Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been reading about the security, or lack of, with regards to a PPTP VPN. The specific things mentioned over and over are the fact that DNS can leak and the encryption is insecure. Is this a flaw with PPTP itself, or just the MS implementation? I do not see why you can't set your default resolver to a DNS server on the VPN to force DNS through the tunnel. Would setting up a static routing table to force the default route also cause all traffic to be sent out the PPTP tunnel? As far as the encryption is concerned, isn't the encryption suite the responsibility of the client\server and not the PPTP protocol itself. Couldn't a PPTP client\server theoretically use something other than MSCHAP?

share|improve this question

The MSCHAP authentication protocol is insecure, and the MPPE tunnel protocol is vulnerable to bit-flipping attacks. You can use a different authentication protocol, such as EAP-TLS, but that requires more complex configuration (namely, PKI). If you're concerned about security, there are several other VPN protocols you could use, such as OpenVPN, L2TP, and IPSec.

For more info, see

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.