Shorewall easily supports PPTP in a number of configurations:
I will try to give you an idea of how to set up a PPTP server on your firewall system. This isn't a detailed HOWTO but rather an example of how I have set up a working PPTP server on my own firewall.
The steps involved are:
To run pppd on a 2.4 kernel, you need the pppd 2.4.1 or later. The primary site for releases of pppd is ftp://ftp.samba.org/pub/ppp.
You will need the following patches:
You may also want the following patch if you want to require remote hosts to use encryption:
Un-tar the pppd source and uncompress the patches into one directory (the patches and the ppp-2.4.1 directory are all in a single parent directory):
You will need to install the resulting binary on your firewall system. To do that, I NFS mount my source filesystem and use "make install" from the ppp-2.4.1 directory.
You will need one of the following patches depending on your kernel version:
Uncompress the patch into the same directory where your top-level kernel source is located and:
Now configure your kernel. Here is my ppp configuration:
You will need a WINS server (Samba configured to run as a WINS server is fine). Global section from /etc/samba/smb.conf on my WINS server (192.168.1.3) is:
[global]
workgroup = TDM-NSTOP
netbios name = WOOKIE
server string = GNU/Linux Box
encrypt passwords = Yes
log file = /var/log/samba/%m.log
max log size = 0
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
os level = 65
domain master = True
preferred master = True
dns proxy = No
wins support = Yes
printing = lprng
[homes]
comment = Home Directories
valid users = %S
read only = No
create mask = 0664
directory mask = 0775
[printers]
comment = All Printers
path = /var/spool/samba
printable = Yes
Here is a copy of my /etc/ppp/options.poptop file:
ipparam PoPToP
lock
mtu 1490
mru 1490
ms-wins 192.168.1.3
ms-dns 206.124.146.177
multilink
proxyarp
auth
+chap
+chapms
+chapms-v2
ipcp-accept-local
ipcp-accept-remote
lcp-echo-failure 30
lcp-echo-interval 5
deflate 0
mppe-128
mppe-stateless
require-mppe
require-mppe-stateless
Notes:
Here's my /etc/ppp/chap-secrets:
Secrets for authentication using CHAP
# client server secret IP addresses
CPQTDM\\TEastep * <shhhhhh> 192.168.1.7
TEastep * <shhhhhh> 192.168.1.7
I am the only user who connects to the server but I may connect either with or without a domain being specified. The system I connect from is my laptop so I give it the same IP address when tunneled in at it has when I use its wireless LAN card around the house.
You will also want the following in /etc/modules.conf:
alias ppp-compress-18 ppp_mppe
alias ppp-compress-21 bsd_comp
alias ppp-compress-24 ppp_deflate
alias ppp-compress-26 ppp_deflate
PoPTop (pptpd) is available from http://poptop.lineo.com/.
Here is a copy of my /etc/pptpd.conf file:
option /etc/ppp/options.poptop
speed 115200
localip 192.168.1.254
remoteip 192.168.1.33-38
Notes:
I use this file to start/stop pptpd -- I have this in /etc/init.d/pptpd:
#!/bin/sh
#
# /etc/rc.d/init.d/pptpd
#
# chkconfig: 5 12 85
# description: control pptp server
#
case "$1" in
start)
echo 1 > /proc/sys/net/ipv4/ip_forward
modprobe ppp_async
modprobe ppp_generic
modprobe ppp_mppe
modprobe slhc
if /usr/local/sbin/pptpd; then
touch /var/lock/subsys/pptpd
fi
;;
stop)
killall pptpd
rm -f /var/lock/subsys/pptpd
;;
restart)
killall pptpd
if /usr/local/sbin/pptpd; then
touch /var/lock/subsys/pptpd
fi
;;
status)
ifconfig
;;
*)
echo "Usage: $0 {start|stop|restart|status}"
;;
esac
Here' a basic setup that treats your remote users as if they were
part of your loc zone. Note
that if your primary internet connection uses ppp0, then be sure that loc follows net in /etc/shorewall/zones.
/etc/shorewall/tunnels:
TYPE ZONE GATEWAY GATEWAY ZONE pptpserver
net 0.0.0.0/0
/etc/shorewall/interfaces:
ZONE INTERFACE BROADCAST OPTIONS loc
ppp+ -
/etc/shorewall/zones:
TYPE ZONE GATEWAY GATEWAY ZONE pptpserver
net 0.0.0.0/0
ZONE DISPLAY COMMENTS net Internet The Internet loc Local Local Network
vpn VPN
Remote Users
Your policies and rules may now be configured for traffic to/from the vpn zone.
ZONE INTERFACE BROADCAST OPTIONS net eth0 206.124.146.255 norfc1918 loc eth2 192.168.10.255 vpn
ppp+ -
Often there will be situations where you want multiple connections
from remote networks with these networks having different firewalling
requirements.
Here's how you configure this in Shorewall. Note that if your
primary internet connection uses ppp0 then be sure that the vpn{1-3} zones follows net in /etc/shorewall/zones as shown
below.
/etc/shorewall/tunnels:
TYPE ZONE GATEWAY GATEWAY ZONE pptpserver
net 0.0.0.0/0
ZONE DISPLAY COMMENTS net Internet The Internet loc Local Local Network
vpn1 Remote1
Remote Network 1
vpn2
Remote2
Remote Network 2
vpn3
Remote3
Remote Network 3
ZONE INTERFACE BROADCAST OPTIONS net eth0 206.124.146.255 norfc1918 loc eth2 192.168.10.255 - ppp+ -
Your policies and rules can now be configured using separate zones (vpn1, vpn2, and vpn3) for the three remote network.
ZONE HOST(S) OPTIONS vpn1
ppp+:192.168.1.0/24 vpn2
ppp+:192.168.2.0/24
vpn3
ppp+:192.168.3.0/24
If you have a single external IP address, add the following to your /etc/shorewall/rules file:
| ACTION | SOURCE | DEST | PROTO | DEST PORT(S) |
SOURCE PORT(S) |
ORIGINAL DEST |
| DNAT | net | loc:<server address> | tcp | 1723 | ||
| DNAT | net | loc:<server address> | 47 | - |
If you have multiple external IP address and you want to forward a single <external address>, add the following to your /etc/shorewall/rules file:
| ACTION | SOURCE | DEST | PROTO | DEST PORT(S) |
SOURCE PORT(S) |
ORIGINAL DEST |
| DNAT | net | loc:<server address> | tcp | 1723 | - | <external address> |
| DNAT | net | loc:<server address> | 47 | - | - | <external address> |
You shouldn't have to take any special action for this case unless you wish to connect multiple clients to the same external server. In that case, you will need to follow the instructions at http://www.impsec.org/linux/masquerade/ip_masq_vpn.html. I recommend that you also add these two lines to your /etc/shorewall/modules file:
loadmodule ip_conntrack_pptp
loadmodule ip_nat_pptp
The PPTP GNU/Linux client is available at http://sourceforge.net/projects/pptpclient/. Rather than use the configuration script that comes with the client, I built my own. I also build my own kernel as described above rather than using the mppe package that is available with the client. My /etc/ppp/options file is mostly unchanged from what came with the client (see below).
The key elements of this setup are as follows:
Here are examples from my setup:
ZONE DISPLAY COMMENTS cpq Compaq Compaq Intranet
ZONE INTERFACE BROADCAST OPTIONS - ppp+
ZONE HOST(S) OPTIONS - ppp+:!192.168.1.0/24
ACTION SOURCE DEST PROTO DEST
PORT(S)SOURCE
PORT(S)ORIGINAL
DESTACCEPT fw net tcp 1723 ACCEPT fw net 47 -
/etc/shorewall/tunnels (For Shorewall versions 1.3.10 and later)
TYPE
ZONE
GATEWAY
GATEWAY ZONE
pptpclient
net
0.0.0.0/0
I use the combination of interface and hosts file to define the 'cpq' zone because I also run a PPTP server on my firewall (see above). Using this technique allows me to distinguish clients of my own PPTP server from arbitrary hosts at Compaq; I assign addresses in 192.168.1.0/24 to my PPTP clients and Compaq doesn't use that RFC1918 Class C subnet.
I use this script in /etc/init.d to control the client. The reason that I disable ECN when connecting is that the Compaq tunnel servers don't do ECN yet and reject the initial TCP connection request if I enable ECN :-(
#!/bin/sh
#
# /etc/rc.d/init.d/pptp
#
# chkconfig: 5 60 85
# description: PPTP Link Control
#
NAME="Tandem"
ADDRESS=tunnel-tandem.compaq.com
USER='Tandem\tommy'
ECN=0
DEBUG=
start_pptp() {
echo $ECN > /proc/sys/net/ipv4/tcp_ecn
if /usr/sbin/pptp $ADDRESS user $USER noauth $DEBUG; then
touch /var/lock/subsys/pptp
echo "PPTP Connection to $NAME Started"
fi
}
stop_pptp() {
if killall /usr/sbin/pptp 2> /dev/null; then
echo "Stopped pptp"
else
rm -f /var/run/pptp/*
fi
# if killall pppd; then
# echo "Stopped pppd"
# fi
rm -f /var/lock/subsys/pptp
echo 1 > /proc/sys/net/ipv4/tcp_ecn
}
case "$1" in
start)
echo "Starting PPTP Connection to ${NAME}..."
start_pptp
;;
stop)
echo "Stopping $NAME PPTP Connection..."
stop_pptp
;;
restart)
echo "Restarting $NAME PPTP Connection..."
stop_pptp
start_pptp
;;
status)
ifconfig
;;
*)
echo "Usage: $0 {start|stop|restart|status}"
;;
esac
Here's my /etc/ppp/options file:
#
# Identify this connection
#
ipparam Compaq
#
# Lock the port
#
lock
#
# We don't need the tunnel server to authenticate itself
#
noauth
+chap
+chapms
+chapms-v2
multilink
mrru 1614
#
# Turn off transmission protocols we know won't be used
#
nobsdcomp
nodeflate
#
# We want MPPE
#
mppe-128
mppe-stateless
#
# We want a sane mtu/mru
#
mtu 1000
mru 1000
#
# Time this thing out of it goes poof
#
lcp-echo-failure 10
lcp-echo-interval 10
My /etc/ppp/ip-up.local file sets up the routes that I need to route Compaq traffic through the PPTP tunnel:
#/bin/sh
case $6 in
Compaq)
route add -net 16.0.0.0 netmask 255.0.0.0 gw $5 $1
route add -net 130.252.0.0 netmask 255.255.0.0 gw $5 $1
route add -net 131.124.0.0 netmask 255.255.0.0 gw $5 $1
...
;;
esac
Finally, I run the following script every five minutes under crond to restart the tunnel if it fails:
#!/bin/sh
restart_pptp() {
/sbin/service pptp stop
sleep 10
if /sbin/service pptp start; then
/usr/bin/logger "PPTP Restarted"
fi
}
if [ -n "`ps ax | grep /usr/sbin/pptp | grep -v grep`" ]; then
exit 0
fi
echo "Attempting to restart PPTP"
restart_pptp > /dev/null 2>&1 &
Here's a scriptand corresponding ip-up.local from Jerry Vonau that controls two PPTP connections.
ZONE DISPLAY COMMENTS modem
Modem ADSL Modem
ZONE INTERFACE BROADCAST OPTIONS modem
eth0
192.168.1.255
dhcp
| TYPE |
ZONE |
GATEWAY |
GATEWAY ZONE |
| pptpclient | modem |
192.168.1.1 |
Last modified 11/22/2003 - Tom Eastep
Copyright © 2001, 2002, 2003 Thomas M. Eastep.