PFSENSE 2.3 PPTP VPN passthru workaround
PFSense 2.3.x and up have removed the PPTP tab, and PPTP passthru options. This is because PPTP has been depreciated and it not considered 100% safe anymore.
For those of you still in need of using PPTP passthru to allow Windows VPN remote users into your LAN, here is the easy workaround.
- Firewall, NAT, Port forward.
- add port forward from WAN (presumably your outside interface name)
- TCP
- WAN ADDRESS
- DEST PORT RANGE=PPTP 1723
- REDIRECT TARGET IP=the internal IP of your Windows RRAS server.
- REDIRECT TARGET PORT=1723
- Allow it to ADD ASSOCIATED FILTER RULE for this entry
- SAVE
- add another rule, exactly the same as above EXCEPT for GRE. All the same settings, but use GRE
- add port forward from WAN (presumably your outside interface name)
- Once that is complete, go look at your WAN firewall rules. You should have two new auto-created rules. One for PPTP and one for GRE.
- Remote users should now be able to connect just fine through PFSENSE 2.3.x into your Windows RRAS server.
Remember, using PPTP in 2016 is considered a risk, so do it at your own risk. Please consider moving towards a newer VPN standard with better security.
Hello,
with the old firewall I had a pptp integrated with radius: do you think it is possible to emulate the old firewall working?
Currently, I have the old firewall working and in windows 2003 IAS it is pointed as “RADIUS Clients”; I created a similar entry for the pfsense server.
If I try to connect in vpn via the new firewall (I point a static ip address different from the old one) I can connect, but when I trace the connection with WireShark I see that the system contact the lan address of the old firewall.
Is it possible so to say to the pfsense to act as the old one for radius?
Thanks.