PPTP policy routing

[resetter]

Hi,
Just want to know if its possible to apply policy based routing on a PPTP VPN connection within ASUSWRT-Merlin?
If not, maybe it should be implemented.
Thanks!

 

[RMerlin]

No, and there are no plan to implement it either. I consider PPTP to be legacy technology that people should avoid using if possible.

 

[Bart Bichau]

No, and there are no plan to implement it either. I consider PPTP to be legacy technology that people should avoid using if possible.

Hi Merlin, sorry to hear that, because the challenge here in New Zealand is that PPTP is 10 times faster than OpenVPN on all the VPN providers I have tested (I tested about 10). Is there no way we can run a script or so to apply policy based routing to L2TP (even faster) please?

 

[RMerlin]

Hi Merlin, sorry to hear that, because the challenge here in New Zealand is that PPTP is 10 times faster than OpenVPN on all the VPN providers I have tested (I tested about 10). Is there no way we can run a script or so to apply policy based routing to L2TP (even faster) please?

You could do it by manually configuring the kernel's RPDB, but it's not something simple to do.

 

[Bart Bichau]

i am way too much of a noob to even consider that. But why is it that L2TP is so much faster than OpenVPN when OpenVPN is supposed to be the future?

 

[RMerlin]

i am way too much of a noob to even consider that. But why is it that L2TP is so much faster than OpenVPN when OpenVPN is supposed to be the future?

L2TP is just a tunnel, it doesn't provide any encryption on its own.

 

[Bart Bichau]

gotcha.sorry about that. But for streaming content that is perfect.

 

[resetter]

Hi guys,
still interested in getting a faster VPN connection on my router, I have an ASUS RT-N66U and I have done a bit of reading.
The following guide discusses adding rules within the router software to enable split tunnelling on DD-WRT, but I figure it
should be much the same on stock/merlin firmwares. Might give it a go and see how it runs.
http://blog.adeel.io/2016/02/07/policy-based-routing-for-pptp-vpn-client-on-dd-wrt-router/
Let me know what you think.

 

[usasf999]

Hi,
Just want to know if its possible to apply policy based routing on a PPTP VPN connection within ASUSWRT-Merlin?
If not, maybe it should be implemented.
Thanks!

similar issue: My VPN provider openvpn config file is using UDP. Unfortunately, my Middle Eastern ISP is blocking UDP ports.
No openvpn config files with use of TCP are available, which is forcing me to go to PPTP, which has the limitation of no policy rule implementation in the Merlin firmware. Can anyone help and highlight why Merlin is not actively working this issue: making policy rules also available for PPTP

 

[ColinTaylor]

Can anyone help and highlight why Merlin is not actively working this issue: making policy rules also available for PPTP

He's already answered that question in posts #2 and #4. Also here. It's a legacy feature that isn't worth dedicating the development time to.

 

[sfx2000]

Hi Merlin, sorry to hear that, because the challenge here in New Zealand is that PPTP is 10 times faster than OpenVPN on all the VPN providers I have tested (I tested about 10). Is there no way we can run a script or so to apply policy based routing to L2TP (even faster) please?

PPTP is fast, but it's very insecure on all aspects - from ciphering on content to authentication...

L2TP can be fast and secure, but L2TP by itself is just a Layer 2 Tunnel - what makes it secure is IPSec, which many implementations actually use...

L2TP is faster because it runs in kernel space as a driver/interface vs. OpenVPN which needs to make jumps between kernel space (the interface driver) and userland (the ovpn and opensssl tasks) and back to kernel. It's not elegant or fast, but it is portable, and that's the goal of the OpenVPN team.

There are other options - Wireguard and ZeroTier come to mind, but that's outside of the scope of AsusWRT and the variants...

 

[Twiglets]

similar issue: My VPN provider openvpn config file is using UDP. Unfortunately, my Middle Eastern ISP is blocking UDP ports.
No openvpn config files with use of TCP are available, which is forcing me to go to PPTP, which has the limitation of no policy rule implementation in the Merlin firmware. Can anyone help and highlight why Merlin is not actively working this issue: making policy rules also available for PPTP

Openvpn config files are TXT files called <something>.opvn , you should be able to edit the file and change the UDP to TCP.
The file will contain a line 'proto udp' change it to 'proto tcp' ...... (Please ignore/do not type the quotes.)
Ensure the file is edited without changing the line endings or run 'dos2unix -u <name of the .opvn file>' to ensure the file is the correct format.

Note 1:
*** Be aware it may not work IF the VPN Provider does not support TCP connections ***
*** If you still have problems you may need to change your VPN Provider ***

Note 2:
On the basis of your Username & location I am guessing your problem.
As an example Windscribe (VPN Vendor) will generate a OpenVPN config with the protocol and port number configurable from a list.
i.e. Protocol can be UDP or TCP and you can use Port 443 so it looks like all the other Port 443 traffic unless packet sniffed (DPI). There are options available that avoid DPI as well.

 

[CaptainSTX]

PPTP is fast, but it's very insecure on all aspects - from ciphering on content to authentication...

L2TP can be fast and secure, but L2TP by itself is just a Layer 2 Tunnel - what makes it secure is IPSec, which many implementations actually use...

L2TP is faster because it runs in kernel space as a driver/interface vs. OpenVPN which needs to make jumps between kernel space (the interface driver) and userland (the ovpn and opensssl tasks) and back to kernel. It's not elegant or fast, but it is portable, and that's the goal of the OpenVPN team.

There are other options - Wireguard and ZeroTier come to mind, but that's outside of the scope of AsusWRT and the variants...

The choice to use TCP/UDP is probably limited or decided by your VPN provider. In the case of PIA they have eleven ports available to use for OpenVPN connections but each port besides being designated TCP or UDP uses different levels of security encryption.