WINS and PPTP: name resolution over a PPTP VPN

(We'll get to the bottom of this yet.) Well, something similar occurred to me last night, but my thinking is slightly different.  First, I agree that traffic to the PPTP server is not being tunneled.  I do not, however, believe the reason is because "you can't tunnel a tunnel."  First, you can tunnel a tunnel...there is no particular reason why you couldn't. A high security application, where you did not want to trust one single encryption system, might just want to put a L2TP inside a PPTP tunnel, for example. Second, I think the reason is a routing decision.  The client has to make a decision about whether outbound traffic flows through the tunnel or not: this decision is made based on an examination of the routing table.

 

For example, suppose the address the client uses to get to the PPTP server is 4.17.x.y.  This is the address we use to set up the VPN connection.  After setting up the VPN, the client gets an address on the VPN, as returned by the PPTP server, say 192.168.1.x

Traffic routed to this subnet goes through the tunnel.  Traffic not destined for this subnet does not go through the tunnel.  Consequently, if the client makes a WINS name resolution request to 4.17.x.y (the PPTP server), the request gets routed outside the tunnel (just a plain old packet over the Internet).  In this case, the WINS request will not get to the WINS server if the ISP is filtering Windows networking traffic (UDP ports 137, 138, TCP port 139).  Likewise, if the client makes a windows networking request to the PPTP server, using the 4.17.x.y address, the traffic will not flow through the tunnel.  For example, "net use t: \\4.17.x.y\someshare" will map a drive on the client to a share on the server, but the traffic over that mapped drive will not go through the tunnel and will not be encrypted.

 

However, if the client makes a WINS name resolution request to 192.168.1.y, where 192.168.1.y is the address on the remote network of a WINS server, then the WINS request will go through the tunnel and it won't matter if the ISP filtering Windows networking traffic or not...in either case the WINS request will go through.  Likewise, if the PPTP server itself is multi-homed, with 192.168.1.z being an alternative address for the PPTP server itself, then "net use t: \\192.168.1.z\someshare" will create a connection that flows through the tunnel and traffic to the PPTP server over this connection will indeed, be subject to the security of the VPN.  This is why the referenced Microsoft Knowledge Base article suggests that one method to get around an ISP filtering ports 137, 138, 139, is to make the PPTP/WINS server multi-homed...using the inside address in this case causes the traffic to flow through the tunnel.

 

Long and short of it, it's a routing decision and whether traffic to the PPTP server itself gets tunneled depends on how that traffic is addressed.

 

Randy Day-

 

 

<jordanr@my-deja.com> wrote in message news:7tqiuv$b9p$1@nnrp1.deja.com...