The Point-to-Point Tunneling Protocol (PPTP) is a VPN protocol used to secure the connection between your device and a VPN server. One of the oldest VPN protocols, PPTP is plagued by multiple security issues and is now considered obsolete.

Despite this, its broad compatibility with a huge range of legacy software and hardware, its ease of setup, its lightweight nature, plus the high cost for businesses to upgrade their old PPTP corporate intranet VPN systems, means that in 2021 the protocol remains in widespread use.

What is a VPN protocol?

The VPN protocol is a mix of transmission protocols and encryption standards that establish a secure connection between your device and a VPN server, and encrypts data as it travels between them. 

A VPN protocol should provide three things:

  • Authentication – prevents unauthorized users from connecting to the VPN server
  • Confidentially – using encryption to ensure that no one can access (“sniff”) the contents of data packets sent over the VPN network
  • Integrity – detects if transmitted data has been tampered with in any way

VPN protocols used today include:

  • PPTP
  • L2TP/IPsec
  • IKEv2 (/IPsec)
  • OpenVPN
  • WireGuard®
  • SSTP
  • SoftEther
  • Cisco AnyConnect (and its open-source variant OpenConnect) – these protocols are used almost exclusively by corporate VPN intranets, not by commercial VPN services, such as Proton VPN.

Learn more about VPN protocols(new window)

Learn more about WireGuard(new window)

What is PPTP VPN?

History

Developed by a consortium founded by Microsoft, the specification for PPTP was designed for creating VPN connections over dial-up networks and was published in 1999. Microsoft quickly added PPTP support to Windows 95, with the result that it quickly became the default VPN protocol for corporate intranets everywhere.  

Support

Over the last 20+ years, support for PPTP has been built-in to almost every VPN-capable platform, and it continues to be natively supported by Windows 11, Android 12, most Linux distros, and the vast majority of VPN-capable routers.

Apple, however, removed(new window) support for PPTP from iOS 10+ and macOS 10.12 Sierra in 2018, and recommended against its use on older versions of its operating systems.

Recent versions of Chrome OS do not support PPTP directly, but it is possible to configure PPTP connections using the Android subsystem on Chromebooks that support the Google Play Store. 

How it works

PPTP is a tunneling protocol(new window), not, in itself, a complete VPN protocol. Encryption and authentication are handled by the Point-to-Point Protocol(new window) (PPP), but PPP includes no routing mechanism to direct packets to their destination.

PPTP establishes a TCP connection to the VPN server over port 1723, repackaging the PPP IP packets using Generic Routing Encapsulation(new window) (GRE). These packets are encrypted with Microsoft Point-to-Point Encryption(new window) (MPPE), which uses an RSA RC4 stream cipher(new window) with a maximum key size of 128-bits. 

Authentication is usually achieved using the MS-CHAP (now v2) protocol. (It is possible(new window) to use the more secure AEP-TLS, but this involves implementing a server certificate system, which largely negates the advantages of using PPTP in the first place.)

Speed

PPTP is a very simple and lightweight VPN protocol. This makes for good speed performance (especially on devices with low processing power), and good battery life on mobile devices. This is especially true when compared to the much more secure (but also more cumbersome) OpenVPN protocol. 

Security

PPTP is known to have numerous critical security issues. One the most serious of these is the possibility of un-encapsulated MS-CHAP v2 authentication, which can allow an attacker to exploit cryptographic weaknesses to obtain user credentials.

Using this exploit, tools first released by crypto-legend Moxie Marlinspike in 2012 allow PPTP to be cracked in under a day(new window). This flaw led Microsoft itself to recommend(new window) using L2TP/IP, IKEv2, IPsec, or SSTP instead. 

In 2019, Microsoft also issued an “Applicability Statement(new window)”, noting that the authentication method used by MS-CHAP v2 is susceptible to dictionary attacks(new window). To make matters worse, the RC4 cipher used by PPTP to encrypt data is vulnerable to bit-flipping attacks(new window).

It therefore came as very little surprise when, in 2014, Der Spiegel (new window)released documents obtained from whistleblower Edward Snowden that confirmed the United States’ NSA has little problem accessing data secured using PPTP. 

Top secret slide obtained from Edward Snowden detailing how the NSA easily breaks PPTP encryption

Resistance to censorship

PPTP uses TCP port 1723, and packets encapsulated by GRE use IP protocol number(new window) 47, both of which are trivial to block using a firewall. 

Summary

PPTP is not a secure VPN protocol, and should never be used in any situation where security is a factor.

Its ease of use, lightweight nature, and almost ubiquitous support mean that it can still be useful in situations where security is not an issue. For example, use cases include when you need to overcome IPS throttling, unblock geo-restricted websites, and stream Netflix content that you’ve subscribed to while traveling abroad.

However, at Proton VPN we believe this obsolete protocol’s security weaknesses make it unfit for purpose, and that it is irresponsible for modern commercial VPN services to provide PPTP as an option to their users.

At Proton VPN we only offer cryptographically secure VPN protocols implemented at their highest security settings. These protocols are:

  • OpenVPN 
  • IKEv2
  • WireGuard

Frequently asked questions

What port does PPTP use?

PPT uses TCP port 1723.

What is PPTP passthrough?

All routers use Network Address Translation (NAT) to map incoming and outgoing connections to local devices that are connected to them. However, not all routers understand what to do with packets that have been encrypted using older VPN protocols, such as PPTP, IPSec, and L2TP. 

To handle traffic that uses these VPN protocols, a router must support VPN passthrough. If it doesn’t, the VPN traffic will be blocked by the router. A PPTP passthrough replaces the basic GRE protocol used by PPTP with an enhanced version that includes a call ID it can use to identify PPTP clients and correctly route their packets. 

Most modern routers include a VPN passthrough that can handle all the common VPN protocols that are affected by this issue (including PPTP). In addition to this, modern VPN protocols, such as OpenVPN, IKEv2, and Wireguard are not affected by this issue as they have been designed to address it. 

Do I need a PPTP client?

Most VPN-capable devices and operating systems include a native PPTP VPN client. A major exception is Apple devices, which no longer support PPTP. This is a good move on Apple’s part because more modern VPN protocols can do everything PPTP does while also being much more secure. 

Protect your privacy and security online
Get Proton VPN free

Related articles

VPN on mobile device
Growing public awareness about the threat posed to our fundamental right to privacy by online trackers has fueled a surge in VPN adoption, a trend that has been boosted thanks to people spending more time online due to the Covid-19 pandemic. Althoug
Tor over VPN
  • Privacy deep dives
Tor is a powerful privacy tool, but you may not want to use Tor all by itself. Learn why you may want to connect to Tor over a VPN. When you connect to the Internet, especially if you’re using public WiFi, there’s a good chance people are watching y
Smart TV privacy
Smart TVs are essentially televisions that can watch you. Their surge in popularity, along with smart speakers, means corporations (and anyone that can hack these devices) have another window through which they can view your private activity. The dat
Expats should use a VPN
Living abroad can be an adventure, but it also presents unique online privacy obstacles. A VPN can help expats stay in touch with their family and avoid Internet censorship. In the age of the “digital nomad” more and more people are moving abroad. L
The internet is full of information, but some of it is inappropriate, especially for kids and sensitive adults. SafeSearch can help filter out this content to make browsing safer and improve your children’s privacy online. This article explains how
IP whitelisting best practices
IP whitelisting is a security mechanism that restricts access to networks, systems, or applications based on approved IP addresses. Only IP addresses on the whitelist are permitted to connect, while all others are denied access. This method is typica