Koozali.org: home of the SME Server

VPN Client HOWTO

Lloyd Keen

VPN Client HOWTO
« on: December 14, 2002, 10:46:50 AM »
For anybody that's interested I've put together a quick and dirty howto for E-smith as a VPN Client. I'll post a more detailed HOWTO over the next couple of days.
Scenario: You need to have your 5.5 box connect to a third party VPN server (in this case another 5.5 box for testing purposes).
VPN Server External IP: 203.213.110.XXX
VPN Server local network 192.168.163.0
Download and install pptp-linux-1.1.0-1.i386.rpm. Goto the local networks panel of the server-manager (on the client) and add the local network of the vpn server. Now we need to modify 2 files on the client.
#mcedit /etc/ppp/options.pptp
and add the following lines to bottom of the file
nodefaultroute
noproxyarp
ipparam pptp
Save the file and exit.
#mcedit /etc/ppp/ip-up.local
looks like

case $IPPARAM in
    pptpd)
        /sbin/e-smith/signal-event ip-up.pptpd "$@"
                        ;;
        *)
        case $NEWIP in

change it to be

case $IPPARAM in
    pptpd)
        /sbin/e-smith/signal-event ip-up.pptpd "$@"
                        ;;
    pptp)             ;;  # No IP Change for pptpclient
    *)
        case $NEWIP in

Thats the client side setup. Now start the client configuration program and choose option 3 to setup the tunnel.
[root@server root]# pptp-command
1.) start
2.) stop
3.) setup
4.) quit
What task would you like to do?:
1.) Manage CHAP secrets
2.) Manage PAP secrets
3.) List PPTP Tunnels
4.) Add a NEW PPTP Tunnel
5.) Delete a PPTP Tunnel
6.) Configure resolv.conf
7.) Select a default tunnel
8.) Quit
?:
You will need to add a new chap secret which will be one of the users from the vpn server, just accept the default for the remote name.
Now select option 4 to add a new tunnel. Choose a friendly name for the tunnel that describes the vpn server, then insert the IP address of the vpn server and finally when you get the route part insert the following:
route: add -net 192.168.163.0 netmask 255.255.255.0 TUNNEL_DEV
That's it. Make this the default tunnel by choosing option 7 from the setup menu and then bring the tunnel up with:
#pptp-command start
You should see something similar to the following:
[root@server root]# pptp-command start
Route: add -net 192.168.163.0 netmask 255.255.255.0 ppp0 added
All routes added.
Tunnel becool is active on ppp0.  IP Address: 192.168.163.250
Test by pinging the vpn server local IP
#ping 192.168.163.1
To stop the tunnel do:
#pptp-command stop
I'll try to template this and write a more detailed HOWTO later. Many thanks to my mate David Biczo for helping out with ipparam.
Regards Lloyd

Mark

Re: VPN Client HOWTO
« Reply #1 on: January 05, 2003, 03:01:48 AM »
Thanks for posting this
I can succesfully establish a tunnel but the connection is not shared to my local network .. that is I can ping the remote network from the gateway but not any of my local machines that use the gateway. Any ideas anyone???

cheers

Mark

Lynn

Re: VPN Client HOWTO
« Reply #2 on: January 24, 2003, 10:24:25 PM »
Is your SME installed as a Private Server/Gateway?

If thats the case, pings arent allowed thru the gateway, nor will it respond to external pings.

Only in Public mode.

Nice feature actually - means DOS ping attacks fall flat. Be nice if Public mode had the option to disable external pings...