PPTP Server Configuration

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 02:32, 23 October 2009 (edit)
Disk Crasher (Talk | contribs)
(Broadcast to VPN Clients)
← Previous diff
Revision as of 00:15, 27 October 2009 (edit) (undo)
Masterman (Talk | contribs)
(Broadcast to VPN Clients)
Next diff →
Line 206: Line 206:
[[Category:English documentation]] [[Category:English documentation]]
[[Category:Advanced tutorials]] [[Category:Advanced tutorials]]
 +See Also:

Revision as of 00:15, 27 October 2009

A PPTP Server (Point-To-Point Tunneling Protocol) allows you to connect securely from a remote location (such as your home) to an LAN (Local Area Network) located in another location, such as your workplace, business office, etc. This way you can use the services provided in your office at the comfort of your home.

It should be noted that PPTP has some security flaws and is considered deprecated. See PPTP Security

For an alternative, see OpenVPN



Tested using version DD-WRT 2.3 "VOIP" on WRT54GS router

  1. Make sure you have flashed the "RIGHT" firmware to your router.
  2. Goto the Web Administration and goto the "ADMINISTRATION" Tab, and the "SERVICES" sub-tab.
  3. Go down and you will see "PPTP Server". This option is disabled by default, so to setup PPTP, you click "ENABLE". (In v24 and higher PPTP is a sub-tab in the Services main tab.)
  4. (In newer versions, this step may be skipped because the options are automatically shown when you click.) Click enable and then click "Save Settings"). After you see the message "Settings Are Successful" click "Continue"
  5. While still in the "SERVICES" sub-tab, complete the options you need. Descriptions of options can be found below.
  6. Finally, go down, Save Settings, and then click on "REBOOT ROUTER", this step is very important, no mather what you have configured, if you dont reboot router, settings will not work.
  7. Once you have completed the data input go down an click on "Save Settings" to save changes, now on the page "Settings Are Succesfull" click on "Continue" and again on "SERVICES" tab, where you doublecheck the values of your PPTP server.

NOTE: After you have done this, only computers the Windows Operating System will be able to connect through the WAN port of the router. Many other operating systems will not work and trying to connect from a LAN port will not work.

Any questions can be posted on the forums or go to www.facebook.com, log in, search for "Marcelo Semino" (Public Figure), Became a fan of me, an then I will help you with your VPN problem for free.


If you are using MacOSX, you may experience problems while connecting to the DD-WRT PPTP server; this is due to the server having encryption as optional, while Mac OS X requires it when encryption is chosen.

Your options are to either:

  • Client (Mac OS X): Set encryption to None.
  • Server (your router): Force encryption.

Force Encryption

The default installation makes encryption optional, you can changed this to required (a must to allow encrypted connections from MacOS X-users) by:

In the DD-WRT Web Interface, goto Administration > Commands. Paste the following line in the commands area; and then press Run Commands:

sed -i -e 's/mppe .*/mppe required,stateless/' /tmp/pptpd/options.pptpd

Congratulations, you've just rewritten the options.pptpd-file in place; and should now have a working PPTP-server to connect to with your Mac (as well as other systems, as long as they can handle encryption).

If you prefer to keep track of what's going on (or need/want to experiment with rewriting files) this will take you through the process step by step, and introduce you to some other very basic tools available:

First of all, let's take a look at the original file:

cat /tmp/pptpd/options.pptpd

If we mess up the file we could just reboot the router to get the original back, but to speed things up we're going to make a copy of it on the router:

cp /tmp/pptpd/options.pptpd /tmp/pptpd/options.pptpd~

Now let's do the rewriting:

sed -i -e 's/mppe .*/mppe required,stateless/' /tmp/pptpd/options.pptpd

So what do we do if we when checking the file (using cat, like above) notices that we've ruined it, or we were cautious enough to work on the backup instead of the original?!

Replace the "live" file with the backup by either "moving" it (leaving no backup), or copying it (leaving the backup just as it its:

mv /tmp/pptpd/options.pptpd~ /tmp/pptpd/options.pptpd
cp /tmp/pptpd/options.pptpd~ /tmp/pptpd/options.pptpd

Learn how to automagically reapply your changes at startup by reading: Startup Scripts.

// This guide was written for the dd-wrt.com/wiki by Svanstrom @ 18:56, 16 October 2007 (CEST). //

For those looking for the the earlier version of this guide: It used echo to add a line to the end of options.pptpd; and then used that, along with sleep, in the startup script:

echo 'mppe required,no40,no56,stateless' >> /tmp/pptpd/options.pptpd
sleep 30
echo 'mppe required,no40,no56,stateless' >> /tmp/pptpd/options.pptpd


PPTP Server

Enables or Disables the Service.

Server IP

Your LAN IP Address. (An IP from your network that is not used by any computer or the router).


Update: The internal IP of your router works just fine with firmware DD-WRT v23 SP2 (09/15/06) vpn. My router's internal address is and I used the same to fill in the "Server IP" field of the PPTP Server Configuration. --psiborg 20:49, 6 May 2007 (CEST)

Update: The IP of your router may work but if you use it, the Webinterface gets unreachable (tested on WRT54GS V2 with DD-WRT v23 SP2) --Xstream 21:31, 30 March 2008 (CEST)

Update: With firmware DD-WRT v24 SP1 on WRT54GL the router's LAN or WAN static address may be used without disturbing the Web interface. Furthermore, if an address of is entered, then the PPTP server will track the router's WAN address, allowing DDNS to be used. 10 September 2008

Client IP(s)

The client IP range. IPs in this range are given clients trying to connect. Should be a valid IP Address on the LAN segment of the network.



The Username and Passwords used by to login to the PPTP server are configured here. Pay close attention to the use of spaces and asterisks between usernames and passwords, authentication will not work without them.

General Syntax:

 Username * Password *
 (username_to_use,blank space,asterisk,blank space,password_to_use,blank space,asterisk)


marcelo * semino *
eduardo * crea *

The above will create two accounts: 'marcelo' and '"eduardo"' with the passwords '"semino"' and '"crea"' respectively.

WARNING: Do NOT forget the spaces between asterisk and usernames/passwords. If you omit them it will not work.


Windows XP & Internet Connection

If using the VPN connection software built into Windows XP, you might find that your internet connection will die once the vpn connection is established. This is a result of the default settings for Windows XP VPN connections.

See: Use the Local Default Gateway


In order to get this to work it's essential to disable "loopback" otherwise it doesn't work (loopback was enabled as default in my firmware version (v.23 std)! Note: Using V23SP1-VOIP 6/5/06, PPTP Server was verified working even with "loopback" enabled (pagedude 6/25/06) Also works with v23 SP2 and v24 beta

Special Characters

Check passwords (chap-secrets file) for special characters ( # - Character in password breaks pptp). The admin password of the router is inserted into chap-secrets by default! --Krikkit 12:12, 7 Mar 2006 (CET)

Outgoing PPTP Connections

Another issue in v.23 is that outgoing pptp-trafic cannot pass-through the router with pptp-server enabled. There is a fairly complicated fix for this issue in the dd-wrt forum. [edit]


DMZ must be DISABLED in order to work --ptodic 21:36, 8 Mar 2006 (CET)

Update: Actually, DMZ does NOT need to be disabled. Better solution is going to Application & Gaming - Port Forwarding and adding a new line:

app: whatever name you want
port from: 1723
protocol: tcp
ip address: LAN IP of the router (default
port to: 1723
enable: checked
--curlyboi 19:20, 6 Jan 2007 (CET)


If you're unable to connect to the PPTP server or can occasionally but not for more than a few minutes at a time, and you use a WAN device that does PPPoE onboard (Like a SpeedStream 5100b DSL Modem) -- You may have to disable the onboard PPPoE and use the PPPoE on the WRT54G. The GRE that's needed for PPTP sometimes gets messed up by your WAN device, probably because it uses a buggy layer 3 stack that corrupts or doesn't pass the GRE packets to your WRT.

You may also have disconnects if the actual network that the client is on is the same subnet that the server is on (e.g. client subnet is and the DD-WRT server subnet is This causes IP collisions. The best solution is to change the subnet of the server or client network to something unique, such as (i.e. an IP range of with a netmask of

Two DD-WRT Boxes

If PPTP-connection between two dd-wrt boxes fail with error message "IPCP terminated by peer (Unauthorized remote IP address)" you need "noipdefault" option at client side. You can add pptpd.conf options through WEB gui using MPPE Encryption field. In this case set "MPPE Encryption" as "noipdefault mppe required". --Veekoo 12:51, 15 Aug 2006 (CEST)

Also see [1] for instructions on how to connect two or more DD-WRT routers via PPTP. --Disk Crasher 08:58, 18 October 2009 (CEST)

DNS Issues

Your client may not get the correct DNS setting. To correct this do the following.

To permanently set the WINS/DNS values for the PPTP server that assigned to the client, you can set/commit the following nvram params:


  nvram set pptpd_dns1=ip-address-of-first-dns-server 
  nvram set pptpd_dns2=ip-address-of-second-dns-server 
  nvram set pptpd_wins1=ip-address-of-first-wins-server 
  nvram set pptpd_wins2=ip-address-of-second-wins-server 


To have the PPTP server give out a wins/netBios address of "", you would type the following in a SSH/telnet session into the router:


  nvram set pptpd_wins1= 
  nvram commit 


To have the PPTP server give out a DNS address of "", you would type the following in a SSH/telnet session into the router:


  nvram set pptpd_dns1= 
  nvram commit 

Broadcast to VPN Clients

From: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=4786

Issue: How to get broadcast IP belonging one subnet to additionally broadcast on an another subnet? The answer is routing.

For example, say you're hosting a multiplayer game like Warcraft 3 that utilieses the broadcast IP of the underlying subnetmask the host computer is running on. When you do a cmd -> ipconfig on the hosting computer, you'd most likely see that the subnetmask on your local area connection is If you do the same on a client computer connected to the PPTP server, you'd see that the subnetmask of the VPN connection differs from the local area connection. Local area connection at subnetmask and VPN connection at This means that the VPN connection is on a different subnet.

So the PPTP server uses subnetmask and your game is hosting on subnet Because of this, the VPN connection will never receive the messages broadcasted from the broadcasting IP on the other subnet. Thats why the clients can't find the host on games that uses broadcast IP to announce their presence.

Let's say your router IP is You have setup PPTP server to accept 10 VPN connections in the range of (Use outside DHCP range!). In a subnet with subnetmask you have a total of 254 IP-addresses available. ( - 255 is reserved for broadcasting on the respective subnet. Only difference is that as mentioned, the IP addresses that is reserved for the PPTP server are on a different subnetmask, thus another subnet.

To add a static route to send Broadcast packets to the remote network, do the following:

  1. Open the DD-WRT web configuration
  2. Select Basic Setup -> Advanced Routing
  3. Change the following settings.
 In Dest. LAN IP:
 Subnetmask :
 Gateway :
 Interface : LAN/WLAN

Now we have created a static route that routes a connection between those subnets.

v24 SP1 vpn note: The above route appears to get created automatically when setting up a PPTP connection (verified by typing "route" in the CLI). However, broadcast packets do not route, even if a static route is also added to The SP2 build has an option to enable bcrelay but that too doesn't appear to be working at this time. --Disk Crasher 04:32, 23 October 2009 (CEST)

See Also: