Change:
<del> { stdenv, fetchurl, networkmanager, pptp, ppp, intltool, pkgconfig , libsecret, withGnome ? true, gnome3 }: let pname   = "NetworkManager-pptp"; version = "1.2.4"; in stdenv.mkDerivation rec { name    = "${pname}${if withGnome then "-gnome" else ""}-${version}"; src = fetchurl { url    = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz"; sha256 = "bd97ce768c34cce6d5b5d43681149a8300bec754397a3f46a0d8d0aea7030c5e"; }; buildInputs = [ networkmanager pptp ppp libsecret ] ++ stdenv.lib.optionals withGnome [ gnome3.gtk gnome3.libgnome-keyring gnome3.networkmanagerapplet ]; nativeBuildInputs = [ intltool pkgconfig ]; postPatch = '' sed -i -e 's%"(/usr/sbin|/usr/pkg/sbin|/usr/local/sbin)/[^"]*",%%g' ./src/nm-pptp-service.c substituteInPlace ./src/nm-pptp-service.c  --replace /sbin/pptp ${pptp}/bin/pptp  --replace /sbin/pppd ${ppp}/bin/pppd ''; configureFlags = if withGnome then "--with-gnome --with-gtkver=3" else "--without-gnome"; passthru = { updateScript = gnome3.updateScript { packageName = pname; attrPath = "networkmanager-pptp"; }; }; meta = { description = "PPtP plugin for NetworkManager"; inherit (networkmanager.meta) maintainers platforms; }; } </del>

Discussion:
When trying to use a pptp vpn connection with NetworkManager, establishing the connection fails. The logs in journalctl look like this: This is solved by "sudo modprobe nfconntrackpptp". I'm not sure whether: should be enabled by default, can be automatically loaded somehow by NetworkManager, or need for this module when using pptp should simply be documented in the nixos manual. Install nixos with NetworkManager enabled, try to connect to a pptp vpn using NetworkManager, then see above. I created the connection using the NetworkManager applet in plasma/kde. System: 18.03pre115166. Nix version: nix-env (Nix) 1.11.14 Nixpkgs version: 18.03pre118381. Sandboxing enabled: No
In theory, network-manager-pptp . However, as this is currently hardcoded to , this doesn't work.
Can you check if applying works for you?
Sorry, I can't test at the time, I don't have access to a pptp'ed network anymore.
Same here - Nobody should really use pptp anymore… as you :+1:'d, do you have a test setup ready?
No, I don't, it just sounded the correct solution.
I just reverted and it builds and works without trouble. Note that you have to set networking.firewall.connectionTrackingModules to at least [ "pptp" ]. No idea why was it removed just so simply, could someone please check if it works that way too?
That's the problem - pptp is rarely used these days, really insecure and there was no feedback on a proposed patch fixing some reported issue. If this really should go back in, we would need a maintainer and a nixos test for it.
I'm not sure whether it was deleted based only on this issue, but this one seems to be the exact same as , without the proposed (and working) solution. As for security, I don't know nearly enough about VPNs to have an objective opinion on the topic, but as a layman I think it poses no security threat just by simply being in the repository, if it doesn't get used (and even usage of it is disabled without further tinkering as the networking.firewall.autoLoadConntrackHelpers setting defaults to false).

Unfortunately I can't help with the maintainer and nixos test part.. Obviously I am biased on the topic, as reverting your commit at each update works for me, but it doesn't seem to be the optimal solution :D And I need pptp as my university currently offers VPN only through this protocol..
Setting to contain will result in the module being loaded, similar to fixing the networkmanager's code modprobe`-ing said kernel module at runtime, as done in above patch ;-) You can get some details on the security of PPTP (article from 2014), the , and even a decryption tool at . So it might be a good idea to not use PPTP anymore. Simply having this networkmanager plugin inside nixpkgs of course doesn't pose a direct security threat to everyone, but higher chance of coderot, as there's neither automated testing nor somebody available to maintain this package, I thought it would be the best to just remove it. Maybe there are ways to operate PPTP in a secure fashion, can you shed some light on that as a pppd maintainer?
ouch, I'm using pptp as well (I work as a contractor, not my decision what protocol the company uses)...
Until some decision is made you can do git revert , and set the networking.firewall.connectionTrackingModules to [ "pptp" ].
as written above, having a nixos vm test with a a server/client setup, would help ensuring it works. You can peek into .
This issue has been mentioned on NixOS Discourse. There might be relevant details there: