Install and configure PPTP_VPN_Server in CentOS

Lab environment: (1) all game servers in the company allow access from only one internet ip address. to maintain the server, you must first dial the server to the specified internet ip address. (2) the communication between the company and its headquarters is through the vpn channel. The company's internal ip address and vpn device are different network segments and must be under the vpn device.

Lab environment:

(1) all game servers of the company allow access from only one internet ip address. to maintain the server, you must first dial the server to the specified internet ip address.

(2) communication between the company and its headquarters is through the vpn channel. The company's internal ip address and vpn device are different network segments, and a dual Nic server needs to be connected under the vpn device.

 

Solution: Through The pptp protocol in linux, remote users can access the network securely through all the operating systems that support the point-to-Point Protocol.

 

Lab diagram:

 

 

Set up the Poptop service at 192.168.15.50 according to the solution.

 

About Poptop:

Poptop is an open-source implementation of PPTP servers. it is developed using C predictions and can run on x86 or Motorola's embedded ColdFire system. It can fully interoperate with Microsoft's pptp vpn client.

 

Point-to-Point Tunneling (PPTP) is a network technology that supports virtual private networks with multiple protocols. Through this protocol, remote users can securely access the company's network through Microsoft Windows NT Workstation, Windows 95 and Windows 98 operating systems, and other systems with point-to-point protocols, and can dial up to connect to the local ISP, link to the company network through Internet security.

PPTP can be used to establish a PPP session tunnel on an IP network. In this configuration, the PPTP tunnel and PPP session run on two identical machines, and the caller acts as the PNS. PPTP uses the client-server structure to separate some functions of the current network access server and supports virtual private networks. As a call control and management protocol, PPTP allows the server to control incoming call switches from the PSTN or ISDN and initiate external circuit exchange connections.

PPTP can only be implemented through PAC and PNS, and other systems do not need to know PPTP. The dial-up network can be connected to the PAC without knowing PPTP. The standard PPP client software can continue to operate on the tunnel PPP link.

PPTP uses an extended version of GRE to transmit user PPP packets. These enhancements allow lower-layer congestion control and flow control for tunnels that transmit user data between PAC and PNS. This mechanism allows efficient use of tunnel available bandwidth and avoids unnecessary retransmission and buffer overflow. PPTP does not specify a specific algorithm for lower-layer control, but it does define some communication parameters to support such algorithm work.

 

A software package is required for the Poptop environment:

1. Dkms

2. kernel_ppp_mppe MPPE (Microsoft Point to Point Encryption, Microsoft Point-to-Point Encryption)

3. ppp (Point-to-Point Protocol)

4. pptpd

 

The procedure is as follows:

1. check which software needs to be installed. because the 2.6.18 kernel of RHEL 5 has integrated the MPPE and the high-version ppp

[Root @ viong ~] # Rpm-q ppp

Ppp-2.4.4-2.el5

[Root @ viong ~] # Strings '/usr/sbin/pppd' | grep-I mppe | wc-l

42

Check whether the PPP supports MPPE. if the result shows "0", it means no, and "30" or a larger number means yes.

[Root @ viong ~] # Modprobe ppp-compress-18 & echo 'OK! MPPE was found! '

OK! MPPE was found!

Check whether the kernel MPPE patch is successfully installed: if the result shows "OK! MPPE was found !" It indicates the operation is successful.

[Root @ viong ~] # Rpm-q dkms

Package dkms is not installed

[Root @ viong ~] # Rpm-q pptpd

Package pptpd is not installed

 

2. install software

[Root @ viong soft] # rpm-ivh http://poptop.sourceforge.net/yum/stable/packages/dkms-2.0.17.5-1.noarch.rpm

[Root @ viong soft] rps-ivh http://poptop.sourceforge.net/yum/stable/packages/pptpd-1.3.4-1.rhel5.1.i386.rpm

 

3. modify pptpd. conf configuration parameters

[Root @ viong soft] # vi/etc/pptpd. conf

95 # (Recommended)

96 # localip 192.168.0.1

97 # remoteip 192.168.0.234-238,192.168 .0.245

To:

95 # (Recommended)

96 localip 192.168.126.2

97 remoteip 192.168.126.100-200

 

Note: Common configurations of/etc/pptpd. conf

Option/etc/ppp/options.ppt pd

Configuration file to be used by the PPP component;

Stimeout 120

Start PPTP to control the connection timeout, in seconds;

Debug

Record all debug information to system logs/var/log/messages;

Localip 192.168.1.10

The IP address allocated by the server VPN virtual interface can be set to the IP address of the same CIDR block as the intranet address of the VPN server, or the IP address of another CIDR block;

Remoteip 192.168.1.11-30

After the client VPN connection is successful, the assigned IP address segment can also be set to the IP address segment of the same network segment as the intranet address of the VPN server, or to the IP address segment of another network segment;

Logwtmp

This function is used to "use wtmp to record client connection and disconnection information

 

4.modify options.ppt pd configuration parameters

/Etc/ppp/options.ppt pd default configuration is OK

 

Note: Common configurations of/etc/ppp/options.ppt pd

Name pptpd

The name of the pptpd server.

Refuse-pap

Reject the pap authentication mode.

Refuse-chap

The chap authentication mode is denied.

Refuse-mschap

The mschap authentication mode is denied.

