PPTP and SSTP Tunnels for Remote Networks

What it is

A tunnel carries private traffic across an untrusted network, such as the Internet, as if the two ends shared a cable.

RouterOS supports several tunnel types, and this page covers two.

PPTP is simple and widely supported. SSTP carries PPP inside an encrypted TLS connection.

Both are PPP based, so they use the same PPP secrets and profiles as PPPoE. The difference is the transport that carries the PPP session between the two ends.

How it works

The server accepts logins, the client connects with a name and password, and a PPP interface appears at each end.

The common pieces

A PPP tunnel needs the same three pieces as other PPP services.

• A PPP secret on the server with the user name, the password and the service.
• A PPP profile with the local and remote addresses of the tunnel.
• A route so that each side knows about the network behind the other.

/ppp secret add name=branch1 password=Str0ngPass service=any profile=default-encryption local-address=10.77.0.1 remote-address=10.77.0.2

The two tunnel addresses are the point-to-point addresses of the link. To reach the LAN behind the client, add a static route on the server that uses the client tunnel address as the gateway, and a route on the client that does the same in the other direction.

PPTP server

The PPTP server is switched on in its own menu.

/interface pptp-server server set enabled=yes

PPTP uses a TCP connection on port 1723 together with the GRE protocol for the tunnel traffic. A firewall in front of the server must therefore allow both. On a router with a drop rule in the input chain, add allow rules first.

/ip firewall filter add chain=input protocol=tcp dst-port=1723 action=accept
/ip firewall filter add chain=input protocol=gre action=accept

A dynamic interface appears for each client that connects, as with other PPP servers.

Quick Set and VPN access

Quick Set contains a VPN access option for a home style setup. Switching it on enables a VPN server on the router, so that you can reach the home network remotely.

The exact protocol that Quick Set enables depends on the version, so check which one your version turns on before you rely on it. Quick Set only writes ordinary configuration, so you can look at the result in the normal menus.

PPTP client

The client connects to the server address with a user name and password.

/interface pptp-client add name=pptp-out1 connect-to=203.0.113.10 user=branch1 password=Str0ngPass disabled=no

Check the tunnel on both sides.

/interface pptp-client print
/ppp active print

SSTP

SSTP carries the PPP session inside a TLS connection on a TCP port, which is normally the same one that HTTPS uses. Because it looks like ordinary secure web traffic, it passes through most firewalls and proxies. Encryption comes from TLS, which is stronger than the PPTP encryption.

The SSTP server normally uses a certificate. The client can check this certificate to make sure it talks to the right server.

/interface sstp-client add name=sstp-out1 connect-to=203.0.113.10 user=branch1 password=Str0ngPass verify-server-certificate=yes disabled=no

The verify-server-certificate setting makes the client check the certificate. Turning it off removes that protection, so use it only for a short test.

The client then has a PPP interface called sstp-out1, with the addresses taken from the server profile.

PPTP and SSTP compared

Choose SSTP when the path crosses strict firewalls, or when security matters. PPTP is simple, but it is a legacy choice.

Routing across the tunnel

A tunnel connects two addresses. For the LANs behind each end to talk, add routes.

# On the server
/ip route add dst-address=192.168.50.0/24 gateway=10.77.0.2
# On the client
/ip route add dst-address=192.168.1.0/24 gateway=10.77.0.1

Both LANs must use different subnets. Also check that the firewall of each router allows the forwarded traffic through the tunnel interface.