PPTP VPN server is enabled: a VPN that has been broken since 2012
PPTP was the easy VPN of the early 2000s. Its authentication and encryption were shown to be breakable in 2012, so a captured session can be decrypted and the password recovered. Here is how to replace it.
/interface pptp-server server
What the audit found
The PPTP server on your router is enabled. PPTP is a VPN protocol from the late 1990s that uses MS-CHAPv2 for authentication and MPPE for encryption. Both have been publicly broken since 2012: anyone who records a PPTP session can decrypt it and recover the user's password with modest computing effort.
The audit reports this as high whenever the server is switched on, regardless of firewall settings, because a VPN that does not keep secrets is worse than no VPN — people trust it with traffic they would otherwise protect differently.
Why it matters
Picture a remote worker connecting to the office through PPTP from a hotel network or public WiFi. Anyone on that network — or anyone between them and your router — can capture the handshake. In 2012 it was demonstrated that MS-CHAPv2 reduces to a single DES key search, which cloud services could crack in under a day at the time and hardware today does far faster. With the recovered key the attacker decrypts the whole session, and because MS-CHAPv2 uses the account password, they now also hold a valid VPN login.
That login typically lands inside your LAN, past the firewall. PPTP passwords on MikroTik are often PPP secrets shared with other services, and are rarely rotated.
A second, quieter problem: the PPTP server listens on TCP 1723 and the GRE protocol, both of which appear in scans. Its presence tells an attacker the router is old-fashioned and probably has other legacy settings. There is no way to configure PPTP securely; the only fix is to stop using it.
What it looks like in Winbox
Open PPP → Interface and click the PPTP Server button in the toolbar. If the Enabled box is ticked, the server is running. The same window shows the authentication methods and MPPE settings, but none of the options changes the conclusion. Active client sessions appear under PPP → Active Connections with type pptp, and PPP → Secrets lists the accounts that can log in through it.
How to fix it
First set up a replacement so nobody loses access, then switch PPTP off. Doing it in that order is what keeps remote users working through the change.
On RouterOS 7, WireGuard is the simplest replacement. It consists of a WireGuard interface with a listening port, an address for the tunnel subnet, one peer entry per user carrying that user's public key and allowed address, and an accept rule in the input chain for the WireGuard UDP port — placed above your final drop rule, or the tunnel never comes up. Each client gets a small configuration with the router's public key and endpoint. If you must stay on RouterOS 6, IKEv2 with certificates or L2TP with use-ipsec set to required are the acceptable alternatives.
Once the new tunnel has been tested with every user, untick Enabled in the PPTP Server window. Then remove any input rules that accepted TCP 1723 or GRE, and change the passwords of the PPP secrets that were ever used over PPTP — they must be treated as potentially captured. If you cannot migrate everyone at once, at least restrict the PPTP port in the firewall to the source addresses of known users. Use Safe Mode for the firewall edits, so a wrong rule cannot cut off your own session.
Afterwards, a connection attempt to TCP port 1723 on your public IP from outside should be refused or time out, and PPP → Active Connections should list only the new tunnel type. Confirm that every remote user can connect over the new tunnel, then re-run the audit; the finding disappears once the server is disabled.
The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.
FAQ
My users are on Windows and PPTP "just works" there. Does WireGuard?
Yes. WireGuard has official clients for Windows, macOS, iOS, Android and Linux, and importing a config file or scanning a QR code is quicker than setting up PPTP by hand. IKEv2 is also built into Windows, macOS and iOS if you prefer certificate-based access without a third-party client.
Can I keep PPTP if I only allow it from a few fixed IP addresses?
That reduces the number of people who can reach the port, but not the underlying weakness: the session between those addresses and your router can still be captured and decrypted anywhere along the path. Treat address restriction as a temporary measure while you migrate, not as a fix.
Is disabling the server enough, or do I need to remove the PPP secrets too?
Disabling the server stops PPTP logins immediately. Keep the secrets if the same accounts are used for L2TP/IPsec or SSTP, but change their passwords. If a secret was only ever used for PPTP, remove it — fewer valid credentials is always better.
This article explains the finding in general terms. Test any configuration change with Safe Mode enabled in Winbox. MKRouterKit analyses configuration exports only; it does not replace an external port scan or a professional penetration test.