Creating PPTP on Pfsense 2.2.4

If you want to build a PPTP server graphically build using pfsense nice looking interface, then please do follow the steps below. Here I assume, a proper NAT firewall is already running in the pfsense configuration.

Step-1

1. Go to VPN > PPTP from top menu
2. Under “Configuration” tab-
   1. PPTP redirection > Enable PPTP server
   2. Define “No of user”
   3. Server Address- type 1.2.3.4 (trust me, it works no matter whatever your WAN or LAN IP is!)
   4. Remote Address Range- <your LAN IP>
   5. PPTP DNS Server- I used- 114.130.5.5 and 8.8.8.8
   6. Place a ‘tick’ “Require 128-bit encryption”
   7. Save

3. Now go to “user” tab-
   1. Click “+”
   2. Enter Username and Password in respective text box
   3. Save
4. Next-
   1. Move in Firewall > Rules > PPTP VPN
   2. Add A New Rule
   3. Under Interface select > PPTP VPN
   4. Protocol > TCP/UDP
   5. Source > Type any
   6. Destination > Type any
   7. Destination port range > from any to any
   8. In “Advanced Features” Gateway section > select your WAN gateway
   9. Save
   10. Now back to Firewall > Rules > PPTP VPN and add another new rule
   11. In this Rule under Interface select > PPTP VPN
   12. Protocol > ICMP
   13. Save

Now your PPTP VPN server is ready.

Configuring PPTP Client under Windows XP (similar works for vista/7/8 edition)

1. Navigate to Start > Control Panel > Network Connections
2. Click File > New Connection, click Next
3. Select Connect to the network at my workplace, click Next
4. Select VPN connection, click Next
5. Enter Descriptive name for connection, click Next
6. Select Do not dial the initial connection, click Next
7. Enter Hostname or PUBLIC IP address of the PPTP server, click Next
8. This would be the IP address in use on the default WAN of the firewall
9. Select Do not use smart card, click Next
10. Click Finish

That is all that is required. If resources will be accessed which via the VPN that are not directly connected to the firewall itself, such as the Internet, the next steps should be skipped.

By default when a connection is made to the PPTP server, the default gateway for ALL traffic will be via the PPTP VPN. With the current rules created in this example, resources outside the LAN or DMZ subnets would be unreachable. To allow that traffic, add more permissive rules, such as one with a pass to a destination of any.

To change this behavior:

1. Click Properties
2. Click Networking, then select Internet Protocol (IPv4)
3. Click Properties
4. Click Advanced
5. Uncheck Use default gateway on remote network
6. Click OK (3 times)
7. Enter a username and password configured during the PPTP User Setup process.
8. Click on Connect
9. The client will attempt to connect. It will show “Connecting”, then “Verifying username & password”, then “Authenticated”, and perhaps “Registering computer on network”.
10. Right click on the tray icon for the VPN connection
11. Click Properties
12. Click Details
13. Ensure that we are using MSCHAP v2 and MPPE 128
14. Attempt to ping the LAN interface of the firewall.