How to Configure Windows XP ICS for an Internal PPTP Server

Windows XP includes support for Internet Connection Sharing (ICS), which provides the ability to share an internet connection with other computers on a local network. ICS in Windows XP allows services to be mapped to hosts on the internal network, so that requests coming from the internet and destined for a particular service will be redirected by Windows XP to the appropriate computer on the internal network.

For example, you may want to place a Point-to-Point Tunneling Protocol (PPTP) server on the internal network and configure Windows XP ICS to forward the Virtual Private Networking (VPN) traffic to the PPTP server. This article describes the process that is required to map PPTP back to an internal host, so that an incoming VPN connection can pass through the Windows XP ICS computer. For the purposes of this article, it is assumed that the PPTP server is already configured properly and is able to accept PPTP connections from clients on the local network.

A PPTP connection is composed of two types of traffic. The first is PPTP traffic, which uses TCP port 1723, and is used to establish and maintain the connection. The second is Generic Route Encapsulation (GRE) (Protocol 47), and is used to encapsulate the actual data that is passed between the two endpoints. When you configure service redirection in ICS (for Windows XP), it is only necessary to map TCP port 1723 to the appropriate internal server. GRE traffic will automatically be redirected to the same host as the PPTP traffic.

To add the service mapping that will allow PPTP traffic to be passed to an internal host:

1. Double-click Network Connections in Control Panel.
2. Right-click the Internet connection (which is also the connection where ICS is enabled), and then click Properties.
3. On the Advanced tab, click Settings.
4. In the Services box, check to see if there is an Incoming Connection VPN (PPTP) entry. If so, click this service filter, and then click Delete. This entry is maintained by the Incoming Connections Wizard, so the settings that are configured for this service filter will be returned to default values for the local host each time you run the wizard.
5. Click Add.
6. Fill in the Service Settings form as follows:
   • Description of Service: Internal PPTP server
   • Name or IP: <IP address of internal PPTP server, for example: 192.168.0.12, or enter the name of the PPTP server, for example: PPTPServ.MSHOME.NET>
   • Protocol: TCP
   • External Port number for this service: 1723
   • Internal Port number for this service: 1723
7. Click OK to complete the configuration, and then click OK to exit the Advanced Settings dialog box.

ICS should now be configured to allow clients on the Internet to connect by using PPTP to the internal VPN server.