<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>PPTP - Unmaintained</title><link rel="stylesheet" href="html.css" type="text/css" /><meta name="generator" content="DocBook XSL Stylesheets V1.73.2" /><meta name="description" content="Shorewall easily supports PPTP in a number of configurations." /></head><body><div class="article" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title"><a id="PPTP"></a>PPTP - Unmaintained</h2></div><div><div class="authorgroup"><div class="author"><h3 class="author"><span class="firstname">Tom</span> <span class="surname">Eastep</span></h3></div></div></div><div><p class="copyright">Copyright © 2001, 2002, 2003, 2004, 2005, 2006, 2007 Thomas M. Eastep</p></div><div><div class="legalnotice"><a id="id290194"></a><p>Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of the license is included in the section entitled “<span class="quote"><a class="ulink" href="GnuCopyright.htm" target="_self">GNU Free Documentation License</a></span>”.</p></div></div><div><p class="pubdate">2008/12/15</p></div><div><div class="abstract"><p class="title"><b>Abstract</b></p><p>Shorewall easily supports PPTP in a number of configurations.</p></div></div></div><hr /></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="section"><a href="#Prelim">Preliminary Reading</a></span></dt><dt><span class="section"><a href="#ServerFW">PPTP Server Running on your Firewall</a></span></dt><dd><dl><dt><span class="section"><a href="#Samba">Configuring Samba</a></span></dt><dt><span class="section"><a href="#ConfigPppd">Configuring pppd</a></span></dt><dt><span class="section"><a href="#ConfigPptpd">Configuring pptpd</a></span></dt><dt><span class="section"><a href="#ConfigFw">Configuring Shorewall</a></span></dt><dd><dl><dt><span class="section"><a href="#Basic">Basic Setup</a></span></dt><dt><span class="section"><a href="#Zones">Remote Users in a Separate Zone</a></span></dt><dt><span class="section"><a href="#Hub">Multiple Remote Networks</a></span></dt></dl></dd></dl></dd><dt><span class="section"><a href="#ServerBehind">PPTP Server Running Behind your Firewall</a></span></dt><dt><span class="section"><a href="#ClientsBehind">PPTP Clients Running Behind your Firewall</a></span></dt><dt><span class="section"><a href="#ClientFW">PPTP Client Running on your Firewall</a></span></dt><dt><span class="section"><a href="#PPTP_ADSL">PPTP Client running on your Firewall with PPTP Server in an ADSL Modem</a></span></dt></dl></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>I have not used PPTP in years and as a consequence, this document is no longer maintained (any volunteers?).</p><p>As far as I know, the information regarding Shorewall configuration is still valid but the configurations shown for for the other components may no longer work. For the most part, they show configuration files that I used when I worked for <span class="trademark">Compaq</span>™ and used PPTP as my work VPN.</p></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="Prelim"></a>Preliminary Reading</h2></div></div></div><p>I recommend reading the <a class="ulink" href="VPNBasics.html" target="_self">VPN Basics</a> article if you plan to implement any type of VPN.</p></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="ServerFW"></a>PPTP Server Running on your Firewall</h2></div></div></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="Samba"></a>Configuring Samba</h3></div></div></div><p>You will need a WINS server (Samba configured to run as a WINS server is fine). Global section from /etc/samba/smb.conf on my WINS server (192.168.1.3) is:</p><pre class="programlisting">[global] workgroup = TDM-NSTOP netbios name = WOOKIE server string = GNU/Linux Box encrypt passwords = Yes log file = /var/log/samba/%m.log max log size = 0 socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 os level = 65 domain master = True preferred master = True dns proxy = No wins support = Yes printing = lprng [homes] comment = Home Directories valid users = %S read only = No create mask = 0664 directory mask = 0775 [printers] comment = All Printers path = /var/spool/samba printable = Yes</pre></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="ConfigPppd"></a>Configuring pppd</h3></div></div></div><p>Here is a copy of my /etc/ppp/options.poptop file:</p><pre class="programlisting">ipparam PoPToP lock mtu 1490 mru 1490 ms-wins 192.168.1.3 ms-dns 206.124.146.177 multilink proxyarp auth +chap +chapms +chapms-v2 ipcp-accept-local ipcp-accept-remote lcp-echo-failure 30 lcp-echo-interval 5 deflate 0 mppe-128 mppe-stateless require-mppe require-mppe-stateless</pre><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><div class="itemizedlist"><ul type="disc"><li><p>System 192.168.1.3 acts as a WINS server so I have included that IP as the “<span class="quote">ms-wins</span>” value.</p></li><li><p>I have pointed the remote clients at my DNS server -- it has external address 206.124.146.177.</p></li><li><p>I am requiring 128-bit stateless compression.</p></li></ul></div></div><p>Here's my /etc/ppp/chap-secrets:</p><pre class="programlisting">Secrets for authentication using CHAP # client server secret IP addresses CPQTDM\\TEastep * <shhhhhh> 192.168.1.7 TEastep * <shhhhhh> 192.168.1.7</pre><p>I am the only user who connects to the server but I may connect either with or without a domain being specified. The system I connect from is my laptop so I give it the same IP address when tunneled in at it has when I use its wireless LAN card around the house.</p><p>You will also want the following in /etc/modules.conf:</p><pre class="programlisting">alias ppp-compress-18 ppp_mppe alias ppp-compress-21 bsd_comp alias ppp-compress-24 ppp_deflate alias ppp-compress-26 ppp_deflate</pre></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="ConfigPptpd"></a>Configuring pptpd</h3></div></div></div><p>PoPTop (pptpd) is available from <a class="ulink" href="http://www.poptop.org/" target="_self">http://www.poptop.org/</a>.</p><p>Here is a copy of my /etc/pptpd.conf file:</p><pre class="programlisting">option /etc/ppp/options.poptop speed 115200 localip 192.168.1.254 remoteip 192.168.1.33-38</pre><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><div class="itemizedlist"><ul type="disc"><li><p>I specify the /etc/ppp/options.poptop file as my ppp options file (I have several).</p></li><li><p>The local IP is the same as my internal interface's (192.168.1.254).</p></li><li><p>I have assigned a remote IP range that overlaps my local network. This, together with “<span class="quote">proxyarp</span>” in my /etc/ppp/options.poptop file make the remote hosts look like they are part of the local subnetwork.</p></li></ul></div></div><p>I use this file to start/stop pptpd -- I have this in /etc/init.d/pptpd:</p><pre class="programlisting">#!/bin/sh # # /etc/rc.d/init.d/pptpd # # chkconfig: 5 12 85 # description: control pptp server # case "$1" in start) echo 1 > /proc/sys/net/ipv4/ip_forward modprobe ppp_async modprobe ppp_generic modprobe ppp_mppe modprobe slhc if /usr/local/sbin/pptpd; then touch /var/lock/subsys/pptpd fi ;; stop) killall pptpd rm -f /var/lock/subsys/pptpd ;; restart) killall pptpd if /usr/local/sbin/pptpd; then touch /var/lock/subsys/pptpd fi ;; status) ifconfig ;; *) echo "Usage: $0 {start|stop|restart|status}" ;; esac</pre></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="ConfigFw"></a>Configuring Shorewall</h3></div></div></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="Basic"></a>Basic Setup</h4></div></div></div><p>Here' a basic setup that treats your remote users as if they were part of your <span class="bold"><strong>loc</strong></span> zone. Note that if your primary Internet connection uses ppp0, then be sure that <span class="bold"><strong>loc</strong></span> follows <span class="bold"><strong>net</strong></span> in /etc/shorewall/zones.