Category: Linux

This howto describes the steps in how to setup a PPTP VPN on Centos, Fedora, Debian, and Ubuntu with basic RSA authentication.

Before the installation make sure to have your Yum repos updated with the Epel repos.

CentOS and Red Hat Enterprise Linux 5.x

CentOS and Red Hat Enterprise Linux 6.x

wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm && sudo rpm -Uvh epel-release-6*.rpm

CentOS and Red Hat Enterprise Linux 7.x

Step 1. Install PPTPD

CentOS/RedHat 5:

yum install pptpd.x86_64 -y

CentOS/RedHat 6:

yum install pptpd.x86_64 -y


Fedora 20:

yum install pptpd.x86_64 -y

Ubuntu/Debian:

apt-get install pptpd

Step 2. Edit IP setttings in /etc/pptpd.conf

echo > /etc/pptpd.conf

paste the following content into the pptpd.conf file

 

#start of custom file
#logwtmp
option /etc/ppp/options.pptpd
localip 192.168.0.1   # local vpn IP 
remoteip 192.168.0.100-200  # ip range for connections
listen 23.216.x.x # eth0 my example public IP and network interface
#end of custom file

Step 3. Add user account in/etc/ppp/chap-secrets (assign username and password)

vi /etc/ppp/chap-secrets

usernameForuser1 *  setpassword1here  *

usernameForuser2 *  setpassword2here  *

Step 4. Optional settings in /etc/ppp/options.pptpd

echo > /etc/ppp/options.pptpd

Paste the following to your options.pptp

 

#custom settings for a simple fast pptp server
ms-dns 8.8.8.8
ms-dns 4.2.2.2
lock
name pptpd
require-mschap-v2
# Require MPPE 128-bit encryption
# (note that MPPE requires the use of MSCHAP-V2 during authentication)
 require-mppe-128

 

Step 5. Enable network forwarding in /etc/sysctl.conf

vi /etc/sysctl.conf

net.ipv4.ip_forward = 1

use the following command to apply the change:

sysctl -p

Step 6. Configure firewall (don’t skip this step even if you have firewall disabled.)

# sudo nano /etc/rc.local
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE
iptables -A FORWARD -p tcp –syn -s 192.168.0.0/24 -j TCPMSS –set-mss 1356

Step 7. Start PPTP VPN server

Fedora/Debian:

service pptpd restart

Centos/Fedora:
/etc/init.d/pptpd restart-kill && /etc/init.d/pptpd start

Note: To avoid starting pptp on every reboot you can automated by running chkconfig pptp on

 

The log of the VPN server, by default, is combined with system log located at /var/log/messages.

Source: https://www.photonvps.com/billing/knowledgebase.php?action=displayarticle&id=58

On the local machine, type the BOLD part. The non-bold part is what you might see as output or prompt.

• Step 1:
  % ssh-keygen -t dsa
  Generating public/private dsa key pair.
  Enter file in which to save the key (~/.ssh/id_dsa): (just type return)
  Enter passphrase (empty for no passphrase): (just type return)
  Enter same passphrase again: (just type return)
  Your identification has been saved in ~/.ssh/id_dsa
  Your public key has been saved in ~/.ssh/id_dsa.pub
  The key fingerprint is:
  Some really long string
  %
• Step 2:
  Then, paste the content of the local ~/.ssh/id_dsa.pub file into the file ~/.ssh/authorized_keys on the remote host.
• RSA instead of DSA
  • If you want something strong, you could try
    % ssh-keygen -t rsa -b 4096
  • Instead of the names id_dsa and id_dsa.pub, it will be id_rsa and id_rsa.pub , etc.
  • The rest of the steps are identical.

That’s it!

FAQ:

• Q: I follow the exact steps, but ssh still ask me for my password!
• A: Check your remote .ssh directory. It should have only your own read/write/access permission (octal 700)
  % chmod 700 ~/.ssh

Source: http://www.ece.uci.edu/~chou/ssh-key.html

今天花了一晚上倒腾VPN服务器，因为是用的CENTOS，没法直接apt-get install pptpd，虽然网上有RPM包，但最后还是选择了源码安装，过程中碰到很多问题，在此总结一下：

1. make install后默认没有安装服务，需要自行创建/etc/rc.d/init.d/pptpd,写入代码如下：

#!/bin/sh
#
# Startup script for pptpd
#
# chkconfig: 345 85 15
# description: PPTP server
# processname: pptpd
# config: /etc/pptpd.conf

# Source function library.
. /etc/rc.d/init.d/functions
# See how we were called.
case "$1" in
start)
echo -n "Starting pptpd: "
if [ -f /var/lock/subsys/pptpd ] ; then
echo
exit 1
fi

daemon /usr/local/sbin/pptpd
echo
touch /var/lock/subsys/pptpd
;;
stop)
echo -n "Shutting down pptpd: "
killproc pptpd
echo
rm -f /var/lock/subsys/pptpd
;;
status)
status pptpd
;;
restart)
$0 stop
$0 start
;;
*)
echo "Usage: $0 {start|stop|restart|status}"
exit 1
esac

exit 0

2. 将pptpd安装为服务并随机启动:

chkconfig --add pptpd
chkconfig pptpd on
service pptpd start

3. 客户端链接的时候很可能提示错误，这是因为通过yum install ppp安装的组件版本与pptpd所支持的版本不一致，解决办法，修改/etc/pptpd.options,注释掉logwtmp即可。这个问题折磨我好久！=-=!

4. 还有一个很折腾人的问题，就是连上VPN后无法访问外网只能访问VPN服务器，原因是要通过iptables转发数据包才行，代码如下：

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
//add it to /etc/rc.d/rc.local for auto execution when rebooted.

5. 附上具体安装步骤：

//install ppp 
yum install ppp

//install pptpd, download source code and
./configure
make
make install

// update pptpd configurations in file /etc/pptpd.conf:
localip     192.168.9.1
remoteip    192.168.9.11-30

// /etc/ppp/options.pptpd:
ms-dns    8.8.8.8
ms-dns    8.8.4.4

// /etc/ppp/chap-secrets. Each line in the file has the format:
<username> pptpd <passwd> *

// /etc/sysctl.conf, use the following config:
net.ipv4.ip_forward = 1