Background:
Setting up a PPTP VPN server is an essential skill for every webmaster, and the process is quite straightforward.
Configuration Details:
OS: CentOS 6.4 x86_64 Minimal
1. Install the EPEL repository
# yum install http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm
2. Install the PPTP repository
# yum install http://poptop.sourceforge.net/yum/stable/rhel6/pptp-release-current.noarch.rpm
3. Install the PPTP VPN Server
# yum install pptpd
4. Edit /etc/pptpd.conf
# vim /etc/pptpd.conf
############################################################################### # $Id: pptpd.conf,v 1.11 2011/05/19 00:02:50 quozl Exp $ # # Sample Poptop configuration file /etc/pptpd.conf # # Changes are effective when pptpd is restarted. ############################################################################### # TAG: ppp # Path to the pppd program, default '/usr/sbin/pppd' on Linux # #ppp /usr/sbin/pppd # TAG: option # Specifies the location of the PPP options file. # By default PPP looks in '/etc/ppp/options' # option /etc/ppp/options.pptpd # TAG: debug # Turns on (more) debugging to syslog # debug # TAG: stimeout # Specifies timeout (in seconds) on starting ctrl connection # stimeout 120 # TAG: noipparam # Suppress the passing of the client's IP address to PPP, which is # done by default otherwise. # #noipparam # TAG: logwtmp # Use wtmp(5) to record client connections and disconnections. # #logwtmp # TAG: vrf <vrfname> # Switches PPTP & GRE sockets to the specified VRF, which must exist # Only available if VRF support was compiled into pptpd. # #vrf test # TAG: bcrelay <if> # Turns on broadcast relay to clients from interface <if> # #bcrelay eth1 # TAG: delegate # Delegates the allocation of client IP addresses to pppd. # # Without this option, which is the default, pptpd manages the list of # IP addresses for clients and passes the next free address to pppd. # With this option, pptpd does not pass an address, and so pppd may use # radius or chap-secrets to allocate an address. # #delegate # TAG: connections # Limits the number of client connections that may be accepted. # # If pptpd is allocating IP addresses (e.g. delegate is not # used) then the number of connections is also limited by the # remoteip option. The default is 100. #connections 100 # TAG: localip # TAG: remoteip # Specifies the local and remote IP address ranges. # # These options are ignored if delegate option is set. # # Any addresses work as long as the local machine takes care of the # routing. But if you want to use MS-Windows networking, you should # use IP addresses out of the LAN address space and use the proxyarp # option in the pppd options file, or run bcrelay. # # You can specify single IP addresses seperated by commas or you can # specify ranges, or both. For example: # # 192.168.0.234,192.168.0.245-249,192.168.0.254 # # IMPORTANT RESTRICTIONS: # # 1. No spaces are permitted between commas or within addresses. # # 2. If you give more IP addresses than the value of connections, # it will start at the beginning of the list and go until it # gets connections IPs. Others will be ignored. # # 3. No shortcuts in ranges! ie. 234-8 does not mean 234 to 238, # you must type 234-238 if you mean this. # # 4. If you give a single localIP, that's ok - all local IPs will # be set to the given one. You MUST still give at least one remote # IP for each simultaneous client. # # (Recommended) #localip 192.168.0.1 #remoteip 192.168.0.234-238,192.168.0.245 # or #localip 192.168.0.234-238,192.168.0.245 #remoteip 192.168.1.234-238,192.168.1.245 localip 10.192.168.1 remoteip 10.192.168.100-200
Note: In the above configuration file,
The path to the PPP configuration file is specified: option /etc/ppp/options.pptpd
Debug logging is enabled: debug
The timeout for establishing a connection is set to 120 seconds: stimeout 120
The local IP address of the PPTP VPN Server (the gateway address automatically obtained by clients): localip 10.192.168.1
