Use pptpd to build a VPN Server in CentOS 6.7 x64

Use pptpd to build a VPN Server in CentOS 6.7 x64

Principle: PPTP uses the PPP protocol to encapsulate user data and then encapsulates PPP data frames in IP data packets. pptpd is more responsible for the connection from the client to the server, the ppp protocol encapsulates and forwards user data packets. When the client connects to the server, the pptpd service creates a virtual network card ppp0 to encapsulate user data packets, and forwards data packets to the physical network card, entering the Ethernet

1: verify whether the kernel is loaded with the MPPE Module

modprobeppp-compress-18&& echo MPPEisSuccess

# Print Success to indicate loaded

2: Install ppp Software

yum install ppp-y

3: Install pptpd

rpm-ivhhttp: //poptop .sourceforge.net /yum/beta/packages/pptpd-1 .4.0-1.el6.x86_64.rpm

4. Configure pptpd and ppp

vi /etc/ppp/options .pptpd

# Comment the following options # Remove

namepptpd refuse-pap refuse-chap refuse-mschap require-mschap-v2 require-mppe-128 ms-dns8.8.8.8 ms-dns8.8.4.4 proxyarp lock nobsdcomp novj novjccomp nologfd

If you do not know what to specify, you can refer to the explanation in the configuration file. Although it is all in English, the explanation is quite clear.

5. Add a user

vi /etc/ppp/chap-secrets

# Open the configuration file

username1pptpdpasswd1* # One user per row username2pptpdpasswd2* # It is the source ip address of the user name and service password (this can specify the network segment or unique IP address). If it does not match, all requests are rejected. The * Number knows what the regular expression knows.

6. Configure the pptpd service.

vi /etc/pptpd .conf

Remove the comments of the following lines

option /etc/ppp/options .pptpd logwtmp localip172.16.36.254 remoteip172.16.36.1-250

7. Enable kernel forwarding

vi /etc/sysctl .conf net.ipv4.ip_forward=1 # Find this option and change it to 1

# Save and run

sysctl-p

8. Start the pptpd service.

chkconfigpptpdon # Add to auto start upon startup servicepptpdstart # Start the pptpd Service

9: add firewall rules

# Back Up Original firewall rules

[root@ local ~] #cp/etc/sysconfig/iptables/etc/sysconfig/iptables.bak [root@ local ~] # Iptables-PINPUTACCEPT # Set all to allow, so as to avoid ssh disconnection when firewall rules are cleared. [root@ local ~] #iptables-F [root@ local ~] #iptables-X [root@ local ~] # Iptables-Z # clearing firewall rules ends

# Adding firewall rules

[root@ local ~] #iptables-AINPUT-ilo-pall-jACCEPT [root@ local ~] #iptables-AINPUT-pgre-jACCEPT [root@ local ~] #iptables-AINPUT-mstate--stateRELATED,ESTABLISHED-jACCEPT [root@ local ~] #iptables-AINPUT-ptcp-mtcp--dport21-jACCEPT [root@ local ~] #iptables-AINPUT-ptcp-mtcp--dport22-jACCEPT [root@ local ~] #iptables-AINPUT-ptcp-mtcp--dport80-jACCEPT [root@ local ~] #iptables-AINPUT-ptcp-mtcp--dport1723-jACCEPT [root@ local ~] #iptables-AFORWARD-ptcp--syn-s172.16.36.0/24-jTCPMSS--set-mss1356

# Set the shared ip address and nat table pre-Routing

[root@ local ~] #iptables-tnat-APOSTROUTING-s172.16.36.0/24-oeth0-jMASQUERADE

# Because the generated command will expire after restart, we will not save it to the configuration file.

[root@ local ~] #iptables-save>/etc/sysconfig/iptables

# Restart [root @ local ~] # Iptables

[root@ local ~] #serviceiptablesrestart

Send a reference to my VPS iptables document.