</p><p><code class="filename">/etc/shorewall/tunnels</code>:</p><pre class="programlisting">#TYPE ZONE GATEWAY GATEWAY ZONE pptpserver net 0.0.0.0/0</pre><p><code class="filename">/etc/shorewall/interfaces</code>:</p><pre class="programlisting">#ZONE INTERFACE BROADCAST OPTIONS loc ppp+</pre></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="Zones"></a>Remote Users in a Separate Zone</h4></div></div></div><p>If you want to place your remote users in their own zone so that you can control connections between these users and the local network, follow this example. Note that if your primary Internet connection uses ppp0 then be sure that <span class="bold"><strong>vpn</strong></span> follows <span class="bold"><strong>net</strong></span> in /etc/shorewall/zones as shown below.</p><p><code class="filename">/etc/shorewall/tunnels</code>:</p><pre class="programlisting">#TYPE ZONE GATEWAY GATEWAY ZONE pptpserver net 0.0.0.0/0</pre><p><code class="filename">/etc/shorewall/zones</code>:</p><pre class="programlisting">#ZONE TYPE net ipv4 loc ipv4 vpn ipv4</pre><p><code class="filename">/etc/shorewall/interfaces</code>:</p><pre class="programlisting">#ZONE INTERFACE BROADCAST OPTIONS net eth0 206.124.146.255 norfc1918 loc eth2 192.168.10.255 vpn ppp+</pre><p>Your policies and rules may now be configured for traffic to/from the <span class="bold"><strong>vpn</strong></span> zone.</p></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="Hub"></a>Multiple Remote Networks</h4></div></div></div><p>Often there will be situations where you want multiple connections from remote networks with these networks having different firewalling requirements.</p><div><img src="images/MultiPPTP.png" /></div><p>Here's how you configure this in Shorewall. Note that if your primary Internet connection uses ppp0 then be sure that the <span class="bold"><strong>vpn{1-3}</strong></span> zones follows <span class="bold"><strong>net</strong></span> in /etc/shorewall/zones as shown below.</p><p><code class="filename">/etc/shorewall/tunnels</code>:</p><pre class="programlisting">#TYPE ZONE GATEWAY GATEWAY ZONE pptpserver net 0.0.0.0/0</pre><p><code class="filename">/etc/shorewall/zones</code>:</p><pre class="programlisting">#ZONE TYPE fw firewall net ipv4 loc ipv4 vpn1 ipv4 vpn2 ipv4 vpn3 ipv4</pre><p><code class="filename">/etc/shorewall/interfaces</code>:</p><pre class="programlisting">#ZONE INTERFACE BROADCAST OPTIONS net eth0 206.124.146.255 norfc1918 loc eth2 192.168.10.255 - ppp+</pre><p><code class="filename">/etc/shorewall/hosts</code>:</p><pre class="programlisting">#ZONE HOST(S) OPTIONS vpn1 ppp+:192.168.1.0/24 vpn2 ppp+:192.168.2.0/24 vpn3 ppp+:192.168.3.0/24</pre><p>Your policies and rules can now be configured using separate zones (vpn1, vpn2, and vpn3) for the three remote network.</p></div></div></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="ServerBehind"></a>PPTP Server Running Behind your Firewall</h2></div></div></div><p>If you have a single external IP address, add the following to your /etc/shorewall/rules file:</p><p><code class="filename">/etc/shorewall/rules</code>:</p><pre class="programlisting">#ACTION SOURCE DEST PROTO DEST PORT(S) DNAT net loc:<span class="emphasis"><em><server address></em></span> tcp 1723 DNAT net loc:<span class="emphasis"><em><server address></em></span> 47</pre><p>If you have multiple external IP address and you want to forward a single <<span class="emphasis"><em>external