Netopia - PPTP Setup (Router-to-Router)

This Netopia Quick Guide details configuration of a PPTP tunnel between two Netopia routers.

Please Note: If your router is currently running Netopia Residential Firmware with a web "GUI" configuration menu, this technote is not applicable to you. Most 3300 Series Netopia Gateways can be upgraded to Enterprise level firmware. Click Here! to purchase the upgrade key.

Related documents: NQG_053 IPSec Router to Router

Firmware References:

v8.2 R1 (and up) - 3300 Enterprise Series
v5.3.7 (and up) - 4000 Series
v4.8.2 (and up) - R-Series

Before You Start

PLEASE READ our Notice on Configuring VPN Tunnels with Netopia Routers.

Telnet into the Netopia router's Main Menu at 192.168.1.1 (if using the default IP setting). If your network has a different IP addressing scheme, modify this accordingly. Click Here! for instructions on using telnet and Hyperterminal (serial connection).

Login with the user name and password. The Superuser login is required to save changes. If you are unsure of this, contact your network administrator.

Don't forget to press the Enter key to save any entries. Hitting the back space, delete or tab without first hitting enter will undo any changes.

The Esc key will take you back towards the main menu screen.

Once you have completed your configuration, you should reboot the Netopia to save and apply your changes.

The Netopia Main Menu Interface

Notice:

This document is provided to you as an added service by Netopia Technical Support. Although the configurations described below have proven successful in many instances for doing Microsoft Networking across a WAN or VPN connection, we cannot guarantee success in all circumstances due to the many variables and unpredictable behavior common to Windows OS. If the following suggestions do not provide the results you desire, please contact your MIS Department, or Microsoft Technical Support directly as Netopia cannot further support the features of Windows OS.

Network Example

The following example configuration is based on two Netopia routers with connections to the Internet using NAT (Network Address Translation). It is not necessary for you to have NAT enabled on your Internet connection profile for this to work. The Local WAN IP addresses used in the configuration are for illustrative purposes only.

(Note: The Ethernet IP Addresses used in this example can be implemented in other similar configurations. However, the Local WAN IP Addresses will change per individual configuration. The following router configurations are based on the following example configurations. Please substitute your own IP information when configuring your routers. In any case, both routers must be configured for different Ethernet IP subnets, as the example configuration illustrates.)

Netopia Router A		Netopia Router B
Ethernet IP Address:	192.168.1.1	Ethernet IP Address:	192.168.2.1
Ethernet Subnet Mask:	255.255.255.0	Ethernet Subnet Mask:	255.255.255.0
Local WAN IP Address:	172.20.16.1	Local WAN IP Address:	172.20.17.1

Router A Configuration

From the Main Menu of router console screens, go to Quick Menus, and select Add Connection Profile.
Under Profile Name, type Router B (or a name of your choice).
Change Data Link Encapsulation to PPTP and select Data Link Options.
Enter the PPTP Partner IP Address. (Note: This is the public IP address of Router B. Considering our example, the public IP address, or Local WAN IP Address, is 172.20.17.1. If the opposite router in your configuration does not have NAT enabled for the Internet connection profile, and IP Addressing... in Easy Setup is set for an Unnumbered connection to the Internet, the Ethernet IP Address should be used at the PPTP Partner IP Address instead.)
Next, set an Authentication type for the tunnel. If you wish to use encryption, you must choose MS-CHAP. You will have the option to use MPPE or None as your Data Encryption type. MPPE provides both compression and a greater level of security through encryption. However, it will slow down data transmission.
If you choose either PAP or CHAP as your authentication type, you may choose to use Data Compression. You have a choice of None or Standard LZS.
If Router A will be initiating PPTP connections to Router B, enter a unique Send Host Name and Send Password (or Secret) and set Initiate Connections to Yes.
If Router B will be initiating PPTP connections to Router A, enter a unique Receive Host Name and Receive Password (or Secret).
If you want Router A to initiate a PPTP connections to Router B whenever there is a demand for resources on the Router B network, as opposed to manually establishing a connection from the router every time, set On Demand to Yes.
Idle Timeout is the amount of time Router A will maintain the PPTP connection to Router B when there is no traffic. It is 300 seconds by default. A value of zero disables the idle timer so the PPTP connection will never time out.
Escape once back to the Add Connection Profile screen.
IP Enabled should be set to Yes. Next, select IP Profile Parameters.
Set Address Translation Enabled to No.(Note: Use the tab key to toggle this option between Yes and No. Hit enter to save your changes).
Set the Remote IP Address to 192.168.2.1 and Remote IP Mask to 255.255.255.0. (Note: In your case, if Router B has a different Ethernet IP Address and Ethernet Subnet Mask then what is used in this example, please substitute your own Ethernet IP Information for Router B.)
Do not select a Filter Set. If one is active, hit enter on Remove Filter Set to deactivate it. (Note: You can filter over a PPTP connection, however, none of the pre-set filters are suitable for this purpose. If you wish to filter traffic on your PPTP tunnel, please read technote NIR 052: Basic Firewall Features and Configuration.)
Receive RIP should be set to Off unless you have multiple RIP-enabled routers on either the Router A or Router B network.
Escape once to return to the Add Connection Profile screen and select Add Profile Now.
From the Connection Profiles screen, escape once back to Quick Menus.
Select ATMP/PPTP Default Profile (Firmware versions below 4.8 select VPN Default Answer Profile).
Set Answer ATMP/PPTP Connections: to Yes (Firmware versions below 4.8 set Answer VPN Connections: to Yes).
Under PPTP Configuration Options, select the Receive Authentication type you are using. This will be the same as the Authentication type you selected in Data Link Options.
Escape once back to Quick Menus.
Select WAN Default Profile.
Set Must Match a Defined Profile to Yes.

