CentOS 6.x quick installation of PPTP VPN

CentOS 6.x quick installation of PPTP VPN

I. Introduction

This article describes how to build the pptp vpn service in the CentOS operating system. Including PPTP installation, configuration, and corresponding iptables rules. This article does not involve PPTP traffic control for the time being. I will try again later after learning FreeRADIUS.

The reason for choosing pptp vpn is that it is convenient to connect the client. Linux Desktop, Windows, and Android terminals all have PPTP clients.

2. The configuration of PPTP involves the following five steps:

• Verify whether the MPPE module is loaded in the kernel

• Install the required software package

• Configure the PPP and PPTP configuration files

• Enable the kernel IP forwarding function

• Start the pptpd daemon

• Configure iptables firewall access and forwarding rules

All the following configuration operations require the root permission. Unless otherwise specified, all commands are executed in the root's home directory.

1. verify whether the MPPE module is loaded in the kernel.

The kernel MPPE module is used to support Microsoft Point-to-Point Encryption. The VPN Client of Windows uses this encryption method, and the mainstream Linux Desktop also supports MPPE. In fact, in our kernel version, MPPE has been loaded by default. You only need to verify it by using the following command and display MPPE OK:

modprobeppp-compress-18&&echoMPPEisok

2. Install the required software package

PPTP uses the PPP protocol to encapsulate user data, then encapsulates PPP data frames in IP datagram, and transmits them through the IP network. Therefore, we need to support the PPP protocol first. The full version of CentOS already comes with the ppp package. If you are installing a streamlined system such as Minial CentOS, you may need to run the following command to install ppp, because the system yum can solve the dependency between software packages, we can directly install the software packages for our final purpose.

yuminstallpptpd-y

3. Configure the configuration files for PPP and PPTP

This file does not need to be configured much. We only need to add dns.

# Vim/etc/ppp/options.ppt pd

ms-dns8.8.8.8ms-dns8.8.4.4

Next, modify another file that stores the user account. This file is very simple. It stores the user name, service name, password, and IP address range of the VPN customer in plaintext, with one account per line:

# Vim/etc/ppp/chap-secrets

username1pptpdpasswd1*username2pptpdpasswd2*

The first and third columns are respectively the user name and password. The second column should be consistent with the service name specified after name in the above file/etc/ppp/options.ppt pd. The last column limits the Client IP address, asterisk indicates no restriction.

Edit the pptpd configuration file below, and there are few valid lines in this file.

# Vim/etc/pptpd. conf

option/etc/ppp/options.pptpd# Specify the configuration in/etc/ppp/options.ppt pdlogwtmp# Indicates using WTMP logslocalip192.168.0.1# VPN Local intranet IP Addressremoteip192.168.0.207-217# IP address segment allocated to the VPN Client

4. Enable the kernel IP forwarding function

To enable the VPN Server to act as a transit proxy for network requests and allow the client to access the Internet through VPN, you also need to enable the IP forwarding function of the kernel. If it is permanently effective, you can modify the configuration file sysctl. conf.

echo1>/proc/sys/net/ipv4/ip_forward

5. Start the pptpd daemon

servicepptpdstart

6. Configure iptables firewall access and forwarding rules

iptables-tnat-APOSTROUTING-s192.168.0.0/24-oeth0-jMASQUERADE

The IP address range 192.168.0.1/24 must be changed to the IP address range of the localip and remoteip you configured in/etc/pptp. conf.

serviceiptablessave

Security suggestions

The VPN and the website are put together, which may be insecure. They suggested that I add an IP address for the VPS so that the VPN service and the Web can use different IP addresses, so that the IP address of the VPN Server will not be easily exposed because of the content posted by the Web site.