Configure a PPTP VPN server with Ubuntu

Marcos Saiz

October 25, 2026 22:14
Updated

Security warning

The PPTP (Point-to-Point Tunneling Protocol) VPN protocol is considered obsolete and insecure due to known vulnerabilities in its authentication and encryption mechanisms.

Its use is not recommended in environments where security and information protection are important. Whenever possible, using more modern and secure alternatives such as OpenVPN, WireGuard or IPsec is recommended.

Clouding firewall configuration

To make our VPN work, we will create a firewall profile with the following rules:

Server requirements

To create the PPTP VPN, we will use a machine running Ubuntu 16.04 with 1 GB of RAM, 0,5 Core and 5 GB of disk space. When creating the server, it is important to select the firewall profile above.

Install dnsmasq

# apt-get install dnsmasq

We will create an empty configuration file (/etc/dnsmasq.conf) with the following content:

dhcp-range=10.254.254.100,10.254.254.200
dhcp-option=121,10.20.10.0/24,10.254.254.1,27.0.172.0/22,10.254.254.1,46.183.112.0/21,10.254.254.1,80.240.126.0/23,10.254.254.1,85.208.20.0/21,10.254.254.1,93.189.88.0/19,10.254.254.1,103.23.60.0/23,10.254.254.1,161.22.40.0/21,10.254.254.1,185.166.212.0/21,10.254.254.1,185.253.152.0/22,10.254.254.1,185.254.204.0/22,10.254.254.1,213.192.233.0/24,10.254.254.1,217.71.200.0/21,10.254.254.1
dhcp-option=249,10.20.10.0/24,10.254.254.1,27.0.172.0/22,10.254.254.1,46.183.112.0/21,10.254.254.1,80.240.126.0/23,10.254.254.1,85.208.20.0/21,10.254.254.1,93.189.88.0/19,10.254.254.1,103.23.60.0/23,10.254.254.1,161.22.40.0/21,10.254.254.1,185.166.212.0/21,10.254.254.1,185.253.152.0/22,10.254.254.1,185.254.204.0/22,10.254.254.1,213.192.233.0/24,10.254.254.1,217.71.200.0/21,10.254.254.1

The IP ranges 10.20.10.0/24 (private network) and 46.183.112.0/21 (public network) belong to Clouding. Any access to Clouding servers will use the VPN's IP address.
You can add as many ranges as you like.
We will start the service and configure it to start by default when the server restarts:

# service dnsmasq start
# update-rc.d dnsmasq enable

Install pptpd

# apt-get install pptpd

Now we will edit the configuration file to add the local IP address and the DHCP range to use. In “vi /etc/pptpd.conf”, add the following at the end:

localip 10.254.254.1
remoteip 10.254.254.200-250

We will specify the necessary options in “vi /etc/ppp/pptpd-options”. Add the following at the end:

ipcp-accept-local
ipcp-accept-remote
require-mschap-v2
ms-dns 8.8.8.8
proxyarp
connect-delay 5000

Here we can create all the users we want to access the VPN. In “vi /etc/ppp/chap-secrets”, add the following at the end:

userVPN * passVPN *

NOTE: Use strong passwords; this is an example.
We will start the service and configure it to start by default when the server restarts:

# service pptpd start
# update-rc.d pptpd enable

Finally, we will run:

# /sbin/sysctl -w net.ipv4.ip_forward=1
# /sbin/iptables -t nat -A POSTROUTING -s 10.254.254.0/24 -j MASQUERADE

We will also add the commands above to /etc/rc.local so they persist when we restart our server:

/sbin/sysctl -w net.ipv4.ip_forward=1
/sbin/iptables -t nat -A POSTROUTING -s 10.254.254.0/24 -j MASQUERADE

Configure a VPN in Windows

In the Windows Control Panel, we will type VPN in the search box, open “Cambiar redes privadas virtuales”, click “Agregar una conexión VPN” and fill in the fields with our details (IP address, username and password)

We will also change the settings so the VPN is used for all traffic. We will open “Cambiar opciones del adaptador” on the right, select the VPN adapter we created and go to “Propiedades”. On the “Funciones de red” tab, we will double-click Protocolo TCP/IPv4, go to “Opciones avanzadas” and disable “Usar la puerta de enlace predeterminada en la red remota”

We can now start using our VPN.

Configure a VPN in Android

To configure our VPN in Android, we will go to Ajustes, then más redes, open the VPN option and tap + to create a VPN.

Articles in this section