next »

[eweri]

Hello!

I know that there is a problem with pfsense when I try to start a pptp-session form the LAN through to a pptp-server in the internet when the pptp-server in the pfsense is activated. For me this is a real showstopper because i am doing a lot of remote administration and every time I have to switch off the pptp-service to get pptp to my external customers running. If I forget to switch it on after the session I can not get into our LAN when I am outside my firm.

Does 1.2.2 , 1.2.3 or 2.0 fix this? Otherwise I have to switch to another router-os in the future.

Bye,
Christoph

[blak111]

I'm not sure if this is fixed, but if you are the only one that connects to your pfSense you could switch to OpenVPN to mitigate the problem.

[eweri]

Just to let everybody know:

I am running pfsense 1.2.3 embedded with an active pptp-server and if I try to connect to a pptp-server at WAN interface with my pptp-client at LAN interface it still does not work. If I switch off the pptp-server I could connect to the outside pptp-server.

Is there a workaround? Maybe I need a firewall rule?

Bye,
eweri

[rpsmith]

as far as I know, this is a known PPTP limitation of all versions of pfsense.  there has been some talk of this possibly being fixed in 2.0 but I have not heard whether or not they have been able to resolve this.

Roy...

[jimp]

It's still an issue as far as I know.

If you are doing remote administration from your router, shut off your PPTP server and switch your own personal VPN to OpenVPN or IPsec instead. PPTP may be easy, but it's quite insecure and you're better off familiarizing yourself with the more secure alternatives where possible.

Or, if you have multiple static IPs, you can NAT the outbound PPTP traffic to a second IP. I made a package called onatproto a long time ago which adds a protocol filter for outbound NAT which makes matching PPTP traffic much easier.

[netphreak]

I realize it's probably difficult to make a fix to this issue (since it's not fixed ages ago) - but I will like to point out that this is a major issue which should get high priority. I find it really strange that this limitation isn't mentioned directly into the webgui - which would at least save a lot of users the hassle of trying that road.

Or at least make this issue a sticky in here?

[jimp]

It's mentioned on the main web site, in the book, and the doc wiki/FAQ. A sticky might be overkill at this point.

[rpsmith]

a GUI note and sticky would be good.  a fix would be awesome.

Roy...

[netphreak]

It's mentioned on the main web site, in the book, and the doc wiki/FAQ. A sticky might be overkill at this point.

I realize that it's not exactly good commercial to have this as a sticky or a GUI notice - but still - from all the posts regarding this, it seems quite clear that "everyone" goes in the same trap. After banging the head against the wall for some time, we end up asking here.

[jimp]

I put a sticky topic up with links to FAQ entries, but no details -- details really belong in the docs, not a sticky.

http://forum.pfsense.org/index.php/topic,22861

[rpsmith]

Thanks!  that should help.

Roy...

[GraKez]

I have multiple Static (external) IPs, if only I could get the PPTP server to attach to the secondary IP, then all other traffic (including VPN passthru) could function as normal via NAT off the primary IP. Surely this would be easier than creating rules to redirect the passthru VPNs around the PPTP server?

It seems so simple,  but I don't know how to change the IP that the PPTP server listens to . . .

Can anyone help?