#Generatedbyiptables-savev1.4.7onMonSep2110:53:002015 *filter :INPUTACCEPT[2:156] :FORWARDACCEPT[0:0] :OUTPUTACCEPT[20:1845] -AINPUT-ilo-jACCEPT -AINPUT-pgre-jACCEPT -AINPUT-mstate--stateRELATED,ESTABLISHED-jACCEPT -AINPUT-ptcp-mtcp--dport21-jACCEPT -AINPUT-ptcp-mtcp--dport22-jACCEPT -AINPUT-ptcp-mtcp--dport25-jACCEPT -AINPUT-ptcp-mtcp--dport110-jACCEPT -AINPUT-ptcp-mtcp--dport80-jACCEPT -AINPUT-ptcp-mtcp--dport8080-jACCEPT -AINPUT-ptcp-mtcp--dport1723-jACCEPT -AINPUT-s127.0.0.1/32-ptcp-mtcp--dport3306-jACCEPT -AINPUT-ptcp-mtcp--dport3306-jDROP -AINPUT-ivirbr0-pudp-mudp--dport53-jACCEPT -AINPUT-ivirbr0-ptcp-mtcp--dport53-jACCEPT -AINPUT-ivirbr0-pudp-mudp--dport67-jACCEPT -AINPUT-ivirbr0-ptcp-mtcp--dport67-jACCEPT -AINPUT-pudp-mudp--dport53-jACCEPT -AFORWARD-s172.16.36.0/24-jACCEPT -AFORWARD-d172.16.36.0/24-jACCEPT -AFORWARD-ptcp--syn-s172.16.36.0/24-jTCPMSS--set-mss1356 -AFORWARD-ippp+-mstate--stateNEW,RELATED,ESTABLISHED-jACCEPT -AFORWARD-mstate--stateESTABLISHED,RELATED-jACCEPT -AFORWARD-d192.168.122.0/24-ovirbr0-mstate--stateRELATED,ESTABLISHED-jACCEPT -AFORWARD-s192.168.122.0/24-ivirbr0-jACCEPT -AFORWARD-ivirbr0-ovirbr0-jACCEPT -AFORWARD-ovirbr0-jREJECT--reject-withicmp-port-unreachable -AFORWARD-ivirbr0-jREJECT--reject-withicmp-port-unreachable COMMIT #CompletedonMonSep2110:53:002015 #Generatedbyiptables-savev1.4.7onMonSep2110:53:002015 *nat :PREROUTINGACCEPT[12:1068] :POSTROUTINGACCEPT[25:1844] :OUTPUTACCEPT[25:1844] -APOSTROUTING-s192.168.122.0/24!-d192.168.122.0/24-ptcp-jMASQUERADE--to-ports1024-65535 -APOSTROUTING-s192.168.122.0/24!-d192.168.122.0/24-pudp-jMASQUERADE--to-ports1024-65535 -APOSTROUTING-s192.168.122.0/24!-d192.168.122.0/24-jMASQUERADE -APOSTROUTING-s172.16.36.0/24-oeth2-jMASQUERADE COMMIT #CompletedonMonSep2110:53:002015 #Generatedbyiptables-savev1.4.7onMonSep2110:53:002015 *mangle :PREROUTINGACCEPT[283:25473] :INPUTACCEPT[281:25015] :FORWARDACCEPT[0:0] :OUTPUTACCEPT[258:37097] :POSTROUTINGACCEPT[258:37097] -APOSTROUTING-ovirbr0-pudp-mudp--dport68-jCHECKSUM--checksum-fill COMMIT #CompletedonMonSep2110:53:002015

If the windows client cannot access the intranet resources after the VPN is dialed, enter

route-padd172.16.0.0mask255.255.0.0192.168.10.254

Note: 172.16.0.0 is the vpn cidr block. You can use 192.168.1.0 or 192.168.10.0 based on your personal circumstances. The specific situation depends on your vpn cidr Block settings;
255.255.0.0 is a mask. Generally, 255.255.255.0 is used;
192.168.10.254 is the IP address of the LAN gateway. Set it as needed.