Note: The R9100 and the R910 may not have a Wan Default Profile. Simply disregard this step.

Escape twice out to the Main Menu and go to Utilities and Diagnostics.
Select Restart System. This concludes the setup for Router A.

Router B Configuration

From the Main Menu of router console screens, go to Quick Menus, and select Add Connection Profile.
Under Profile Name, type Router A (or a name of your choice).
Change Data Link Encapsulation to PPTP and select Data Link Options.
Enter the PPTP Partner IP Address. (Note: This is the public IP address of Router A. Considering our example, the public IP address, or Local WAN IP Address, is 172.20.16.1. If the opposite router in your configuration does not have NAT enabled for the Internet connection profile, and IP Addressing... in Easy Setup is set for an Unnumbered connection to the Internet, the Ethernet IP Address should be used at the PPTP Partner IP Address instead.)
Next, select the same Authentication type as you did in Router A for the Router B profile.
Also, select the same Data Compression or Data Encryption type as you set in Router A for the Router B profile.
If Router B will be initiating PPTP connections to Router A, enter the same values you configured in Router A for Receive Host Name and Receive Password (or Secret) as the Send Host Name and Send Password (or Secret) here, in Router B. Set Initiate Connections to Yes.
If Router A will be initiating PPTP connections to Router B, (Initiate Connections must be set to Yes in the Router B profile of Router A), enter the same values you configured in Router A for Send Host Name and Send Password (or Secret) as the Receive Host Name and Receive Password (or Secret) here, in Router B.
If you want Router B to initiate a PPTP tunnel to Router A whenever there is a demand for resources on the Router A network, as opposed to manually establishing a connection from the router every time, set On Demand to Yes.
Again, Idle Timeout is the amount of time Router B will maintain the PPTP connection to Router A when there is no traffic. It is 300 seconds by default. A value of zero disables the idle timer so the PPTP connection will never time out.
Escape once back to the Add Connection Profile screen.
IP Enabled should be set to Yes. Next, select IP Profile Parameters.
Set Address Translation Enabled to No.
Set the Remote IP Address to 192.168.1.1 and Remote IP Mask to 255.255.255.0. (Note: In your case, if Router A has a different Ethernet IP Address and Ethernet Subnet Mask then what is used in this example, please substitute your own Ethernet IP Information for Router A.)
Do not select a Filter Set. If one is active, hit enter on Remove Filter Set to deactivate it. (Note: You can filter over a PPTP connection, however, none of the pre-set filters are suitable for this purpose. If you wish to filter traffic on your PPTP tunnel, please read technote NIR 052: Basic Firewall Features and Configuration.)
Receive RIP should be set to Off unless you have multiple RIP-enabled routers on either the Router B or Router A network.
Escape once to return to the Add Connection Profile screen and select Add Profile Now.
From the Connection Profiles screen, escape once back to Quick Menus.
Select ATMP/PPTP Default Profile (Firmware versions below 4.8 select VPN Default Answer Profile).
Set Answer ATMP/PPTP Connections: to Yes (Firmware versions below 4.8 set Answer VPN Connections: to Yes).
Under PPTP Configuration Options, select the Receive Authentication type you are using. This will be the same as the Authentication type you selected in Data Link Options.
Escape once back to Quick Menus.
Select WAN Default Profile.
Set Must Match a Defined Profile to Yes.

Note: The R9100 and the R910 may not have a Wan Default Profile. Simply disregard this step.

Escape twice out to the Main Menu and go to Utilities and Diagnostics.
Select Restart System. This concludes the setup for Router B.

Conclusion

Once both routers are configured, a PPTP connection can be established to allow IP routing through the tunnel between the two LAN's.

Netopia PPTP Setup (Router-to-Router)

NQG_023