Internet Service Provider (ISP) and then use a VPN to make a secure connection to the corporate office. PPTP lets you use inexpensive Internet links to create secure connections (dial-up or dedicated) between computers. I discuss only dial-up PPTP usage in this article.

PPTP is not the only network protocol you can use to create VPNs, but it is easy to acquire and use. NT, Windows 95, and Win98 include PPTP for free. You can obtain versions for Windows 3.1, Windows 3.11, and Macintosh from Network Telesystems (http://www.nts.com) and a Linux client (http://www.pdos.lcs.mit.edu/~cananian/Projects/PPTP). Thus, you can use PPTP to create VPNs among various OSs.

In this article, I describe how to configure PPTP on common Windows platforms and how to verify PPTP operation. (For more information about installing PPTP, see Douglas Toombs, "Point-to-Point Tunneling Protocol," June 1997.)

Configuring RAS as a PPTP Server
PPTP requires Remote Access Service (RAS), even if you are not using a modem or ISDN adapter. PPTP piggybacks on many RAS operations and functions, regardless of whether you use it with dial-up or permanent network connections.

PPTP requires special RAS server settings. Open Control Panel, and start the Network applet. Select Services, Remote Access Service. Then, select one of the VPN ports, and click Network. (Which VPN port you select does not matter, because they all have the same settings.) The encryption settings determine which Point-to-Point Protocol (PPP) authentication mechanisms the PPTP server accepts. The Require Microsoft encrypted authentication setting lets you use only Microsoft's Challenge Handshake Authentication Protocol (CHAP). MS CHAP uses a different encryption scheme than regular CHAP uses, and MS CHAP is the only authentication protocol that PPTP accepts. If you want to encrypt the tunneled connection, you must select Require data encryption. If you do not select this option, the data traversing the tunneled connection is not encrypted--­negating one of PPTP's most useful features.