VPN configuration in Linux

Article title: VPN configuration in Linux. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
1. find the software
The software I use is pptpd-1.1.4-b3.tar. I don't know why. I won't upload the gz file here.
　　
2. Installation
After decompression,
./Configure
Make
Make install
　　
3. configuration file
Vi/etc/pptpd. conf
Code:
　　
Speed115200
Option/etc/ppp/options
Debug
# Localip 192.168.0.1 is useless. I commented out
Remoteip 192.168.0.20-30 is assigned, but I don't know why, the CLIENT IP is not allocated according to this statement: cry:
Enable chap
　　
Vi/etc/ppp/options
Code:
　　
Lock
Debug
# Name platinum.com.cn
Bsdcomp 0
Auth
Use chap for require-chap authentication
Proxyarp
# Ms-dns 202.106.196.152 this should be a re-allocated DNS for the CLIENT, but it seems useless and has not been deleted, it will be saved first
　　
Vi/etc/ppp/chap-secrets this is part of the CLIENT password definition
Code:
　　
# Secrets for authentication using PAP
# Client server secret IP addresses
"Platinum" * "vpntest" 192.168.0.10
　　
OK. Now the configuration is complete. run pptpd to start the service.
First turn off the firewall test, CLIENT: WIN2000
Create VPN dialing, and then specify the IP address 61.149.xx.xx
Note: In attribute editing, do not use encryption. Otherwise, it cannot be connected (it seems that the ms mschap patch is required. I did not find it)
　　
Connection, test passed
Reference:
　　
[Root @ platinum ppp] # netstat-a | more
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
Tcp 0 0 *: 1723 *: * LISTEN
Tcp 0 0 61.149.6.131: 1723 202.204.224.130: 1164 ESTABLISHED
Raw 0 0 61.149.6.131: gre 202.204.224.130: * 1
　　
　　
Slightly deleted content
Note: the external IP address 202.204.224.130 is connected. the VPN port is 1723.
In addition, there is also a GRE protocol name that is not TCP, UDP, ICMP !!!
This is the main transmission protocol of VPN, so you must enable this to configure the firewall.
　　
4. configure the firewall
My FIREWALL code is as follows:
Code:
　　
#! /Bin/bash
# Initial settings: allow Intranet forwarding
Echo 1>/proc/sys/net/ipv4/ip_forward
/Sbin/iptables-F-t filter
/Sbin/iptables-F-t nat
/Sbin/iptables-P INPUT ACCEPT
/Sbin/iptables-P OUTPUT ACCEPT
/Sbin/iptables-P FORWARD ACCEPT
/Sbin/iptables-t nat-P PREROUTING ACCEPT
/Sbin/iptables-t nat-P POSTROUTING ACCEPT
/Sbin/iptables-t nat-P OUTPUT ACCEPT
　　
# Allow all IP addresses in the intranet to do everything
/Sbin/iptables-a input-s 192.168.0.0/24-j ACCEPT
　　
# Open FTP port: 211
/Sbin/iptables-a input-p tcp -- dport 211-j ACCEPT
　　
# Open VPN Port 1723 and GRE !!!
/Sbin/iptables-a input-p tcp -- dport 1723-j ACCEPT
/Sbin/iptables-a input-p gre-j ACCEPT
　　
# WWW: 801, SWAT: 901
/Sbin/iptables-a input-p tcp -- dport 801-j ACCEPT
/Sbin/iptables-a input-p tcp -- dport 901-j ACCEPT
　　
# Socks5. 8039
/Sbin/iptables-a input-p tcp -- dport 8039-j ACCEPT
　　
# ICMP (PING)
# This sentence is the echo-request flag that allows ICMP protocol except all public IP addresses
# That is, allow the PING of the machine in the network, but do not send PONG
/Sbin/iptables-a input-p icmp -- icmp-type! Echo-request-j ACCEPT
　　
# NAT
/Sbin/iptables-t nat-a postrouting-o ppp0-s 192.168.0.0/24-j MASQUERADE
　　
# DENY OTHERS
# This statement is critical. you can set the active connection status of the IP address to avoid previous firewall vulnerabilities.
/Sbin/iptables-a input-m state -- state ESTABLISHED, RELATED-j ACCEPT
　　
# DROP all other unregistered ports!
/Sbin/iptables-a input-j DROP
　　
Of course, I can see from my FIREWALL that I have configured other services. I have added the SAMBA service and cannot access it without logging on to the VPN. After VPN + IPTABLES + SAMBA + FTP + WWW + SOCKS5 is configured, you can add other services to your machine, open the port externally, and change FIREWALL.