Creating PPTP on Pfsense 2.2.4

If you want to build a PPTP server graphically build using pfsense nice looking interface, then please do follow the steps below. Here I assume, a proper NAT firewall is already running in the pfsense configuration.


  1. Go to VPN > PPTP from top menu
  2. Under “Configuration” tab-
    1. PPTP redirection > Enable PPTP server
    2. Define “No of user”
    3. Server Address- type (trust me, it works no matter whatever your WAN or LAN IP is!)
    4. Remote Address Range- <your LAN IP>
    5. PPTP DNS Server- I used- and
    6. Place a ‘tick’ “Require 128-bit encryption”
    7. Save
  3. Now go to “user” tab-
    1. Click “+”
    2. Enter Username and Password in respective text box
    3. Save
  4. Next-
    1. Move in Firewall > Rules > PPTP VPN
    2. Add A New Rule
    3. Under Interface select > PPTP VPN
    4. Protocol > TCP/UDP
    5. Source > Type any
    6. Destination > Type any
    7. Destination port range > from any to any
    8. In “Advanced Features” Gateway section > select your WAN gateway
    9. Save
    10. Now back to Firewall > Rules > PPTP VPN and add another new rule
    11. In this Rule under Interface select > PPTP VPN
    12. Protocol > ICMP
    13. Save

Now your PPTP VPN server is ready.

Configuring PPTP Client under Windows XP (similar works for vista/7/8 edition)

  1. Navigate to Start > Control Panel > Network Connections
  2. Click File > New Connection, click Next
  3. Select Connect to the network at my workplace, click Next
  4. Select VPN connection, click Next
  5. Enter Descriptive name for connection, click Next
  6. Select Do not dial the initial connection, click Next
  7. Enter Hostname or PUBLIC IP address of the PPTP server, click Next
  8. This would be the IP address in use on the default WAN of the firewall
  9. Select Do not use smart card, click Next
  10. Click Finish

That is all that is required. If resources will be accessed which via the VPN that are not directly connected to the firewall itself, such as the Internet, the next steps should be skipped.

By default when a connection is made to the PPTP server, the default gateway for ALL traffic will be via the PPTP VPN. With the current rules created in this example, resources outside the LAN or DMZ subnets would be unreachable. To allow that traffic, add more permissive rules, such as one with a pass to a destination of any.

To change this behavior:

  1. Click Properties
  2. Click Networking, then select Internet Protocol (IPv4)
  3. Click Properties
  4. Click Advanced
  5. Uncheck Use default gateway on remote network
  6. Click OK (3 times)
  7. Enter a username and password configured during the PPTP User Setup process.
  8. Click on Connect
  9. The client will attempt to connect. It will show “Connecting”, then “Verifying username & password”, then “Authenticated”, and perhaps “Registering computer on network”.
  10. Right click on the tray icon for the VPN connection
  11. Click Properties
  12. Click Details
  13. Ensure that we are using MSCHAP v2 and MPPE 128
  14. Attempt to ping the LAN interface of the firewall.

Screen Shot 10-20-15 at 12.13 PM Screen Shot 10-20-15 at 12.14 PM 001 Screen Shot 10-20-15 at 12.14 PM 002 Screen Shot 10-20-15 at 12.14 PM 003 Screen Shot 10-20-15 at 12.14 PM 004 Screen Shot 10-20-15 at 12.14 PM Screen Shot 10-20-15 at 12.15 PM 001 Screen Shot 10-20-15 at 12.15 PM


1 thought on “Creating PPTP on Pfsense 2.2.4”

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.