Require-mschap-v2

Microsoft's mschap-v2 is required for self-verification when the endpoint performs a connection handshake.

Require-mppe-128

The MPPE module adopts 128-bit encryption.

Ms-dns 61.139.2.69

Ms-dns 202.98.96.68

Ppp provides the DNS server IP address for Windows clients. the first ms-dns is the DNS Master, and the second is the DNS Slave.

Proxyarp

Create an ARP proxy key.

Debug

Enable the debugging mode. the related information is also recorded in/var/logs/message.

Lock

Lock the client's PTY device file.

Nobsdcomp

Disable the BSD compression mode.

Novj

Novjccomp

Disable the Van Jacob compression mode.

Nologfd

Do not record error messages to stderr)

 

5. modify chap-secrets configuration parameters

 

[Root @ viong soft] # vi/etc/ppp/chap-secrets

# Secrets for authentication using CHAP

# Client server secret IP addresse

"Viong" pptpd "123 "*

Note:

Viong user account

* Automatically identifies the host name of the current server. you can also manually configure the host name.

123 user password

* Indicates that an available IP address is automatically assigned. you can specify an IP address as needed.

Double quotation marks must be added to the account and password; otherwise, an error occurs.

 

You can also use the vpnuser command for configuration:

# Vpnuser add viong 123 add a viong user

 

6. enable route forwarding

 

Because the VPN client actually communicates data through the Internet Nic of the server after dialing, packet forwarding must be enabled to access the address of the intranet CIDR block so that packets of the Internet Nic can be forwarded to the intranet Nic.

 

[Root @ viong soft] # vi/etc/sysctl. conf
6 # Controls IP packet forwarding

7. net. ipv4.ip _ forward = 0

To:

6 # Controls IP packet forwarding

7. net. ipv4.ip _ forward = 1

[Root @ viong soft] # sysctl-p/etc/sysctl. conf

Route forwarding takes effect immediately

7. firewall configuration

 

SELinux authentication is enabled by default:

 

Run the following command to make pppd and pptp penetrate SELinux.

 

[Root @ viong soft] # setsebool pppd_disable_trans 1

 

[Root @ viong soft] # setssebool pptp_diable_trans 1

 

Attached is the method for disabling SELinux authentication:

Edit the vi/etc/sysconfig/selinux file and configure the following options:

SELINUX = disabled

If the modification does not take effect after restart, run the following command to make the modification take effect.

[Root @ viong soft] # setenforce 0

 

For hosts with iptables filter enabled, open the VPN service ports: 47 1723 and gre.

Edit the/etc/sysconfig/iptables file and add the following rules

-A RH-Firewall-1-INPUT-p gre-j ACCEPT

-A RH-Firewall-1-INPUT-p tcp-m state -- state NEW-m tcp -- dport 47-j ACCEPT

-A RH-Firewall-1-INPUT-p tcp-m state -- state NEW-m tcp -- dport 1723-j ACCEPT

[Root @ viong soft] # service iptables restart

Restart iptables to take effect.

Use Iptables for NAT service
After the VPN client is successfully dial-up, the default gateway of the local network will change to the VPN intranet address of the VPN server. in this way, the client can only connect to the VPN server and its intranet, but cannot access the Internet;

Iptables-t nat-a postrouting-s 192.168.126.0/24-j SNAT -- to Internet IP address

[Root @ viong ~] # Iptables-t nat-a postrouting-s 192.168.126.0/24-j SNAT -- to 192.168.15.50

[Root @ viong ~] # Echo iptables-t nat-a postrouting-s 192.168.126.0/24-j SNAT -- to 192.168.15.50>/etc/rc. local

Add to/etc/rc. local boot automatically

 

8. start pptp

[Root @ viong ~] # Service pptpd restart

[Root @ viong ~] # Netstat-ntpl | grep 1723

Tcp 0 0 0.0.0.0: 1723 0.0.0.0: * LISTEN 2585/pptpd

 

9. test whether dialing is successful

Client: Win 7

C: \ Documents Ents and Settings \ Administrator> ipconfig

Windows IP Configuration

Ethernet adapter Local connection:

Connection-specific DNS Suffix .:

IP Address ......: 192.168.15.253

Subnet Mask ......: 255.255.255.0

Default Gateway ......: 192.168.15.1

PPP adapter test:

Connection-specific DNS Suffix .:

IP Address ......: 192.168.126.100

Subnet Mask ......: 255.255.255.255

Default Gateway ......: 192.168.126.100

C: \ Documents Ents and Settings \ Administrator> ping 192.168.126.1

Pinging 192.168.126.1 with 32 bytes of data:

Reply from 192.168.126.1: bytes = 32 time = 144 ms TTL = 127

Reply from 192.168.126.1: bytes = 32 time = 4-ms TTL = 127

 

C: \ Documents Ents and Settings \ Administrator> ping www.baidu.com

Pinging www.a.shifen.com [119.75.216.20] with 32 bytes of data:

Reply from 119.75.216.20: bytes = 32 time = 33 ms TTL = 52

Reply from 119.75.216.20: bytes = 32 time = 27 ms TTL = 52

 

After the above test, it indicates that it has taken effect successfully.

 

 

This article is from "Chen Shenggang's blog", please be sure to keep this source http://chenshengang.blog.51cto.com/4399161/1425359