Port reference
Port 1723 (TCP) – PPTP VPN
PPTP VPN control channel — a legacy tunneling protocol whose encryption (MS-CHAPv2) is considered broken.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on legacy VPN servers and routers configured for PPTP. Disabled on modern platforms that have dropped PPTP support.
What is port 1723 used for?
Port 1723 is the control channel for PPTP (Point-to-Point Tunneling Protocol), one of the earliest VPN technologies. Windows shipped a built-in PPTP client for years, and many home routers still list it as a VPN option. PPTP uses TCP 1723 to set up the tunnel, while the data itself travels over GRE (IP protocol 47). Its encryption is now considered broken, and modern systems have largely dropped it.
When would you open it?
You'd only forward 1723 to keep an old PPTP VPN server running for legacy clients. For any new setup, you should not open it — use a modern VPN such as WireGuard, IKEv2/IPsec, or OpenVPN instead, and leave PPTP disabled.
Is it safe to open?
No — PPTP's MS-CHAPv2 authentication can be cracked, so it should be retired rather than exposed; migrate to a modern VPN and block 1723. See the security notes below.
How to check if this port is open
ss -tulpn | grep :1723
nmap -p 1723 <target>netstat -ano | findstr :1723
Test-NetConnection <host> -Port 1723lsof -i :1723
nmap -p 1723 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 1723 to your device's local IP, internal port 1723, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 1723/tcpsudo firewall-cmd --permanent --add-port=1723/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1723 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 1723" -Direction Inbound -Protocol TCP -LocalPort 1723 -Action AllowSecurity & risks
Common attacks
- Offline cracking of MS-CHAPv2 handshakes to recover VPN credentials
- Credential brute force and password spraying against the VPN
- Traffic interception due to weak/broken encryption
- VPN endpoint and user enumeration
Hardening
- Retire PPTP entirely — migrate to WireGuard, IKEv2/IPsec or OpenVPN
- If PPTP must remain temporarily, restrict by source IP and enforce strong, unique passwords
- Add MFA at an upstream gateway since PPTP cannot be trusted alone
- Block 1723 and GRE (protocol 47) at the firewall once migrated
- Monitor for credential brute force against the VPN
How to block this port
sudo ufw deny 1723/tcpsudo firewall-cmd --permanent --remove-port=1723/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 1723 -j DROPNew-NetFirewallRule -DisplayName "Block 1723" -Direction Inbound -Protocol TCP -LocalPort 1723 -Action Blocknmap snippet
nmap -p1723 --script pptp-version <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is PPTP on port 1723 secure?
- No. PPTP relies on MS-CHAPv2, whose handshakes can be cracked offline to reduce the key to a single DES operation. It is considered broken and should be replaced with a modern VPN.
- What should I use instead of PPTP?
- Migrate to WireGuard, IKEv2/IPsec, or OpenVPN. These provide strong, modern cryptography and active maintenance, unlike PPTP which is effectively obsolete.