Any plans for future support PPTP connections?

[stojanon 0]

I wonder if you plan to add support for PPTP / L2TP in the future.

Thank you very much and Merry Christmas!

[michigan82 4]

i just wonder why you need pptp-support...? I can't see any advantage of pptp in comparison to openvpn... on the contrary, there is a big disadvantage of pptp as it was already hacked in conjunction with MSCHAPv2. It lacks security due to its layering. This issue is already known for many years. So you can be quite sure that pptp won't be introduced here on air.org.

@admin: An idea that I had: It could be interesting to offer proxies for all vpn-server. This could help to quickly change an IP without having to disconnect a vpn-server. This would be a nice additional layer. You could secure these proxies with usernames and passwords so that only members of air.org can use them... or allow to enter these proxies only from certain IPs so that you have to be connected to a vpn-server in order to use a proxy... or whatever. I think that this could be a nice feature for the future...

cheers,

Mich

[skxBMrYsxlli 9]

i just wonder why you need pptp-support...? I can't see any advantage of pptp in comparison to openvpn... on the contrary, there is a big disadvantage of pptp as it was already hacked in conjunction with MSCHAPv2.

PPTP in itself is not insecure; however, at least in Microsoft implementations, using it securely mandates EAP-TLS. I'm not sure that this buys you anything compared to OpenVPN. Better client support on Windows, I suppose.

On the other hand, the only allowed carrier protocol appears to be TCP. This is likely to kill speed.

L2TP is also not insecure as such, because it does not have any authentication or encryption on its own; it's merely an encapsulation / tunneling protocol. (Same as PPTP.) This buys you encapsulation of Layer 2 (hence the name), but it's probably not useful here, either. (L2TPv3 adds some trivial security, but it appears to have considerable weaknesses.)

Implementation of either would probably introduce notable overhead compared to OpenVPN. Even running L2TPv3 directly on IP, which is possible, still requires the extra overhead of an actual session security layer. (L2TP + IPSec is common.)

If there's really some call for a protocol besides OpenVPN, it seems to make more sense to consider IPSec; either as an IP alternative, or running on top of UDP. Or both.