Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If you're trying to connect from a Mac to a Windows Server's VPN (PPTP), accepting only MS-CHAPv2, the client fails with the following error:

18/6/13 9:06:08.672 AM pppd[10247]: MS-CHAP authentication failed: E=691 Authentication failure

Proposed solutions (Post from Macworld, Post from Apple forum) are to disable the Digitally sign communications (always) and enable it only if client agrees (not tested, since we cannot change the settings on the server).

Often, you don't want to or can't change any setting on the server and thus look for a solution on the client side.

Has anyone found a command line to force the usage of MS-CHAPv2, or, in other words, to preclude the usage of any other authentication method?

share|improve this question
up vote 3 down vote accepted

MacOSX has pppd embedded and you can connect via the Terminal. To connect via pppd and have only a subset network routed through the vpn I use the following command line (multiline for readability):

sudo pppd 
   remoteaddress *vpn_server_address* 
   pty "*vpn_server_address* --nolaunchpppd" 
   user *DOMAIN\\username* 
   password *password* 
   plugin pptp.ppp 
   plugin /System/Library/SystemConfiguration/PPPController.bundle/Contents/PlugIns/PPPDialogs.ppp  
   logfile /path/to/your/log.log

Then, I declare in another terminal the needed route, for example

sudo route add -net *distant_local_network* *gateway_ip* *mask*

for example

sudo route add -net

Then all the traffic to the distant network uses the VPN and the rest of Internet is still accessible.

share|improve this answer
Thanks!! Just what I needed. I had to change this a little bit to make it work. I added the following options: require-mppe require-mppe-40 require-mppe-128 mppe-stateful – delkant Dec 14 '14 at 23:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.