Port 1723 – PPTP

TCP

Port 1723 is the PPTP (Point-to-Point Tunneling Protocol) control channel port. PPTP is a legacy VPN protocol with known cryptographic weaknesses – MS-CHAPv2 authentication can be cracked in under 24 hours. PPTP should never be used for security-sensitive connections. Use WireGuard, OpenVPN, or IPsec instead.

Port Number

1723

Protocol

TCP

Service

Point-to-Point Tunneling Protocol

Range

IANA Registered (1024–49151)

Description

PPTP on port 1723 establishes the control channel for VPN tunnels. The actual encrypted data travels over GRE (IP protocol 47). PPTP was built into Windows since Windows 95 and remains available on all major operating systems for backward compatibility. PPTP's MS-CHAPv2 authentication was broken definitively in 2012 – any captured handshake can be reduced to a single DES key and cracked in under 24 hours using cloud compute. Even with EAP-TLS replacing MS-CHAPv2, the MPPE encryption (RC4-based) has its own weaknesses. No security professional recommends PPTP for any use case. The only remaining justification is connecting to legacy systems that support nothing else.

Security risks

1MS-CHAPv2 completely broken (2012): Moxie Marlinspike demonstrated that any MS-CHAPv2 handshake can be cracked to the NTLM hash in under 24 hours (CloudCracker service) – the protocol cannot be secured
2GRE protocol (IP 47) required: PPTP uses GRE for data encapsulation. NAT devices and firewalls often handle GRE poorly, leading operators to disable firewall features to make PPTP work
3No forward secrecy: PPTP's MPPE encryption key derives from the password hash. If the password is ever compromised, all past captured traffic is decryptable
4Known plaintext attacks on MPPE: the RC4-based MPPE encryption reuses key material predictably, allowing traffic decryption with enough captured data
5Still widely deployed: many legacy VPN concentrators, consumer routers, and older Windows Server installations offer PPTP as default or only VPN option

Firewall guidance

PPTP should be disabled and replaced. If found in use: immediately plan migration to WireGuard, IPsec (IKEv2), or OpenVPN. Block port 1723 once migration is complete. Do NOT 'upgrade' PPTP with stronger passwords – the protocol itself is broken regardless of password strength. Microsoft deprecated PPTP in Windows Server 2022.

Diagnosis commands

Detect PPTP VPN server and version

shell

nmap -p 1723 --script pptp-version target

Check if PPTP server daemon is configured on Linux

shell

grep -r 'pptp\|pptpd' /etc/ 2>/dev/null

PowerShell: check Windows RRAS VPN tunnel types (disable PPTP)

shell

Get-VpnServerConfiguration | Select TunnelType

Check if the same server offers IKEv2 as a PPTP replacement

shell

ike-scan --ikev2 target

Usage examples

Port 1723 – PPTP

shell

pptpsetup --create tunnel --server vpn.example.com --username user
nmap -p 1723 target
pon tunnel

Common services on this port

Windows Server RRAS (legacy)MikroTik RouterOSTP-Link/consumer routersmacOS (client only, server removed in Monterey)

Related ports

1723

PPTP control (this port, TCP)

GRE protocol (PPTP data encapsulation)

1194

OpenVPN (secure alternative)

51820

WireGuard (modern alternative)

500

IKE/IPsec (secure alternative)

History

PPTP (Point-to-Point Tunneling Protocol) was developed by Microsoft, Ascend Communications, and US Robotics in 1996 (RFC 2637, informational). Port 1723 was assigned for the control channel. PPTP was the first widely-deployed VPN protocol (built into Windows 95 OSR2). Bruce Schneier and Mudge published the first cryptanalysis in 1998. Moxie Marlinspike's 2012 MS-CHAPv2 crack made PPTP definitively insecure. Apple removed PPTP from macOS/iOS in 2016-2018.

FAQ

Why is PPTP still used if it's broken?

Inertia. PPTP is built into every Windows version, most consumer routers, and many legacy network appliances. It 'just works' without certificates or complex setup. Organizations often don't realize it's broken because: (1) it was once recommended by Microsoft, (2) traffic 'looks encrypted' in Wireshark, (3) no one tested their specific deployment. The migration path is clear (IKEv2 is built into modern Windows too) but requires active effort.

What should I replace PPTP with?

For Windows environments: IKEv2/IPsec (built into Windows 10/11, no client install, strongest with certificate auth). For cross-platform: WireGuard (fastest, simplest, modern crypto). For maximum compatibility: OpenVPN (works through restrictive firewalls on TCP 443). All three are dramatically more secure than PPTP. Migration order: deploy new VPN alongside PPTP → move users → disable 1723.

Specification

RFC 2637 – Port 1723 specification →