PPTP

The Linux PPTP client project has a nice GUI for configuring and managing VPN connections where your Linux system is the PPTP client. This is what I currently use. I am no longer running PoPToP but rather I use the PPTP Server included with XP Professional (see PPTP Server running behind your Firewall below).

I am leaving the instructions for building MPPE-enabled kernels and pppd in the text below for those who may wish to obtain the relevant current patches and “roll their own”.

I recommend reading the VPN Basics article if you plan to implement any type of VPN.

I will try to give you an idea of how to set up a PPTP server on your firewall system. This isn't a detailed HOWTO but rather an example of how I have set up a working PPTP server on my own firewall.

The steps involved are:

cd ppp-2.4.1
patch -p1 < ../ppp-2.4.0-openssl-0.9.6-mppe.patch
patch -p1 < ../ppp-2.4.1-MSCHAPv2-fix.patch
(Optional) patch -p1 < ../require-mppe.diff
./configure
make

Patching and building your Kernel

You will need one of the following patches depending on your kernel version:

http://www.shorewall.net/pub/shorewall/pptp/linux-2.4.4-openssl-0.9.6a-mppe-patch.gz

http://www.shorewall/net/pub/shorewall/pptp/linux-2.4.16-openssl-0.9.6b-mppe-patch.gz

Uncompress the patch into the same directory where your top-level kernel source is located and:

cd <your GNU/Linux source top-level directory>
patch -p1 < ../linux-2.4.16-openssl-0.9.6b-mppe.patch

Now configure your kernel. Here is my ppp configuration:

[global]
     workgroup = TDM-NSTOP
     netbios name = WOOKIE
     server string = GNU/Linux Box
     encrypt passwords = Yes
     log file = /var/log/samba/%m.log
     max log size = 0
     socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
     os level = 65
     domain master = True
     preferred master = True
     dns proxy = No
     wins support = Yes
     printing = lprng

[homes]
     comment = Home Directories
     valid users = %S
     read only = No
     create mask = 0664
     directory mask = 0775

[printers]
     comment = All Printers
     path = /var/spool/samba
     printable = Yes

ipparam PoPToP
lock
mtu 1490
mru 1490
ms-wins 192.168.1.3
ms-dns 206.124.146.177
multilink
proxyarp
auth
+chap
+chapms
+chapms-v2
ipcp-accept-local
ipcp-accept-remote
lcp-echo-failure 30
lcp-echo-interval 5
deflate 0
mppe-128
mppe-stateless
require-mppe
require-mppe-stateless

Secrets for authentication using CHAP
# client        server    secret    IP addresses
CPQTDM\\TEastep *         <shhhhhh> 192.168.1.7
TEastep         *         <shhhhhh> 192.168.1.7

alias ppp-compress-18 ppp_mppe
alias ppp-compress-21 bsd_comp
alias ppp-compress-24 ppp_deflate
alias ppp-compress-26 ppp_deflate

option /etc/ppp/options.poptop
speed 115200
localip 192.168.1.254
remoteip 192.168.1.33-38

#!/bin/sh
#
# /etc/rc.d/init.d/pptpd
#
# chkconfig: 5 12 85
# description: control pptp server
#

case "$1" in
start)
    echo 1 > /proc/sys/net/ipv4/ip_forward
    modprobe ppp_async
    modprobe ppp_generic
    modprobe ppp_mppe
    modprobe slhc
    if /usr/local/sbin/pptpd; then
        touch /var/lock/subsys/pptpd
    fi
    ;;
stop)
    killall pptpd
    rm -f /var/lock/subsys/pptpd
    ;;
restart)
    killall pptpd
    if /usr/local/sbin/pptpd; then
        touch /var/lock/subsys/pptpd
    fi
    ;;
status)
    ifconfig
    ;;
*)
    echo "Usage: $0 {start|stop|restart|status}"
    ;;
esac

Configuring Shorewall

Basic Setup

Here' a basic setup that treats your remote users as if they were part of your loc zone. Note that if your primary internet connection uses ppp0, then be sure that loc follows net in /etc/shorewall/zones.

/etc/shorewall/tunnels:

#TYPE           ZONE             GATEWAY           GATEWAY ZONE
pptpserver      net              0.0.0.0/0

/etc/shorewall/interfaces:

#ZONE          INTERFACE         BROADCAST        OPTIONS
loc            ppp+

Remote Users in a Separate Zone

If you want to place your remote users in their own zone so that you can control connections between these users and the local network, follow this example. Note that if your primary internet connection uses ppp0 then be sure that vpn follows net in /etc/shorewall/zones as shown below.

/etc/shorewall/tunnels:

#TYPE           ZONE             GATEWAY           GATEWAY ZONE
pptpserver      net              0.0.0.0/0

/etc/shorewall/zones:

#ZONE           DISPLAY          COMMENTS
net             Internet         The Internet
loc             Local            Local Network
vpn             VPN              Remote Users

/etc/shorewall/interfaces:

#ZONE          INTERFACE         BROADCAST        OPTIONS
net            eth0              206.124.146.255  norfc1918
loc            eth2              192.168.10.255
vpn            ppp+

Your policies and rules may now be configured for traffic to/from the vpn zone.

Multiple Remote Networks

Often there will be situations where you want multiple connections from remote networks with these networks having different firewalling requirements.

Here's how you configure this in Shorewall. Note that if your primary internet connection uses ppp0 then be sure that the vpn{1-3} zones follows net in /etc/shorewall/zones as shown below.

/etc/shorewall/tunnels:

#TYPE           ZONE             GATEWAY           GATEWAY ZONE
pptpserver      net              0.0.0.0/0

/etc/shorewall/zones:

#ZONE           DISPLAY          COMMENTS
net             Internet         The Internet
loc             Local            Local Network
vpn1            Remote1          Remote Network 1
vpn2            Remote2          Remote Network 2
vpn3            Remote3          Remote Network 3

/etc/shorewall/interfaces:

#ZONE          INTERFACE         BROADCAST        OPTIONS
net            eth0              206.124.146.255  norfc1918
loc            eth2              192.168.10.255
-              ppp+

/etc/shorewall/hosts:

#ZONE          HOST(S)                   OPTIONS
vpn1           ppp+:192.168.1.0/24
vpn2           ppp+:192.168.2.0/24
vpn3           ppp+:192.168.3.0/24

Your policies and rules can now be configured using separate zones (vpn1, vpn2, and vpn3) for the three remote network.

If you have a single external IP address, add the following to your /etc/shorewall/rules file:

/etc/shorewall/rules:

#ACTION      SOURCE         DEST                  PROTO       DEST PORT(S)
DNAT         net            loc:<server address>  tcp         1723
DNAT         net            loc:<server address>  47

If you have multiple external IP address and you want to forward a single <external address>, add the following to your /etc/shorewall/rules file:

/etc/shorewall/rules:

#ACTION      SOURCE         DEST                  PROTO       DEST PORT(S)     SOURCE          ORIGINAL
#                                                                              PORT(S)         DEST
DNAT         net            loc:<server address>  tcp         1723             -               <external address>
DNAT         net            loc:<server address>  47          -                -               <external address>

You shouldn't have to take any special action for this case unless you wish to connect multiple clients to the same external server. In that case, you must install the PPTP connection/tracking and NAT patch from Netfilter Patch-O-Matic (some distributions are now shipping with this patch installed). I recommend that you also add these four lines to your /etc/shorewall/modules file:

loadmodule ip_conntrack_proto_gre
loadmodule ip_conntrack_pptp
loadmodule ip_nat_pptp
loadmodule ip_nat_proto_gre

For LEAF/Bering users, the 2.4.20 kernel as already been patched as described at the URL above and the three modules are included in the Bering 1.2 modules tarball.

The PPTP GNU/Linux client is available at http://sourceforge.net/projects/pptpclient/. Rather than use the configuration script that comes with the client, I built my own. I also build my own kernel as described above rather than using the mppe package that is available with the client. My /etc/ppp/options file is mostly unchanged from what came with the client (see below).

