PPTP VPN client is configured

What the audit found

Your configuration has at least one PPTP client interface under PPP → Interface. This means the router itself dials out to a remote PPTP server — typically a head office, a partner network, or a VPN provider — and carries traffic through that tunnel.

The audit rates this medium. The router is not exposing a service here; the problem is the quality of the tunnel it uses. It is reported whenever a PPTP client interface exists, whether or not it is currently connected.

Why it matters

PPTP was designed in the 1990s. Its authentication (MS-CHAPv2) and its encryption (MPPE) are tied together in a way that turned out to be a fatal weakness: in 2012 it was shown that the MS-CHAPv2 exchange can be cracked with certainty, not merely guessed, using modest computing resources. Since then, the practical situation has been this: anyone who records a PPTP session — an ISP hop, a compromised router along the path, someone on the same WiFi — can recover the password and decrypt everything that went through the tunnel. There is no configuration setting that fixes it. Microsoft, MikroTik's own documentation and every major VPN provider have recommended against PPTP for over a decade.

What that means for a router-to-router tunnel: the traffic between your sites — file transfers, database queries, printer jobs, management sessions to internal devices — is only as private as the wire. And the password recovered from the tunnel is a valid login on the remote VPN server, so an attacker can also connect there in your router's place.

If the far end is your own MikroTik, you control both sides and can switch protocols at your convenience. If the far end is a third party that offers only PPTP, that is worth raising with them.

What it looks like in Winbox

Open PPP → Interface. A PPTP client appears as a row of type PPTP Client with the remote server address in Connect To and the account in User. The Status tab shows whether it is currently up. Double-click it to see the profile and the Allow list of authentication methods.

How to fix it

Replace the tunnel with a modern protocol. The best choice depends on what the other end supports. WireGuard (RouterOS 7, both ends) is fast, simple and key-based — the usual pick when both sides are MikroTik or any modern system. IKEv2/IPsec is widely supported, including by most firewalls and cloud providers, with certificate or pre-shared-key authentication. SSTP is TLS-based and useful when the path only allows HTTPS-like traffic.

The principle of the switch is the same whichever you choose: build the new tunnel interface under WireGuard or PPP → Interface, give it an address in a small transfer subnet, tell it which remote networks are reachable through it, and add a route for the remote LAN pointing at the new interface. The far end needs a matching entry — for WireGuard, a peer with this router's public key. Bring the new tunnel up alongside the old one, move the routes across, confirm traffic flows, and only then remove the PPTP client interface.

If the tunnel carries your own management traffic to the remote site, do the switch with Safe Mode on and keep an independent way to reach both routers, so that a route pointing at a tunnel that is not yet up cannot strand you.

Afterwards, check that the new interface shows running, that the routing table sends the remote networks through it, and that a ping to a host on the far side succeeds; confirm no PPTP client interface remains under PPP → Interface. Then re-run the audit; the finding should disappear.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

The remote end only offers PPTP. What are my options?

Ask them to enable IKEv2, SSTP or WireGuard; all are built into RouterOS and most commercial firewalls. If they cannot, treat everything sent through the tunnel as if it went over the open internet — use HTTPS, SSH and other encrypted protocols inside it, and change the PPTP password to something long and random so it at least resists guessing.

The connection is disabled or has not been used for years. Does it still count?

The audit reports it as long as the interface exists. If it is no longer needed, removing it is the cleanest fix and removes a stored password from the configuration as well.

Does a strong password make PPTP safe?

No. The weakness is in the protocol, not the password; a captured session can be decrypted regardless of password length. A strong password only stops online guessing against the server.