address</em></span>>, add the following to your /etc/shorewall/rules file:</p><p><code class="filename">/etc/shorewall/rules</code>:</p><pre class="programlisting">#ACTION SOURCE DEST PROTO DEST PORT(S) SOURCE ORIGINAL # PORT(S) DEST DNAT net loc:<span class="emphasis"><em><server address></em></span> tcp 1723 - <span class="emphasis"><em><external address></em></span> DNAT net loc:<span class="emphasis"><em><server address></em></span> 47 - - <span class="emphasis"><em><external address></em></span></pre><p>You will also want to add this entry to your <code class="filename">/etc/shorewall/masq</code> file:</p><pre class="programlisting">#INTERFACE SUBNET ADDRESS PROTO <<span class="emphasis"><em>external interface</em></span>> <<span class="emphasis"><em>server address</em></span>> <<span class="emphasis"><em>external address</em></span>> 47</pre><div class="important" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Important</h3><p>Be sure that the above entry comes <span class="bold"><strong>before</strong></span> any other entry that might match the server's address.</p></div></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="ClientsBehind"></a>PPTP Clients Running Behind your Firewall</h2></div></div></div><p>Please see <a class="ulink" href="VPN.htm" target="_self">this article</a>.</p></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="ClientFW"></a>PPTP Client Running on your Firewall</h2></div></div></div><p>The key elements of this setup are as follows:</p><div class="orderedlist"><ol type="1"><li><p>Define a zone for the remote network accessed via PPTP.</p></li><li><p>Associate that zone with a ppp interface.</p></li><li><p>Define rules for PPTP traffic to/from the firewall.</p></li><li><p>Define rules for traffic two and from the remote zone.</p></li></ol></div><p>Here are examples from one of my old setups:</p><p><code class="filename">/etc/shorewall/zones</code>:</p><pre class="programlisting">#ZONE TYPE cpq ipv4</pre><p><code class="filename">/etc/shorewall/interfaces</code>:</p><pre class="programlisting">#ZONE INTERFACE BROADCAST OPTIONS - ppp+</pre><p>/etc/shorewall/hosts:</p><pre class="programlisting">#ZONE HOST(S) OPTIONS cpq ppp+:!192.168.1.0/24</pre><p><code class="filename">/etc/shorewall/tunnels</code>:</p><pre class="programlisting">#TYPE ZONE GATEWAY GATEWAY ZONE pptpclient net 0.0.0.0/0</pre><p>I use the combination of interface and hosts file to define the “<span class="quote">cpq</span>” zone because I also run a PPTP server on my firewall (see above). Using this technique allows me to distinguish clients of my own PPTP server from arbitrary hosts at Compaq; I assign addresses in 192.168.1.0/24 to my PPTP clients and Compaq doesn't use that RFC1918 Class C subnet.</p><p>I use this script in /etc/init.d to control the client. The reason that I disable ECN when connecting is that the Compaq tunnel servers don't do ECN yet and reject the initial TCP connection request if I enable ECN :-(</p><pre class="programlisting">#!/bin/sh # # /etc/rc.d/init.d/pptp # # chkconfig: 5 60 85 # description: PPTP Link Control # NAME="Tandem" ADDRESS=tunnel-tandem.compaq.com USER='Tandem\tommy' ECN=0 DEBUG= start_pptp() { echo $ECN > /proc/sys/net/ipv4/tcp_ecn if /usr/sbin/pptp $ADDRESS user $USER noauth $DEBUG; then touch /var/lock/subsys/pptp echo "PPTP Connection to $NAME Started" fi } stop_pptp() { if killall /usr/sbin/pptp 2> /dev/null; then echo "Stopped pptp" else rm -f /var/run/pptp/* fi # if killall pppd; then # echo "Stopped pppd" # fi rm -f /var/lock/subsys/pptp echo 1 > /proc/sys/net/ipv4/tcp_ecn } case "$1" in start) echo "Starting PPTP Connection to ${NAME}..." start_pptp ;; stop) echo "Stopping $NAME PPTP Connection..." stop_pptp ;; restart) echo "Restarting $NAME PPTP Connection..." stop_pptp start_pptp ;; status) ifconfig ;; *) echo "Usage: $0 {start|stop|restart|status}" ;; esac</pre><p>Here's my /etc/ppp/options file:</p><pre class="programlisting"># # Identify this connection # ipparam Compaq # # Lock the port # lock # # We don't need the tunnel server to authenticate itself # noauth +chap +chapms +chapms-v2 multilink mrru 1614 # # Turn off transmission protocols we know won't be used # nobsdcomp nodeflate # # We want MPPE # mppe-128 mppe-stateless # # We want a sane mtu/mru # mtu 1000 mru 1000 # # Time this thing out of it goes poof # lcp-echo-failure 10 lcp-echo-interval 10</pre><p>My /etc/ppp/ip-up.local file sets up the routes that I need to route Compaq traffic through the PPTP tunnel:</p><pre class="programlisting">#/bin/sh case $6 in Compaq) route add -net 16.0.0.0 netmask 255.0.0.0 gw $5 $1 route add -net 130.252.0.0 netmask 255.255.0.0 gw $5 $1 route add -net 131.124.0.0 netmask 255.255.0.0 gw $5 $1 ... ;; esac</pre><p>Finally, I run the following script every five minutes under crond to restart the tunnel if it fails:</p><pre class="programlisting">#!/bin/sh restart_pptp() { /sbin/service pptp stop sleep 10 if /sbin/service pptp start; then /usr/bin/logger "PPTP Restarted" fi } if [ -n "`ps ax | grep /usr/sbin/pptp | grep -v grep`" ]; then exit 0 fi echo "Attempting to restart PPTP" restart_pptp > /dev/null 2>&1 &</pre><p><a class="ulink" href="ftp://ftp.shorewall.net/pub/shorewall/misc/Vonau" target="_self">Here's a script and corresponding ip-up.local</a> from Jerry Vonau <code class="email"><<a class="email" href="mailto:jvonau@home.com">jvonau@home.com</a>></code> that controls two PPTP connections.</p></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="PPTP_ADSL"></a>PPTP Client running on your Firewall with PPTP Server in an ADSL Modem</h2></div></div></div><p>Some ADSL systems in Europe (most notably in Austria and the Netherlands) feature a PPTP server builtinto an ADSL “<span class="quote">Modem</span>”. In this setup, an Ethernet interface is dedicated to supporting the PPTP tunnel between the firewall and the “<span class="quote">Modem</span>” while the actual Internet access is through PPTP (interface ppp0). If you have this type of setup, you need to modify the sample configuration that you downloaded as described in this section. <span class="bold"><strong>These changes are in addition to those described in the <a class="ulink" href="shorewall_quickstart_guide.htm" target="_self">QuickStart Guides</a>.</strong></span></p><p>Lets assume the following:</p><div class="itemizedlist"><ul type="disc"><li><p>ADSL Modem connected through eth0</p></li><li><p>Modem IP address = 192.168.1.1</p></li><li><p>eth0 IP address = 192.168.1.2</p></li></ul></div><p>The changes you need to make are as follows:</p><div class="orderedlist"><ol type="1"><li><p>Add this entry to /etc/shorewall/zones:</p><pre class="programlisting">#ZONE TYPE modem ipv4</pre><p>That entry defines a new zone called “<span class="quote">modem</span>” which will contain only your ADSL modem.</p></li><li><p>Add the following entry to /etc/shorewall/interfaces:</p><pre class="programlisting">#ZONE INTERFACE BROADCAST OPTIONS modem eth0 192.168.1.255 dhcp</pre><p>You will of course modify the “<span class="quote">net</span>” entry in /etc/shorewall/interfaces to specify “<span class="quote">ppp0</span>” as the interface as described in the QuickStart Guide corresponding to your setup.</p></li><li><p>Add the following to /etc/shorewall/tunnels:</p><pre class="programlisting">#TYPE ZONE GATEWAY GATEWAY ZONE pptpclient modem 192.168.1.1</pre><p>That entry allows a PPTP tunnel to be established between your Shorewall system and the PPTP server in the modem.</p></li></ol></div></div></div></body></html>