I recommend reading the VPN Basics article if you plan to implement any type of VPN.

If you have a single external IP address, add the following to your /etc/shorewall/rules file:

/etc/shorewall/rules:

#ACTION      SOURCE         DEST                  PROTO       DEST PORT(S)
DNAT         net            loc:<server address>  tcp         1723
DNAT         net            loc:<server address>  47

If you have multiple external IP address and you want to forward a single <external address>, add the following to your /etc/shorewall/rules file:

/etc/shorewall/rules:

#ACTION      SOURCE         DEST                  PROTO       DEST PORT(S)     SOURCE          ORIGINAL
#                                                                              PORT(S)         DEST
DNAT         net            loc:<server address>  tcp         1723             -               <external address>
DNAT         net            loc:<server address>  47          -                -               <external address>

You will also want to add this entry to your /etc/shorewall/masq file:

#INTERFACE             SUBNET             ADDRESS               PROTO
<external interface>   <server address>   <external address>    47

Pleas see this article.

The key elements of this setup are as follows:

Here are examples from one of my old setups:

/etc/shorewall/zones:

#ZONE          TYPE
cpq            ipv4

/etc/shorewall/interfaces:

#ZONE          INTERFACE        BROADCAST          OPTIONS
-              ppp+

/etc/shorewall/hosts:

#ZONE          HOST(S)                             OPTIONS
cpq            ppp+:!192.168.1.0/24

/etc/shorewall/tunnels:

#TYPE          ZONE             GATEWAY            GATEWAY ZONE
pptpclient     net              0.0.0.0/0

I use the combination of interface and hosts file to define the “cpq” zone because I also run a PPTP server on my firewall (see above). Using this technique allows me to distinguish clients of my own PPTP server from arbitrary hosts at Compaq; I assign addresses in 192.168.1.0/24 to my PPTP clients and Compaq doesn't use that RFC1918 Class C subnet.

I use this script in /etc/init.d to control the client. The reason that I disable ECN when connecting is that the Compaq tunnel servers don't do ECN yet and reject the initial TCP connection request if I enable ECN :-(

#!/bin/sh
#
# /etc/rc.d/init.d/pptp
#
# chkconfig: 5 60 85
# description: PPTP Link Control
#
NAME="Tandem"
ADDRESS=tunnel-tandem.compaq.com
USER='Tandem\tommy'
ECN=0
DEBUG=

start_pptp() {
    echo $ECN > /proc/sys/net/ipv4/tcp_ecn
    if /usr/sbin/pptp $ADDRESS user $USER noauth $DEBUG; then
        touch /var/lock/subsys/pptp
        echo "PPTP Connection to $NAME Started"
    fi
}

stop_pptp() {
    if killall /usr/sbin/pptp 2> /dev/null; then
        echo "Stopped pptp"
    else
        rm -f /var/run/pptp/*
    fi

    # if killall pppd; then
    # echo "Stopped pppd"
    # fi

    rm -f /var/lock/subsys/pptp

    echo 1 > /proc/sys/net/ipv4/tcp_ecn
}


case "$1" in
start)
    echo "Starting PPTP Connection to ${NAME}..."
    start_pptp
    ;;
stop)
    echo "Stopping $NAME PPTP Connection..."
    stop_pptp
    ;;
restart)
    echo "Restarting $NAME PPTP Connection..."
    stop_pptp
    start_pptp
    ;;
status)
    ifconfig
    ;;
*)
    echo "Usage: $0 {start|stop|restart|status}"
    ;;
esac

Here's my /etc/ppp/options file:

#
# Identify this connection
#
ipparam Compaq
#
# Lock the port
#
lock
#
# We don't need the tunnel server to authenticate itself
#
noauth

+chap
+chapms
+chapms-v2

multilink
mrru 1614
#
# Turn off transmission protocols we know won't be used
#
nobsdcomp
nodeflate

#
# We want MPPE
#
mppe-128
mppe-stateless

#
# We want a sane mtu/mru
#
mtu 1000
mru 1000

#
# Time this thing out of it goes poof
#
lcp-echo-failure 10
lcp-echo-interval 10

My /etc/ppp/ip-up.local file sets up the routes that I need to route Compaq traffic through the PPTP tunnel:

#/bin/sh

case $6 in
Compaq)
    route add -net 16.0.0.0 netmask 255.0.0.0 gw $5 $1
    route add -net 130.252.0.0 netmask 255.255.0.0 gw $5 $1
    route add -net 131.124.0.0 netmask 255.255.0.0 gw $5 $1
    ...
    ;;
esac

Finally, I run the following script every five minutes under crond to restart the tunnel if it fails:

#!/bin/sh
restart_pptp() {
    /sbin/service pptp stop
    sleep 10
    if /sbin/service pptp start; then
        /usr/bin/logger "PPTP Restarted"
    fi
}

if [ -n "`ps ax | grep /usr/sbin/pptp | grep -v grep`" ]; then
    exit 0
fi

echo "Attempting to restart PPTP"

restart_pptp > /dev/null 2>&1 &

Here's a script and corresponding ip-up.local from Jerry Vonau <[email protected]> that controls two PPTP connections.

Some ADSL systems in Europe (most notably in Austria and the Netherlands) feature a PPTP server built into an ADSL “Modem”. In this setup, an ethernet interface is dedicated to supporting the PPTP tunnel between the firewall and the “Modem” while the actual internet access is through PPTP (interface ppp0). If you have this type of setup, you need to modify the sample configuration that you downloaded as described in this section. These changes are in addition to those described in the QuickStart Guides.

Lets assume the following:

The changes you need to make are as follows: