2002-11-09 19:06:34 +01:00
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
2002-08-13 22:45:21 +02:00
< html >
< head >
2002-11-09 19:06:34 +01:00
< meta http-equiv = "Content-Language" content = "en-us" >
< meta http-equiv = "Content-Type"
content="text/html; charset=windows-1252">
< meta name = "GENERATOR" content = "Microsoft FrontPage 5.0" >
< meta name = "ProgId" content = "FrontPage.Editor.Document" >
< title > Shorewall PPTP< / title >
2002-08-13 22:45:21 +02:00
< / head >
2003-08-09 19:14:58 +02:00
< body >
2002-11-09 19:06:34 +01:00
< table border = "0" cellpadding = "0" cellspacing = "0"
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
2003-07-16 20:59:33 +02:00
id="AutoNumber1" bgcolor="#3366ff" height="90">
2003-08-09 19:14:58 +02:00
< tbody >
< tr >
< td width = "100%" >
2002-11-09 19:06:34 +01:00
< h1 align = "center" > < font color = "#ffffff" > PPTP< / font > < / h1 >
2003-08-09 19:14:58 +02:00
< / td >
< / tr >
< / tbody >
2002-08-22 23:21:41 +02:00
< / table >
2003-08-09 19:14:58 +02:00
< h4 > NOTE: I am no longer attempting to maintain MPPE patches for
current
Linux kernel's and pppd. I recommend that you refer to the following
URLs
for information about installing MPPE into your kernel and pppd.< / h4 >
< h4 > The < a href = "http://pptpclient.sourceforge.net" > Linux PPTP client
project
< / a > has a nice GUI for configuring and managing VPN connections where
your
Linux system is the PPTP client. This is what I currently use. I am no
longer
running PoPToP but rather I use the PPTP Server included with XP
Professional
(see < a href = "#ServerBehind" > PPTP Server running behind your Firewall< / a >
2003-05-15 21:39:23 +02:00
below).< / h4 >
2003-08-09 19:14:58 +02:00
< a href = "http://pptpclient.sourceforge.net" > http://pptpclient.sourceforge.net< / a >
2003-05-15 21:39:23 +02:00
(Everything you need to run a PPTP client).< br >
2003-08-09 19:14:58 +02:00
< a href = "http://www.poptop.org" > http://www.poptop.org< / a >
(The 'kernelmod'
package can be used to quickly install MPPE into your kernel without
rebooting).< br >
< h4 > I am leaving the instructions for building MPPE-enabled kernels and
pppd
in the text below for those who may wish to obtain the relevant current
patches
2003-05-15 21:39:23 +02:00
and "roll their own".< br >
2003-08-09 19:14:58 +02:00
< / h4 >
< hr width = "100%" size = "2" >
< p align = "left" > Shorewall easily supports PPTP in a number of
configurations:< / p >
2002-08-13 22:45:21 +02:00
< ul >
2003-08-09 19:14:58 +02:00
< li > < a href = "#ServerFW" > PPTP Server running on your Firewall< / a > < / li >
< li > < a href = "#ServerBehind" > PPTP Server running behind your
Firewall.< / a > < / li >
< li > < a href = "#ClientsBehind" > PPTP Clients running behind your
Firewall.< / a > < / li >
< li > < a href = "#ClientFW" > PPTP Client running on your Firewall.< / a > < / li >
< li > < a href = "#PPTP_ADSL" > PPTP Client running on your Firewall with
PPTP
Server in an ADSL Modem< / a > < / li >
2002-08-13 22:45:21 +02:00
< / ul >
2003-08-09 19:14:58 +02:00
< h2 align = "center" > < a name = "ServerFW" > < / a > 1. PPTP Server Running on
your
Firewall< / h2 >
< p > I will try to give you an idea of how to set up a PPTP server on
your
firewall system. This isn't a detailed HOWTO but rather an example of
how
I have set up a working PPTP server on my own firewall.< / p >
2002-08-13 22:45:21 +02:00
< p > The steps involved are:< / p >
< ol >
2003-08-09 19:14:58 +02:00
< li > < a href = "#PatchPppd" > Patching and building pppd< / a > < / li >
< li > < a href = "#PatchKernel" > Patching and building your Kernel< / a > < / li >
< li > < a href = "#Samba" > Configuring Samba< / a > < / li >
< li > < a href = "#ConfigPppd" > Configuring pppd< / a > < / li >
< li > < a href = "#ConfigPptpd" > Configuring pptpd< / a > < / li >
< li > < a href = "#ConfigFw" > Configuring Shorewall< / a > < / li >
2002-08-13 22:45:21 +02:00
< / ol >
< h3 > < a name = "PatchPppd" > < / a > Patching and Building pppd< / h3 >
2003-08-09 19:14:58 +02:00
< p > To run pppd on a 2.4 kernel, you need the pppd 2.4.1 or later. The
primary
site for releases of pppd is < a href = "ftp://ftp.samba.org/pub/ppp" > ftp://ftp.samba.org/pub/ppp< / a > .< / p >
2002-08-13 22:45:21 +02:00
< p > You will need the following patches:< / p >
< ul >
2003-08-09 19:14:58 +02:00
< li > < a
2002-11-09 19:06:34 +01:00
href="http://www.shorewall.net/pub/shorewall/pptp/ppp-2.4.1-openssl-0.9.6-mppe-patch.gz">http://www.shorewall.net/pub/shorewall/pptp/ppp-2.4.1-openssl-0.9.6-mppe-patch.gz< / a > < / li >
2003-08-09 19:14:58 +02:00
< li > < a
2002-11-09 19:06:34 +01:00
href="http://www.shorewall.net/pub/shorewall/pptp/ppp-2.4.1-MSCHAPv2-fix.patch.gz">http://www.shorewall.net/pub/shorewall/pptp/ppp-2.4.1-MSCHAPv2-fix.patch.gz< / a > < / li >
2002-08-13 22:45:21 +02:00
< / ul >
2003-08-09 19:14:58 +02:00
< p > You may also want the following patch if you want to require remote
hosts
to use encryption:< / p >
2002-08-13 22:45:21 +02:00
< ul >
2003-08-09 19:14:58 +02:00
< li > < a
2002-11-09 19:06:34 +01:00
href="ftp://ftp.shorewall.net/pub/shorewall/pptp/require-mppe.diff">ftp://ftp.shorewall.net/pub/shorewall/pptp/require-mppe.diff< / a > < / li >
2002-08-13 22:45:21 +02:00
< / ul >
2003-08-09 19:14:58 +02:00
< p > Un-tar the pppd source and uncompress the patches into one directory
(the
patches and the ppp-2.4.1 directory are all in a single parent
directory):< / p >
2002-08-13 22:45:21 +02:00
< ul >
2003-08-09 19:14:58 +02:00
< li > cd ppp-2.4.1< / li >
< li > patch -p1 < ../ppp-2.4.0-openssl-0.9.6-mppe.patch< / li >
< li > patch -p1 < ../ppp-2.4.1-MSCHAPv2-fix.patch< / li >
< li > (Optional) patch -p1 < ../require-mppe.diff< / li >
< li > ./configure< / li >
< li > make< / li >
2002-08-13 22:45:21 +02:00
< / ul >
2003-08-09 19:14:58 +02:00
< p > You will need to install the resulting binary on your firewall
system.
To do that, I NFS mount my source filesystem and use "make install"
from
2003-05-15 21:39:23 +02:00
the ppp-2.4.1 directory.< / p >
2002-08-13 22:45:21 +02:00
< h3 > < a name = "PatchKernel" > < / a > Patching and Building your Kernel< / h3 >
2003-08-09 19:14:58 +02:00
< p > You will need one of the following patches depending on your kernel
version:< / p >
2002-08-13 22:45:21 +02:00
< ul >
2003-08-09 19:14:58 +02:00
< li > < a
2002-11-09 19:06:34 +01:00
href="http://www.shorewall.net/pub/shorewall/pptp/linux-2.4.4-openssl-0.9.6a-mppe-patch.gz">http://www.shorewall.net/pub/shorewall/pptp/linux-2.4.4-openssl-0.9.6a-mppe-patch.gz< / a > < / li >
2003-08-09 19:14:58 +02:00
< li > < a
2002-11-09 19:06:34 +01:00
href="http://www.shorewall.net/pub/shorewall/pptp/linux-2.4.16-openssl-0.9.6b-mppe-patch.gz">http://www.shorewall/net/pub/shorewall/pptp/linux-2.4.16-openssl-0.9.6b-mppe-patch.gz< / a > < / li >
2002-08-13 22:45:21 +02:00
< / ul >
2003-08-09 19:14:58 +02:00
< p > Uncompress the patch into the same directory where your top-level
kernel
source is located and:< / p >
2002-08-13 22:45:21 +02:00
< ul >
2003-08-09 19:14:58 +02:00
< li > cd < your GNU/Linux source top-level directory> < / li >
< li > patch -p1 < ../linux-2.4.16-openssl-0.9.6b-mppe.patch< / li >
2002-08-13 22:45:21 +02:00
< / ul >
< p > Now configure your kernel. Here is my ppp configuration:< / p >
2003-08-09 19:14:58 +02:00
< blockquote >
< p > < img border = "0" src = "images/ppp.jpg" width = "592" height = "734" > < / p >
< / blockquote >
2002-08-13 22:45:21 +02:00
< h3 > < a name = "Samba" > < / a > Configuring Samba< / h3 >
2003-08-09 19:14:58 +02:00
< p > You will need a WINS server (Samba configured to run as a WINS
server
is fine). Global section from /etc/samba/smb.conf on my WINS server
(192.168.1.3)
is:< / p >
< blockquote >
2002-11-09 19:06:34 +01:00
< pre > [global]< br > workgroup = TDM-NSTOP< br > netbios name = WOOKIE< br > server string = GNU/Linux Box< br > encrypt passwords = Yes< br > log file = /var/log/samba/%m.log< br > max log size = 0< br > socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192< br > os level = 65< br > domain master = True< br > preferred master = True< br > dns proxy = No< br > wins support = Yes< br > printing = lprng< br > < br > [homes]< br > comment = Home Directories< br > valid users = %S< br > read only = No< br > create mask = 0664< br > directory mask = 0775< br > < br > [printers]< br > comment = All Printers< br > path = /var/spool/samba< br > printable = Yes< / pre >
2003-08-09 19:14:58 +02:00
< / blockquote >
2002-08-13 22:45:21 +02:00
< h3 > < a name = "ConfigPppd" > < / a > Configuring pppd< / h3 >
< p > Here is a copy of my /etc/ppp/options.poptop file:< / p >
2003-08-09 19:14:58 +02:00
< blockquote >
2002-08-13 22:45:21 +02:00
< p > < font face = "Courier" size = "2" > ipparam PoPToP< br >
2003-08-09 19:14:58 +02:00
lock< br >
mtu 1490< br >
mru 1490< br >
ms-wins 192.168.1.3< br >
ms-dns 206.124.146.177< br >
multilink< br >
proxyarp< br >
auth< br >
+chap< br >
+chapms< br >
+chapms-v2< br >
ipcp-accept-local< br >
ipcp-accept-remote< br >
lcp-echo-failure 30< br >
lcp-echo-interval 5< br >
deflate 0< br >
mppe-128< br >
mppe-stateless< br >
require-mppe< br >
require-mppe-stateless< / font > < / p >
< / blockquote >
2002-08-13 22:45:21 +02:00
< p > Notes:< / p >
< ul >
2003-08-09 19:14:58 +02:00
< li > System 192.168.1.3 acts as a WINS server so I have included that
IP
as the 'ms-wins' value.< / li >
< li > I have pointed the remote clients at my DNS server -- it has
external
address 206.124.146.177.< / li >
< li > I am requiring 128-bit stateless compression (my kernel is built
with
the 'require-mppe.diff' patch mentioned above.< / li >
2002-08-13 22:45:21 +02:00
< / ul >
< p > Here's my /etc/ppp/chap-secrets:< / p >
2003-08-09 19:14:58 +02:00
< blockquote >
< p > < font face = "Courier" size = "2" > Secrets for authentication using
CHAP< br >
# client
server secret IP addresses< br >
CPQTDM\\TEastep *
< shhhhhh> 192.168.1.7< br >
TEastep
* < shhhhhh>
192.168.1.7< / font > < / p >
< / blockquote >
< p > I am the only user who connects to the server but I may connect
either
with or without a domain being specified. The system I connect from is
my
laptop so I give it the same IP address when tunneled in at it has when
I
use its wireless LAN card around the house.< / p >
2002-08-13 22:45:21 +02:00
< p > You will also want the following in /etc/modules.conf:< / p >
2002-11-09 19:06:34 +01:00
< pre > alias ppp-compress-18 ppp_mppe< br > alias ppp-compress-21 bsd_comp< br > alias ppp-compress-24 ppp_deflate< br > alias ppp-compress-26 ppp_deflate< / pre >
2002-08-13 22:45:21 +02:00
< h3 > < a name = "ConfigPptpd" > < / a > Configuring pptpd< / h3 >
< p > PoPTop (pptpd) is available from < a href = "http://poptop.lineo.com/" > http://poptop.lineo.com/< / a > .< / p >
< p > Here is a copy of my /etc/pptpd.conf file:< / p >
2003-08-09 19:14:58 +02:00
< blockquote >
2002-08-13 22:45:21 +02:00
< p > < font face = "Courier" size = "2" > option /etc/ppp/options.poptop< br >
2003-08-09 19:14:58 +02:00
speed 115200< br >
localip 192.168.1.254< br >
remoteip 192.168.1.33-38< / font > < / p >
< / blockquote >
2002-08-13 22:45:21 +02:00
< p > Notes:< / p >
< ul >
2003-08-09 19:14:58 +02:00
< li > I specify the /etc/ppp/options.poptop file as my ppp options file
(I
have several).< / li >
< li > The local IP is the same as my internal interface's
(192.168.1.254).< / li >
< li > I have assigned a remote IP range that overlaps my local network.
This,
together with 'proxyarp' in my /etc/ppp/options.poptop file make the
remote
hosts look like they are part of the local subnetwork.< / li >
2002-08-13 22:45:21 +02:00
< / ul >
2003-08-09 19:14:58 +02:00
< p > I use this file to start/stop pptpd -- I have this in
/etc/init.d/pptpd:< / p >
< blockquote >
2002-08-13 22:45:21 +02:00
< p > < font face = "Courier" size = "2" > #!/bin/sh< br >
2003-08-09 19:14:58 +02:00
#< br >
# /etc/rc.d/init.d/pptpd< br >
#< br >
# chkconfig: 5 12 85< br >
# description: control pptp server< br >
#< br >
< br >
case "$1" in< br >
start)< br >
echo 1 > /proc/sys/net/ipv4/ip_forward< br >
modprobe ppp_async< br >
modprobe ppp_generic< br >
modprobe ppp_mppe< br >
modprobe slhc< br >
if /usr/local/sbin/pptpd; then< br >
touch /var/lock/subsys/pptpd< br >
fi< br >
;;< br >
stop)< br >
killall pptpd< br >
rm -f /var/lock/subsys/pptpd< br >
;;< br >
restart)< br >
killall pptpd< br >
if /usr/local/sbin/pptpd; then< br >
touch /var/lock/subsys/pptpd< br >
fi< br >
;;< br >
status)< br >
ifconfig< br >
;;< br >
*)< br >
echo "Usage: $0 {start|stop|restart|status}"< br >
;;< br >
esac< / font > < / p >
< / blockquote >
2002-08-13 22:45:21 +02:00
< h3 > < a name = "ConfigFw" > < / a > Configuring Shorewall< / h3 >
2003-08-09 19:14:58 +02:00
< p > I consider hosts connected to my PPTP server to be just like local
systems.
My key Shorewall entries are:< / p >
2002-08-13 22:45:21 +02:00
< h4 > /etc/shorewall/zones:< / h4 >
2003-08-09 19:14:58 +02:00
< blockquote >
2002-11-09 19:06:34 +01:00
< table border = "2" cellpadding = "2" style = "border-collapse: collapse;" >
2003-08-09 19:14:58 +02:00
< tbody >
< tr >
< td > < b > ZONE< / b > < / td >
< td > < b > DISPLAY< / b > < / td >
< td > < b > COMMENTS< / b > < / td >
< / tr >
< tr >
< td > net< / td >
< td > Internet< / td >
< td > The Internet< / td >
< / tr >
< tr >
< td > loc< / td >
< td > Local< / td >
< td > My Local Network including remote PPTP clients< / td >
< / tr >
< / tbody >
2002-08-13 22:45:21 +02:00
< / table >
2003-08-09 19:14:58 +02:00
< / blockquote >
2002-08-13 22:45:21 +02:00
< h4 > /etc/shorewall/interfaces:< / h4 >
2003-08-09 19:14:58 +02:00
< blockquote >
2002-11-09 19:06:34 +01:00
< table border = "2" cellpadding = "2" style = "border-collapse: collapse;" >
2003-08-09 19:14:58 +02:00
< tbody >
< tr >
< td > < b > ZONE< / b > < / td >
< td > < b > INTERFACE< / b > < / td >
< td > < b > BROADCAST< / b > < / td >
< td > < b > OPTIONS< / b > < / td >
< / tr >
< tr >
< td > net< / td >
< td > eth0< / td >
< td > 206.124.146.255< / td >
< td > norfc1918< / td >
< / tr >
< tr >
< td > loc< / td >
< td > eth2< / td >
< td > 192.168.1.255< / td >
< td > < / td >
< / tr >
< tr >
< td > -< / td >
< td > ppp+< / td >
< td > < / td >
< td > < / td >
< / tr >
< / tbody >
2002-08-13 22:45:21 +02:00
< / table >
2003-08-09 19:14:58 +02:00
< / blockquote >
2002-08-13 22:45:21 +02:00
< h4 > /etc/shorewall/hosts:< / h4 >
2003-08-09 19:14:58 +02:00
< blockquote >
2002-11-09 19:06:34 +01:00
< table border = "2" cellpadding = "2" style = "border-collapse: collapse;" >
2003-08-09 19:14:58 +02:00
< tbody >
< tr >
< td > < b > ZONE< / b > < / td >
< td > < b > HOST(S)< / b > < / td >
< td > < b > OPTIONS< / b > < / td >
< / tr >
< tr >
< td > loc< / td >
< td > eth2:192.168.1.0/24< / td >
< td > < br >
< / td >
< / tr >
< tr >
< td > loc< / td >
< td > ppp+:192.168.1.0/24< / td >
< td > < / td >
< / tr >
< / tbody >
2002-08-13 22:45:21 +02:00
< / table >
2003-08-09 19:14:58 +02:00
< / blockquote >
2002-08-13 22:45:21 +02:00
< h4 > /etc/shorewall/policy:< / h4 >
2003-08-09 19:14:58 +02:00
< blockquote >
2002-11-09 19:06:34 +01:00
< table border = "2" cellpadding = "2" style = "border-collapse: collapse;" >
2003-08-09 19:14:58 +02:00
< tbody >
< tr >
< td > < b > SOURCE< / b > < / td >
< td > < b > DEST< / b > < / td >
< td > < b > POLICY< / b > < / td >
< td > < b > LOG LEVEL< / b > < / td >
< / tr >
< tr >
< td > loc< / td >
< td > loc< / td >
< td > ACCEPT< / td >
< td > < / td >
< / tr >
< / tbody >
2002-11-09 19:06:34 +01:00
< / table >
2003-08-09 19:14:58 +02:00
< / blockquote >
< h4 > /etc/shorewall/rules (For Shorewall versions up to and including
1.3.9b):< / h4 >
< blockquote > < font face = "Century Gothic, Arial, Helvetica" > < / font >
2002-11-09 19:06:34 +01:00
< table border = "2" cellpadding = "2" style = "border-collapse: collapse;" >
2003-08-09 19:14:58 +02:00
< tbody >
< tr >
2003-07-16 20:59:33 +02:00
< td > < b > ACTION< / b > < / td >
2003-08-09 19:14:58 +02:00
< td > < b > SOURCE< / b > < / td >
< td > < b > DEST< / b > < / td >
< td > < b > PROTO< / b > < / td >
< td > < b > DEST< br >
PORT(S)< / b > < / td >
< td > < b > SOURCE< br >
PORT(S)< / b > < / td >
< td > < b > ORIGINAL< br >
DEST< / b > < / td >
< / tr >
2003-07-16 20:59:33 +02:00
< tr >
< td > ACCEPT< / td >
< td > net< / td >
< td > fw< / td >
< td > tcp< / td >
< td > 1723< / td >
2003-08-09 19:14:58 +02:00
< td > < / td >
< td > < / td >
2003-07-16 20:59:33 +02:00
< / tr >
< tr >
< td > ACCEPT< / td >
< td > net< / td >
< td > fw< / td >
< td > 47< / td >
< td > -< / td >
2003-08-09 19:14:58 +02:00
< td > < / td >
< td > < / td >
2003-07-16 20:59:33 +02:00
< / tr >
< tr >
< td > ACCEPT< / td >
< td > fw< / td >
< td > net< / td >
< td > 47< / td >
< td > -< / td >
2003-08-09 19:14:58 +02:00
< td > < / td >
< td > < / td >
2003-07-16 20:59:33 +02:00
< / tr >
2003-08-09 19:14:58 +02:00
< / tbody >
2002-08-13 22:45:21 +02:00
< / table >
2003-08-09 19:14:58 +02:00
< / blockquote >
< p align = "left" > < b > /etc/shoreawll/tunnels (For Shorewall versions
1.3.10 and
later)< br >
< / b > < / p >
< blockquote >
2002-11-09 19:06:34 +01:00
< table cellpadding = "2" border = "2" style = "border-collapse: collapse;" >
2003-08-09 19:14:58 +02:00
< tbody >
< tr >
< td valign = "top" > < b > TYPE< br >
< / b > < / td >
< td valign = "top" > < b > ZONE< br >
< / b > < / td >
< td valign = "top" > < b > GATEWAY< br >
< / b > < / td >
< td valign = "top" > < b > GATEWAY ZONE< br >
< / b > < / td >
< / tr >
< tr >
< td valign = "top" > pptpserver< br >
< / td >
< td valign = "top" > net< br >
< / td >
< td valign = "top" > 0.0.0.0/0< br >
< / td >
< td valign = "top" > < br >
< / td >
< / tr >
< / tbody >
2002-11-09 19:06:34 +01:00
< / table >
2003-08-09 19:14:58 +02:00
< / blockquote >
2002-11-09 19:06:34 +01:00
< p align = "left" > < br >
2003-08-09 19:14:58 +02:00
Note: I have multiple ppp interfaces on my firewall. If you have a
single
ppp interface, you probably want:< / p >
2002-08-13 22:45:21 +02:00
< h4 > /etc/shorewall/interfaces:< / h4 >
2003-08-09 19:14:58 +02:00
< blockquote >
2002-11-09 19:06:34 +01:00
< table border = "2" cellpadding = "2" style = "border-collapse: collapse;" >
2003-08-09 19:14:58 +02:00
< tbody >
< tr >
< td > < b > ZONE< / b > < / td >
< td > < b > INTERFACE< / b > < / td >
< td > < b > BROADCAST< / b > < / td >
< td > < b > OPTIONS< / b > < / td >
2003-07-16 20:59:33 +02:00
< / tr >
< tr >
< td > net< / td >
2003-08-09 19:14:58 +02:00
< td > eth0< / td >
< td > 206.124.146.255< / td >
< td > norfc1918< / td >
2003-07-16 20:59:33 +02:00
< / tr >
2003-08-09 19:14:58 +02:00
< tr >
< td > loc< / td >
< td > eth2< / td >
< td > 192.168.1.255< / td >
< td > < / td >
2003-07-16 20:59:33 +02:00
< / tr >
< tr >
2003-08-09 19:14:58 +02:00
< td > loc< / td >
< td > ppp0< / td >
< td > < / td >
< td > < / td >
2003-07-16 20:59:33 +02:00
< / tr >
2003-08-09 19:14:58 +02:00
< / tbody >
< / table >
< / blockquote >
< p align = "left" > and < u > < b > no< / b > < / u > entries in /etc/shorewall/hosts.< / p >
< h2 align = "center" > < a name = "ServerBehind" > < / a > 2. PPTP Server Running
Behind
your Firewall< / h2 >
< p > If you have a single external IP address, add the following to your
/etc/shorewall/rules file:< / p >
< font face = "Century Gothic, Arial, Helvetica" > < / font >
< table border = "2" cellpadding = "2" style = "border-collapse: collapse;" >
< tbody >
< tr >
< td > < b > ACTION< / b > < / td >
< td > < b > SOURCE< / b > < / td >
< td > < b > DEST< / b > < / td >
< td > < b > PROTO< / b > < / td >
< td > < b > DEST< br >
PORT(S)< / b > < / td >
< td > < b > SOURCE< br >
PORT(S)< / b > < / td >
< td > < b > ORIGINAL< br >
DEST< / b > < / td >
< / tr >
< tr >
< td > DNAT< / td >
< td > net< / td >
< td > loc:< i > < server address> < / i > < / td >
< td > tcp< / td >
< td > 1723< / td >
< td > < / td >
< td > < / td >
< / tr >
< tr >
< td > DNAT< / td >
< td > net< / td >
< td > loc:< i > < server address> < / i > < / td >
< td > 47< / td >
< td > -< / td >
< td > < / td >
< td > < / td >
< / tr >
< / tbody >
2002-08-13 22:45:21 +02:00
< / table >
2003-08-09 19:14:58 +02:00
< p > If you have multiple external IP address and you want to forward a
single
< i > < external address> , < / i > add the following to your
/etc/shorewall/rules
file:< / p >
< p > < font face = "Century Gothic, Arial, Helvetica" > < / font >
< table border = "2" cellpadding = "2" style = "border-collapse: collapse;" >
< tbody >
< tr >
< td > < b > ACTION< / b > < / td >
< td > < b > SOURCE< / b > < / td >
< td > < b > DEST< / b > < / td >
< td > < b > PROTO< / b > < / td >
< td > < b > DEST< br >
PORT(S)< / b > < / td >
< td > < b > SOURCE< br >
PORT(S)< / b > < / td >
< td > < b > ORIGINAL< br >
DEST< / b > < / td >
< / tr >
< tr >
< td > DNAT< / td >
< td > net< / td >
< td > loc:< i > < server address> < / i > < / td >
< td > tcp< / td >
< td > 1723< / td >
< td > -< / td >
< td > < i > < external address> < / i > < / td >
< / tr >
< tr >
< td > DNAT< / td >
< td > net< / td >
< td > loc:< i > < server address> < / i > < / td >
< td > 47< / td >
< td > -< / td >
< td > -< / td >
< td > < i > < external address> < / i > < / td >
< / tr >
< / tbody >
< / table >
< / p >
< h2 align = "center" > < a name = "ClientsBehind" > < / a > 3. PPTP Clients Running
Behind
your Firewall< / h2 >
< p > You shouldn't have to take any special action for this case unless
you
wish to connect multiple clients to the same external server. In that
case,
you will need to follow the instructions at < a
2003-07-16 20:59:33 +02:00
href="http://www.impsec.org/linux/masquerade/ip_masq_vpn.html">http://www.impsec.org/linux/masquerade/ip_masq_vpn.html< / a > .
2003-08-09 19:14:58 +02:00
I recommend that you also add these two lines to your
/etc/shorewall/modules
file: < / p >
< blockquote >
2002-08-13 22:45:21 +02:00
< p > loadmodule ip_conntrack_pptp< br >
2003-08-09 19:14:58 +02:00
loadmodule ip_nat_pptp < / p >
< / blockquote >
< h2 align = "center" > < a name = "ClientFW" > < / a > 4. PPTP Client Running on
your
Firewall.< / h2 >
2002-11-09 19:06:34 +01:00
< p align = "left" > The PPTP GNU/Linux client is available at < a
2003-08-09 19:14:58 +02:00
href="http://sourceforge.net/projects/pptpclient/">http://sourceforge.net/projects/pptpclient/< / a > .
Rather than use the configuration script that comes with the client, I
built
my own. I also build my own kernel < a href = "#PatchKernel" > as described
above< / a >
rather than using the mppe package that is available with the client.
My
/etc/ppp/options file is mostly unchanged from what came with the
client
(see below).< / p >
2002-11-09 19:06:34 +01:00
< p > The key elements of this setup are as follows: < / p >
2002-08-13 22:45:21 +02:00
< ol >
2003-08-09 19:14:58 +02:00
< li > Define a zone for the remote network accessed via PPTP.< / li >
< li > Associate that zone with a ppp interface.< / li >
< li > Define rules for PPTP traffic to/from the firewall.< / li >
< li > Define rules for traffic two and from the remote zone.< / li >
2002-08-13 22:45:21 +02:00
< / ol >
< p > Here are examples from my setup:< / p >
< h4 > /etc/shorewall/zones< / h4 >
2003-08-09 19:14:58 +02:00
< blockquote >
2002-11-09 19:06:34 +01:00
< table border = "2" cellpadding = "2" style = "border-collapse: collapse;" >
2003-08-09 19:14:58 +02:00
< tbody >
< tr >
< td > < b > ZONE< / b > < / td >
< td > < b > DISPLAY< / b > < / td >
< td > < b > COMMENTS< / b > < / td >
< / tr >
< tr >
< td > cpq< / td >
< td > Compaq< / td >
< td > Compaq Intranet< / td >
< / tr >
< / tbody >
2002-08-13 22:45:21 +02:00
< / table >
2003-08-09 19:14:58 +02:00
< / blockquote >
2002-08-13 22:45:21 +02:00
< h4 > /etc/shorewall/interfaces< / h4 >
2003-08-09 19:14:58 +02:00
< blockquote >
2002-11-09 19:06:34 +01:00
< table border = "2" cellpadding = "2" style = "border-collapse: collapse;" >
2003-08-09 19:14:58 +02:00
< tbody >
< tr >
< td > < b > ZONE< / b > < / td >
< td > < b > INTERFACE< / b > < / td >
< td > < b > BROADCAST< / b > < / td >
< td > < b > OPTIONS< / b > < / td >
< / tr >
< tr >
< td > -< / td >
< td > ppp+< / td >
< td > < / td >
< td > < / td >
< / tr >
< / tbody >
2002-08-13 22:45:21 +02:00
< / table >
2003-08-09 19:14:58 +02:00
< / blockquote >
2002-08-13 22:45:21 +02:00
< h4 > /etc/shorewall/hosts< / h4 >
2003-08-09 19:14:58 +02:00
< blockquote >
2002-11-09 19:06:34 +01:00
< table border = "2" cellpadding = "2" style = "border-collapse: collapse;" >
2003-08-09 19:14:58 +02:00
< tbody >
< tr >
< td > < b > ZONE< / b > < / td >
< td > < b > HOST(S)< / b > < / td >
< td > < b > OPTIONS< / b > < / td >
< / tr >
< tr >
< td > -< / td >
< td > ppp+:!192.168.1.0/24< / td >
< td > < / td >
< / tr >
< / tbody >
2002-08-13 22:45:21 +02:00
< / table >
2003-08-09 19:14:58 +02:00
< / blockquote >
< h4 > /etc/shorewall/rules (For Shorewall versions up to and including
1.3.9b)< / h4 >
< blockquote > < font face = "Century Gothic, Arial, Helvetica" > < / font >
2002-11-09 19:06:34 +01:00
< table border = "2" cellpadding = "2" style = "border-collapse: collapse;" >
2003-08-09 19:14:58 +02:00
< tbody >
< tr >
2003-07-16 20:59:33 +02:00
< td > < b > ACTION< / b > < / td >
2003-08-09 19:14:58 +02:00
< td > < b > SOURCE< / b > < / td >
< td > < b > DEST< / b > < / td >
< td > < b > PROTO< / b > < / td >
< td > < b > DEST< br >
PORT(S)< / b > < / td >
< td > < b > SOURCE< br >
PORT(S)< / b > < / td >
< td > < b > ORIGINAL< br >
DEST< / b > < / td >
< / tr >
< tr >
< td > ACCEPT< / td >
< td > fw< / td >
< td > net< / td >
< td > tcp< / td >
< td > 1723< / td >
< td > < / td >
< td > < / td >
< / tr >
< tr >
< td > ACCEPT< / td >
< td > fw< / td >
< td > net< / td >
< td > 47< / td >
< td > -< / td >
< td > < / td >
< td > < / td >
< / tr >
< / tbody >
2002-11-09 19:06:34 +01:00
< / table >
2003-08-09 19:14:58 +02:00
< / blockquote >
2002-11-09 19:06:34 +01:00
< p > < b > /etc/shorewall/tunnels (For Shorewall versions 1.3.10 and later)< br >
2003-08-09 19:14:58 +02:00
< / b > < / p >
< blockquote >
2002-11-09 19:06:34 +01:00
< table cellpadding = "2" cellspacing = "2" border = "1"
style="border-collapse: collapse;">
2003-08-09 19:14:58 +02:00
< tbody >
< tr >
< td valign = "top" > < b > TYPE< br >
< / b > < / td >
< td valign = "top" > < b > ZONE< br >
< / b > < / td >
< td valign = "top" > < b > GATEWAY< br >
< / b > < / td >
< td valign = "top" > < b > GATEWAY ZONE< br >
< / b > < / td >
< / tr >
< tr >
< td valign = "top" > pptpclient< br >
< / td >
< td valign = "top" > net< br >
< / td >
< td valign = "top" > 0.0.0.0/0< br >
< / td >
< td valign = "top" > < br >
< / td >
< / tr >
< / tbody >
2002-08-13 22:45:21 +02:00
< / table >
2003-08-09 19:14:58 +02:00
< br >
< / blockquote >
< p > I use the combination of interface and hosts file to define the
'cpq'
zone because I also run a PPTP server on my firewall (see above). Using
this technique allows me to distinguish clients of my own PPTP server
from arbitrary
hosts at Compaq; I assign addresses in 192.168.1.0/24 to my PPTP
clients
2003-05-15 21:39:23 +02:00
and Compaq doesn't use that RFC1918 Class C subnet. < / p >
2003-08-09 19:14:58 +02:00
< p > I use this script in /etc/init.d to control the client. The reason
that
I disable ECN when connecting is that the Compaq tunnel servers don't
do
ECN yet and reject the initial TCP connection request if I enable ECN
:-(
< / p >
< blockquote >
2003-05-15 21:39:23 +02:00
< p > < font face = "Courier" size = "2" > #!/bin/sh< br >
2003-08-09 19:14:58 +02:00
#< br >
# /etc/rc.d/init.d/pptp< br >
#< br >
# chkconfig: 5 60 85< br >
# description: PPTP Link Control< br >
#< br >
NAME="Tandem"< br >
ADDRESS=tunnel-tandem.compaq.com< br >
USER='Tandem\tommy'< br >
ECN=0< br >
DEBUG=< br >
< br >
start_pptp() {< br >
echo $ECN > /proc/sys/net/ipv4/tcp_ecn< br >
if /usr/sbin/pptp $ADDRESS user $USER noauth $DEBUG;
then< br >
touch /var/lock/subsys/pptp< br >
echo "PPTP Connection to
$NAME Started"< br >
fi< br >
}< br >
< br >
stop_pptp() {< br >
if killall /usr/sbin/pptp 2> /dev/null; then< br >
echo "Stopped pptp"< br >
else< br >
rm -f /var/run/pptp/*< br >
fi< br >
< br >
# if killall pppd; then< br >
# echo "Stopped pppd"< br >
# fi< br >
< br >
rm -f /var/lock/subsys/pptp< br >
< br >
echo 1 > /proc/sys/net/ipv4/tcp_ecn< br >
}< br >
< br >
< br >
case "$1" in< br >
start)< br >
echo "Starting PPTP Connection to ${NAME}..."< br >
start_pptp< br >
;;< br >
stop)< br >
echo "Stopping $NAME PPTP Connection..."< br >
stop_pptp< br >
;;< br >
restart)< br >
echo "Restarting $NAME PPTP Connection..."< br >
stop_pptp< br >
start_pptp< br >
;;< br >
status)< br >
ifconfig< br >
;;< br >
*)< br >
echo "Usage: $0 {start|stop|restart|status}"< br >
;;< br >
esac< br >
< / font > < / p >
< / blockquote >
2002-11-09 19:06:34 +01:00
< p > Here's my /etc/ppp/options file: < / p >
2003-08-09 19:14:58 +02:00
< blockquote >
2002-11-09 19:06:34 +01:00
< p > < font face = "Courier" size = "2" > #< br >
2003-08-09 19:14:58 +02:00
# Identify this connection< br >
#< br >
ipparam Compaq< br >
#< br >
# Lock the port< br >
#< br >
lock< br >
#< br >
# We don't need the tunnel server to authenticate itself< br >
#< br >
noauth< br >
< br >
+chap< br >
+chapms< br >
+chapms-v2< br >
< br >
multilink< br >
mrru 1614< br >
#< br >
# Turn off transmission protocols we know won't be used< br >
#< br >
nobsdcomp< br >
nodeflate< br >
< br >
#< br >
# We want MPPE< br >
#< br >
mppe-128< br >
mppe-stateless< br >
< br >
#< br >
# We want a sane mtu/mru< br >
#< br >
mtu 1000< br >
mru 1000< br >
< br >
#< br >
# Time this thing out of it goes poof< br >
#< br >
lcp-echo-failure 10< br >
lcp-echo-interval 10< / font > < / p >
< / blockquote >
< p > My /etc/ppp/ip-up.local file sets up the routes that I need to route
Compaq
traffic through the PPTP tunnel: < / p >
< blockquote >
2002-08-13 22:45:21 +02:00
< p > < font face = "Courier" size = "2" > #/bin/sh< br >
2003-08-09 19:14:58 +02:00
< br >
case $6 in< br >
Compaq)< br >
route add -net 16.0.0.0 netmask 255.0.0.0 gw $5 $1< br >
route add -net 130.252.0.0 netmask 255.255.0.0 gw $5
$1< br >
route add -net 131.124.0.0 netmask 255.255.0.0 gw $5
$1< br >
...< br >
;;< br >
esac< / font > < / p >
< / blockquote >
< p > Finally, I run the following script every five minutes under crond
to
restart the tunnel if it fails:< / p >
< pre > #!/bin/sh< br > restart_pptp() {< br > /sbin/service pptp stop< br > sleep 10< br > if /sbin/service pptp start; then< br > /usr/bin/logger "PPTP Restarted"< br > fi< br > }< br > < br > if [ -n "`ps ax | grep /usr/sbin/pptp | grep -v grep`" ]; then< br > exit 0< br > fi< br > < br > echo "Attempting to restart PPTP"< br > < br > restart_pptp > /dev/null 2> & 1 & < br > < br > < a
href="ftp://ftp.shorewall.net/pub/shorewall/misc/Vonau">Here's a scriptand corresponding ip-up.local < / a > from < a
href="mailto:jvonau@home.com">Jerry Vonau < / a > that controls two PPTP connections.< br > < / pre >
< h2 style = "text-align: center;" > < a name = "PPTP_ADSL" > < / a > 5. PPTP Client
running
on your Firewall with PPTP Server in an ADSL Modem< / h2 >
Some ADSL systems in Europe (most notably in Austria) feature a PPTP
server built into an ADSL "Modem".
In this setup, an ethernet interface is dedicated to supporting the
PPTP tunnel between the firewall and the "Modem" while the actual
internet access is through PPTP (interface ppp0). If you have this type
of setup, you need to modify the sample configuration
that you downloaded as described in this section. < span
style="font-weight: bold;">These changes are < span
style="text-decoration: underline;">in addition< / span > to those
described in the < a href = "shorewall_quickstart_guide.htm" > QuickStart
Guides< / a > .< / span > < br >
< br >
Lets assume the following:< br >
< ul >
< li > ADSL Modem connected through eth0< / li >
< li > Modem IP address = 192.168.1.1< / li >
< li > eth0 IP address = 192.168.1.2< / li >
< / ul >
The changes you need to make are as follows:< br >
< br >
1. Add this entry to /etc/shorewall/zones:< br >
< br >
< blockquote >
< table border = "2" cellpadding = "2" style = "border-collapse: collapse;" >
< tbody >
< tr >
< td > < b > ZONE< / b > < / td >
< td > < b > DISPLAY< / b > < / td >
< td > < b > COMMENTS< / b > < / td >
< / tr >
< tr >
< td > modem< br >
< / td >
< td > Modem< / td >
< td > ADSL Modem< br >
< / td >
< / tr >
< / tbody >
< / table >
< / blockquote >
< div style = "margin-left: 40px;" > That entry defines a new zone called '< span
style="font-style: italic;">modem< / span > ' which will contain only your
ADSL modem.< br >
< br >
< / div >
2. Add the following entry to /etc/shorewall/interfaces:< br >
< blockquote >
< table border = "2" cellpadding = "2" style = "border-collapse: collapse;" >
< tbody >
< tr >
< td > < b > ZONE< / b > < / td >
< td > < b > INTERFACE< / b > < / td >
< td > < b > BROADCAST< / b > < / td >
< td > < b > OPTIONS< / b > < / td >
< / tr >
< tr >
< td > modem< br >
< / td >
< td > eth0< br >
< / td >
< td > 192.168.1.255 < br >
< / td >
< td > dhcp< / td >
< / tr >
< / tbody >
< / table >
< / blockquote >
< div style = "margin-left: 40px;" > You will of course modify the 'net'
entry in /etc/shorewall/interfaces to specify 'pppo' as the interface
as described in the QuickStart Guide corresponding to your setup.< br >
< / div >
< br >
3. Add the following to /etc/shorewall/tunnels:< br >
< br >
< div style = "margin-left: 40px;" >
< table cellpadding = "2" cellspacing = "2" border = "1"
style="border-collapse: collapse;">
< tbody >
< tr >
< td valign = "top" > < b > TYPE< br >
< / b > < / td >
< td valign = "top" > < b > ZONE< br >
< / b > < / td >
< td valign = "top" > < b > GATEWAY< br >
< / b > < / td >
< td valign = "top" > < b > GATEWAY ZONE< br >
< / b > < / td >
< / tr >
< tr >
< td valign = "top" > pptpclient < / td >
< td valign = "top" > modem< br >
< / td >
< td valign = "top" > 192.168.1.1< br >
< / td >
< td valign = "top" > < br >
< / td >
< / tr >
< / tbody >
< / table >
< / div >
< div style = "margin-left: 40px;" > < br >
That entry allows a PPTP tunnel to be established between your
Shorewall system and the PPTP server in the modem.< br >
< / div >
< p > < font size = "2" > Last modified 8/8/2003 - < a href = "support.htm" > Tom
Eastep< / a > < / font > < / p >
2003-05-15 21:39:23 +02:00
< p > < a href = "copyright.htm" > < font size = "2" > Copyright< / font > <20> < font
size="2">2001, 2002, 2003 Thomas M. Eastep.< / font > < / a > < / p >
2003-08-09 19:14:58 +02:00
< br >
2002-11-09 19:06:34 +01:00
< / body >
< / html >