The range of IP addresses assigned to clients: remoteip 10.192.168.100-200
5. Edit /etc/ppp/options.pptpd
###############################################################################
# $Id: options.pptpd,v 1.11 2005/12/29 01:21:09 quozl Exp $
#
# Sample Poptop PPP options file /etc/ppp/options.pptpd
# Options used by PPP when a connection arrives from a client.
# This file is pointed to by /etc/pptpd.conf option keyword.
# Changes are effective on the next connection. See "man pppd".
#
# You are expected to change this file to suit your system. As
# packaged, it requires PPP 2.4.2 and the kernel MPPE module.
###############################################################################
# Authentication
# Name of the local system for authentication purposes
# (must match the second field in /etc/ppp/chap-secrets entries)
name ec2-tokyo
# Strip the domain prefix from the username before authentication.
# (applies if you use pppd with chapms-strip-domain patch)
#chapms-strip-domain
# Encryption
# (There have been multiple versions of PPP with encryption support,
# choose with of the following sections you will use.)
# BSD licensed ppp-2.4.2 upstream with MPPE only, kernel module ppp_mppe.o
# {{{
refuse-pap
refuse-chap
refuse-mschap
# Require the peer to authenticate itself using MS-CHAPv2 [Microsoft
# Challenge Handshake Authentication Protocol, Version 2] authentication.
require-mschap-v2
# Require MPPE 128-bit encryption
# (note that MPPE requires the use of MSCHAP-V2 during authentication)
require-mppe-128
# }}}
# OpenSSL licensed ppp-2.4.1 fork with MPPE only, kernel module mppe.o
# {{{
#-chap
#-chapms
# Require the peer to authenticate itself using MS-CHAPv2 [Microsoft
# Challenge Handshake Authentication Protocol, Version 2] authentication.
#+chapms-v2
# Require MPPE encryption
# (note that MPPE requires the use of MSCHAP-V2 during authentication)
#mppe-40 # enable either 40-bit or 128-bit, not both
#mppe-128
#mppe-stateless
# }}}
# Network and Routing
# If pppd is acting as a server for Microsoft Windows clients, this
# option allows pppd to supply one or two DNS (Domain Name Server)
# addresses to the clients. The first instance of this option
# specifies the primary DNS address; the second instance (if given)
# specifies the secondary DNS address.
#ms-dns 10.0.0.1
#ms-dns 10.0.0.2
ms-dns 172.31.0.2
# If pppd is acting as a server for Microsoft Windows or "Samba"
# clients, this option allows pppd to supply one or two WINS (Windows
# Internet Name Services) server addresses to the clients. The first
# instance of this option specifies the primary WINS address; the
# second instance (if given) specifies the secondary WINS address.
#ms-wins 10.0.0.3
#ms-wins 10.0.0.4
# Add an entry to this system's ARP [Address Resolution Protocol]
# table with the IP address of the peer and the Ethernet address of this
# system. This will have the effect of making the peer appear to other
# systems to be on the local ethernet.
# (you do not need this if your PPTP server is responsible for routing
# packets to the clients -- James Cameron)
proxyarp
# Normally pptpd passes the IP address to pppd, but if pptpd has been
# given the delegate option in pptpd.conf or the --delegate command line
# option, then pppd will use chap-secrets or radius to allocate the
# client IP address. The default local IP address used at the server
# end is often the same as the address of the server. To override this,
# specify the local IP address here.
# (you must not use this unless you have used the delegate option)
#10.8.0.100
# Logging
# Enable connection debugging facilities.
# (see your syslog configuration for where pppd sends to)
debug
# Print out all the option values which have been set.
# (often requested by mailing list to verify options)
dump
# Miscellaneous
# Create a UUCP-style lock file for the pseudo-tty to ensure exclusive
# access.
lock
# Disable BSD-Compress compression
nobsdcomp
# Disable Van Jacobson compression
# (needed on some networks with Windows 9x/ME/XP clients, see posting to
# poptop-server on 14th April 2005 by Pawel Pokrywka and followups,
# http://marc.theaimsgroup.com/?t=111343175400006&r=1&w=2 )
novj
novjccomp
# turn off logging to stderr, since this may be redirected to pptpd,
# which may trigger a loopback
nologfd
# put plugins here
# (putting them higher up may cause them to sent messages to the pty)
logfile /var/log/pptpd.log
multilink
Note: In the above configuration file,
The service name of the PPTP VPN Server is defined: name ec2-tokyo
Encryption rules are defined as follows:
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
The DNS address pushed to clients is defined: ms-dns 172.31.0.2 (I usually select the default DNS settings of the server where the PPTP VPN Server is located)
Allows hosts in the same LAN to be visible to each other on the PPTP VPN Server: proxyarp
Debug information is enabled: debug
Some common settings are enabled as follows:
dump
lock
nobsdcomp
novj
novjccomp
nologfd
The location of the log file is specified: logfile /var/log/pptpd.log
Allows binding multiple physical channels into a single logical channel: multilink
6. Edit the user account password file /etc/ppp/chap-secrets
# vim /etc/ppp/chap-secrets
# Secrets for authentication using CHAP # client server secret IP addresses "yunwei123.com" * "password" *
7. Edit /etc/sysconfig/iptables-config
Change IPTABLES_MODULES=”” to IPTABLES_MODULES=”ip_nat_pptp” to ensure the module is automatically loaded when the iptables service starts.
8. Edit /etc/sysconfig/iptables (assuming eth0 is the network interface with the public IP address)
# vim /etc/sysconfig/iptables
*filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p gre -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 1723 -j ACCEPT -A INPUT -s 10.192.168.0/255.255.255.0 -m state --state NEW -m tcp -p tcp -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT *nat :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A POSTROUTING -s 10.192.168.0/255.255.255.0 -o eth0 -j MASQUERADE COMMIT
Note: In the above iptables script,
All GRE protocol packets are allowed;
TCP port 1723 is allowed;
The entire PPTP VPN LAN address segment 10.192.168.0/24 is allowed;
The entire PPTP VPN LAN address segment 10.192.168.0/24 is NAT-mapped to the eth0 interface to enable shared internet access;
9. Enable data forwarding by editing /etc/sysctl.conf
Change net.ipv4.ip_forward = 0 to net.ipv4.ip_forward = 1
Execute sysctl -p
10. Start the PPTP VPN Server
# /etc/init.d/pptpd restart
# /etc/init.d/iptables restart
11. Set PPTP VPN Server and iptables services to start on boot
# chkconfig pptpd on
# chkconfig iptables on
12. Configure the client on your local PC and connect to the PPTP VPN Server
ps Regarding iptables configuration for OpenVPN deployment
If you successfully dial in after installing OpenVPN and can log in to the OpenVPN server, but cannot access any other internal network machines, you need to configure iptables to allow login to any machine in the internal network.
1. Enable system forwarding
[root@who-am-i ~]# vim /etc/sysctl.conf
net.ipv4.ip_forward = 1
[root@who-am-i ~]# sysctl -p
2. Add iptables rules
[root@who-am-i ~]# vim /bin/iptables.sh
iptables -t nat -F
openvpn
iptables -A INPUT -p tcp –destination-port 1194 -j ACCEPT
iptables -A INPUT -i tun0 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.85.0/24 -j SNAT –to-source 10.10.10.167
#iptables -A FORWARD -j DROP
Explanation:
First, delete all nat tables.
Open the OpenVPN service monitoring port 1194.
Open the OpenVPN virtual network device tun0.
Open lo.
Add a nat rule to perform source address masquerading for all packets with a source address (assigned by OpenVPN to clients) of 192.168.85.0/24 after forwarding, masquerading them as the OpenVPN server’s internal IP address 10.10.10.167, allowing communication with other machines in the internal network.
Comment out the default rule iptables -A FORWARD -j DROP to allow forwarding of any packet.