Port 1723PPTP (obsolete VPN)

What port 1723 is used for

PPTP has two parts. TCP 1723 carries the control connection that sets up and tears down the tunnel. The actual tunnelled PPP frames travel inside GRE packets, IP protocol 47, which has no port number. A firewall must allow both for PPTP to work.

Why it is obsolete

• MS-CHAPv2, the usual authentication, can be broken by capturing a single handshake and recovering the password hash; a public service demonstrated 100% success in 2012.
• MPPE encryption uses RC4 with keys derived from that same hash, so a broken handshake exposes the whole session.
• Apple removed PPTP from macOS and iOS in 2016. Microsoft still ships the client for compatibility and does not recommend it.

What still uses it

Old routers, some ISP business services, and organisations that never migrated. If you find a 1723 listener, plan the replacement:

How to check port 1723

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :1723

A line in the LISTENING state means a local program has bound port 1723; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :1723 or lsof -i :1723.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection vpn.example.com -Port 1723

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 1723. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Firewall considerations

The right rule for 1723 is to close it. If a legacy server must remain temporarily, restrict inbound TCP 1723 and GRE to known client addresses and set a decommission date.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 1723 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.