PPTP and L2TP · Topic 1 of 3
PPTP and L2TP Theory and Comparison
Compare PPTP and L2TP tunnels on RouterOS: ports and protocols, how each encrypts traffic, and when to choose L2TP with IPsec instead of plain PPTP.
- 4 min
- Includes a diagram
- PPTP uses TCP port 1723 for control and GRE for data.
- GRE is IP protocol 47, so a firewall must allow it for PPTP.
- PPTP encrypts with MPPE and needs MS-CHAP authentication for the keys.
What it is
PPTP and L2TP are two tunnelling protocols that carry PPP sessions across an IP network.
A tunnel lets a remote user or a branch router join a private network over the internet. The client wraps its PPP traffic inside packets that the internet can carry, and the server unwraps them.
Both protocols use the same PPP profiles and secrets. They differ in how they carry the traffic and in how they protect it.
How it works
Each protocol builds a control connection and a data path, and each handles encryption differently.
PPTP
PPTP uses a TCP connection on port 1723 for control. The tunnelled data travels in GRE packets, which are IP protocol 47.
PPTP encrypts with MPPE, which is controlled by the PPP profile setting use-encryption. MPPE keys come from MS-CHAP authentication, so encryption needs mschap1 or mschap2.
The protocol is old and is regarded as weak, so it is better for convenience than for strong security.
L2TP
L2TP uses UDP port 1701 for both control and data. On its own it does not encrypt anything.
To protect the data, L2TP is paired with IPsec. RouterOS can set this up with use-ipsec on the server and the client. IPsec then uses UDP ports 500 and 4500, and ESP.
Comparison
| Feature | PPTP | L2TP |
|---|---|---|
| Control transport | TCP port 1723 | UDP port 1701 |
| Data transport | GRE, IP protocol 47 | UDP port 1701 |
| Built in encryption | MPPE | None |
| Strong protection | Weak | Good when paired with IPsec |
| NAT friendliness | Needs GRE to pass | Plain UDP, easy to pass |
| Setup effort | Low | Higher with IPsec |
Common ground
Both protocols work in the same way once a session is up. The server checks the secret, applies the profile, and creates a dynamic interface for the client.
The tunnel is a point to point link with two addresses. A client that must reach a LAN behind the server needs a route that points into the tunnel.
Firewall needs
A router that hosts a tunnel server must allow the control and data traffic in its input chain.
/ip firewall filter add chain=input protocol=tcp dst-port=1723 action=accept comment=pptp
/ip firewall filter add chain=input protocol=gre action=accept comment=pptp-gre
/ip firewall filter add chain=input protocol=udp dst-port=1701,500,4500 action=accept comment=l2tp-ipsec
/ip firewall filter add chain=input protocol=ipsec-esp action=accept comment=l2tp-ipsec-espThe first two rules serve PPTP. The last two serve L2TP with IPsec.
Choosing between them
Pick L2TP with IPsec when protection matters, or when the path crosses NAT devices that block GRE. Pick PPTP only for legacy clients that cannot do anything else.
Plain L2TP without IPsec is an unencrypted tunnel. It suits a trusted path or a case where another layer already encrypts the traffic.
What both share with other PPP services
PPTP and L2TP share the /ppp profile, /ppp secret and /ip pool objects with PPPoE, SSTP and OpenVPN. A change to a profile therefore affects every service that uses it.
What to remember for the exam
Seven facts cover most comparison questions.
- PPTP uses TCP port 1723 for control and GRE for data.
- GRE is IP protocol 47, so a firewall must allow it for PPTP.
- PPTP encrypts with MPPE and needs MS-CHAP authentication for the keys.
- L2TP uses UDP port 1701.
- L2TP has no encryption of its own and is paired with IPsec.
- L2TP with IPsec also needs UDP 500, UDP 4500 and ESP.
- Both protocols use PPP profiles and secrets.
A blocked PPTP tunnel usually means TCP 1723 is open but GRE is dropped.
Common mistakes
These four errors appear again and again.
Opening only the TCP port for PPTP. The control connection works, but the data cannot pass without GRE.
Assuming L2TP is encrypted. Without IPsec the traffic is sent in the clear.
Expecting encryption with PAP or CHAP. MPPE keys come from MS-CHAP, so other methods cannot give MPPE.
Forgetting the IPsec ports. L2TP with IPsec needs UDP 500, UDP 4500 and ESP, not only UDP 1701.
PPTP is considered weak. Do not use it for sensitive traffic when an alternative exists.
Check yourself
Work through these three questions.
Which ports and protocols does PPTP need?
PPTP uses TCP port 1723 for control and GRE, IP protocol 47, for data.
Why is plain L2TP not enough for a secure tunnel?
L2TP uses UDP port 1701 and has no encryption of its own. It is paired with IPsec for protection.
What drives MPPE encryption in PPTP?
The profile setting
use-encryptionturns it on, and the keys come from MS-CHAP authentication.
Topic 1 of 3 in PPTP and L2TP
Test yourself on PPTP and L2TP
The full MikroTik MTCUME question bank has 482 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.