Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If you're trying to connect from a Mac to a Windows Server's VPN (PPTP), accepting only MS-CHAPv2, the client fails with the following error:

18/6/13 9:06:08.672 AM pppd[10247]: MS-CHAP authentication failed: E=691 Authentication failure

Proposed solutions (Post from Macworld, Post from Apple forum) are to disable the Digitally sign communications (always) and enable it only if client agrees (not tested, since we cannot change the settings on the server).

Often, you don't want to or can't change any setting on the server and thus look for a solution on the client side.

Has anyone found a command line to force the usage of MS-CHAPv2, or, in other words, to preclude the usage of any other authentication method?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

MacOSX has pppd embedded and you can connect via the Terminal. To connect via pppd and have only a subset network routed through the vpn I use the following command line (multiline for readability):

sudo pppd 
   remoteaddress *vpn_server_address* 
   pty "*vpn_server_address* --nolaunchpppd" 
   lock 
   user *DOMAIN\\username* 
   password *password* 
   nomppe 
   require-mschap-v2 
   noauth 
   nobsdcomp 
   nodeflate 
   nodetach 
   plugin pptp.ppp 
   noipdefault 
   refuse-pap 
   refuse-eap 
   refuse-chap 
   refuse-mschap 
   plugin /System/Library/SystemConfiguration/PPPController.bundle/Contents/PlugIns/PPPDialogs.ppp  
   logfile /path/to/your/log.log

Then, I declare in another terminal the needed route, for example

sudo route add -net *distant_local_network* *gateway_ip* *mask*

for example

sudo route add -net 192.192.0.0 192.192.0.1 255.255.255.0

Then all the traffic to the distant network uses the VPN and the rest of Internet is still accessible.

share|improve this answer
    
Thanks!! Just what I needed. I had to change this a little bit to make it work. I added the following options: require-mppe require-mppe-40 require-mppe-128 mppe-stateful –  delkant Dec 14 at 23:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.