PPTP and Interoperability with Other Local Machine Services (164052)

RESOLUTION

A change has been made in Windows NT Service Pack 2 (SP2) that enables the PPTP service to allow packets to services running on the computer running Windows NT Server. If a registry parameter is set, PPTP will allow packets on a PPTP filtering enabled interface to reach the local machine.

This allows RAS (PPTP) and Proxy servers (or any other server services) to be enabled at the same time, without the fear of the protected network being attacked from the Internet due to packet forwarding.

To protect the private network:

1. Install Service Pack 2 (or later) for Windows NT Server 4.0.
2. Enable PPTP filtering by checking the Enable PPTP Filtering check box in the Advanced TCP/IP properties of the Network Control Panel. This setting does not allow any packets other than PPTP to come and go out of that interface.
3. To allow clients on the Internet to access services running on the Windows NT computer, change the following registry parameter and restart the machine.
   
   WARNING: Using Registry Editor incorrectly can cause serious, system- wide problems that may require you to reinstall Windows NT to correct them. Microsoft cannot guarantee that any problems resulting from the use of Registry Editor can be solved. Use this tool at your own risk.
   
   
   1. Open the Registry Editor (Regedt32.exe).
   2. Go to the following location in the Registry and add the following value:

               HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RASPPTPF
                \Parameters\ 
      
               Value Name: AllowPacketsForLocalMachine
                Data Type: REG_DWORD
                     Data: 1
      								

With this additional setting, PPTP clients can connect to the local computer from the Internet. Computers on the Internet can see this server, and can access services (FTP, WWW, and so forth) running on this server. However, computers on the Internet cannot see past the server.