pptp的包过滤规则

14.11.3. Packet Filtering Characteristics of PPTP

PPTP negotiation takes place on TCP port 1723. The actual tunnel is based on GRE, which is IP protocol 47, and uses GRE protocol hexadecimal 880B (indicating that the tunneled packets are PPP). GRE is discussed further in Chapter 4, "Packets and Protocols ".

Direction	Source Addr.	Dest. Addr.	Protocol	Source Port	Dest. Port	ACK Set	Notes
In	Ext	Int	GRE	[37]	[37]	[38]	Tunnel data, external client to internal server
Out	Int	Ext	GRE	[37]	[37]	[38]	Tunnel reply, internal server to external client
In	Ext	Int	TCP	>1023	1723	[39]	Setup request, external client to internal server
Out	Int	Ext	TCP	1723	>1023	Yes	Setup response, internal server to external client
Out	Int	Ext	GRE	[37]	[37]	[38]	Tunnel data, internal client to external server
In	Ext	Int	GRE	[37]	[37]	[38]	Tunnel reply, external server to internal client
Out	Int	Ext	TCP	>1023	1723	[39]	Setup request, internal client to external server
In	Ext	Int	TCP	1723	>1023	Yes	Setup response, external server to internal client

[37]GRE does not have ports. GRE does have protocol types, and PPTP is protocol type hexadecimal 880B.

[38]GRE has no ACK equivalent.

[39]ACK will not be set on the first packet (establishing connection) but will be set on the rest.

参考：http://www.unix.org.ua/orelly/networking_2ndEd/fire/ch14_11.htm