The key elements of this setup are as follows:

Here are examples from one of my old setups:

/etc/shorewall/zones:

#ZONE          DISPLAY          COMMENTS
cpq            Compaq           Compaq Intranet

/etc/shorewall/interfaces:

#ZONE          INTERFACE        BROADCAST          OPTIONS
-              ppp+

/etc/shorewall/hosts:

#ZONE          HOST(S)                             OPTIONS
cpq            ppp+:!192.168.1.0/24

/etc/shorewall/tunnels:

#TYPE          ZONE             GATEWAY            GATEWAY ZONE
pptpclient     net              0.0.0.0/0

I use the combination of interface and hosts file to define the “cpq” zone because I also run a PPTP server on my firewall (see above). Using this technique allows me to distinguish clients of my own PPTP server from arbitrary hosts at Compaq; I assign addresses in 192.168.1.0/24 to my PPTP clients and Compaq doesn't use that RFC1918 Class C subnet.

I use this script in /etc/init.d to control the client. The reason that I disable ECN when connecting is that the Compaq tunnel servers don't do ECN yet and reject the initial TCP connection request if I enable ECN :-(

#!/bin/sh
#
# /etc/rc.d/init.d/pptp
#
# chkconfig: 5 60 85
# description: PPTP Link Control
#
NAME="Tandem"
ADDRESS=tunnel-tandem.compaq.com
USER='Tandem\tommy'
ECN=0
DEBUG=

start_pptp() {
    echo $ECN > /proc/sys/net/ipv4/tcp_ecn
    if /usr/sbin/pptp $ADDRESS user $USER noauth $DEBUG; then
        touch /var/lock/subsys/pptp
        echo "PPTP Connection to $NAME Started"
    fi
}

stop_pptp() {
    if killall /usr/sbin/pptp 2> /dev/null; then
        echo "Stopped pptp"
    else
        rm -f /var/run/pptp/*
    fi

    # if killall pppd; then
    # echo "Stopped pppd"
    # fi

    rm -f /var/lock/subsys/pptp

    echo 1 > /proc/sys/net/ipv4/tcp_ecn
}


case "$1" in
start)
    echo "Starting PPTP Connection to ${NAME}..."
    start_pptp
    ;;
stop)
    echo "Stopping $NAME PPTP Connection..."
    stop_pptp
    ;;
restart)
    echo "Restarting $NAME PPTP Connection..."
    stop_pptp
    start_pptp
    ;;
status)
    ifconfig
    ;;
*)
    echo "Usage: $0 {start|stop|restart|status}"
    ;;
esac

Here's my /etc/ppp/options file:

#
# Identify this connection
#
ipparam Compaq
#
# Lock the port
#
lock
#
# We don't need the tunnel server to authenticate itself
#
noauth

+chap
+chapms
+chapms-v2

multilink
mrru 1614
#
# Turn off transmission protocols we know won't be used
#
nobsdcomp
nodeflate

#
# We want MPPE
#
mppe-128
mppe-stateless

#
# We want a sane mtu/mru
#
mtu 1000
mru 1000

#
# Time this thing out of it goes poof
#
lcp-echo-failure 10
lcp-echo-interval 10

My /etc/ppp/ip-up.local file sets up the routes that I need to route Compaq traffic through the PPTP tunnel:

#/bin/sh

case $6 in
Compaq)
    route add -net 16.0.0.0 netmask 255.0.0.0 gw $5 $1
    route add -net 130.252.0.0 netmask 255.255.0.0 gw $5 $1
    route add -net 131.124.0.0 netmask 255.255.0.0 gw $5 $1
    ...
    ;;
esac

Finally, I run the following script every five minutes under crond to restart the tunnel if it fails:

#!/bin/sh
restart_pptp() {
    /sbin/service pptp stop
    sleep 10
    if /sbin/service pptp start; then
        /usr/bin/logger "PPTP Restarted"
    fi
}

if [ -n "`ps ax | grep /usr/sbin/pptp | grep -v grep`" ]; then
    exit 0
fi

echo "Attempting to restart PPTP"

restart_pptp > /dev/null 2>&1 &

Here's a script and corresponding ip-up.local from Jerry Vonau <[email protected]> that controls two PPTP connections.

Some ADSL systems in Europe (most notably in Austria) feature a PPTP server built into an ADSL “Modem”. In this setup, an ethernet interface is dedicated to supporting the PPTP tunnel between the firewall and the “Modem” while the actual internet access is through PPTP (interface ppp0). If you have this type of setup, you need to modify the sample configuration that you downloaded as described in this section. These changes are in addition to those described in the QuickStart Guides.

Lets assume the following:

The changes you need to make are as follows: