PPTP through iptables FW...

PPTP through iptables FW...

[Aldo S. Lagana]

I haven't looked into this, but is there a method to connect to a pptp
server from behind an iptables firewall?  I have seen glimpses of
persons using something called ip_conntrack_pptp (sp?) and that seems it
will fit the bill...not sure..here is ASCII art:

Client-----IPTABLES Firewall------INTERNET--------Remote PPTP
server------Server

I am currently using IPTables 1.2.5

RE: PPTP through iptables FW...

[Rowan Reid]

> I haven't looked into this, but is there a method to connect 
> to a pptp server from behind an iptables firewall?  I have 
> seen glimpses of persons using something called 
> ip_conntrack_pptp (sp?) and that seems it will fit the 
> bill...not sure..here is ASCII art:
> 
> Client-----IPTABLES Firewall------INTERNET--------Remote PPTP 
> server------Server
> 
> I am currently using IPTables 1.2.5
>

I guess I'll just share what I have learned. The below link details pptp
filtering.
I'm not familiar with conntrack_pptp (assuming this is a module)  The
method I have beeb
Following is transpaerent but is compiled in as a kernel patch kernel
2.4.17 or earlier.
Thus far I'm not getting a stable setup. Ie no filtering thus far.
Wouldn’t' mind working on this one.
 

ftp://ftp.rubyriver.com/pub/jhardin/masquerade/ip_masq_vpn.html

RE: PPTP through iptables FW...

[Aldo S. Lagana]

> -----Original Message-----
> From: netfilter-admin@lists.samba.org 
> [mailto:netfilter-admin@lists.samba.org] On Behalf Of Rowan Reid
> Sent: Monday, July 01, 2002 11:56 AM
> To: 'Aldo S. Lagana'; netfilter@lists.samba.org
> Subject: RE: PPTP through iptables FW...
> 
> 
> 
> 
> > I haven't looked into this, but is there a method to connect
> > to a pptp server from behind an iptables firewall?  I have 
> > seen glimpses of persons using something called 
> > ip_conntrack_pptp (sp?) and that seems it will fit the 
> > bill...not sure..here is ASCII art:
> > 
> > Client-----IPTABLES Firewall------INTERNET--------Remote PPTP
> > server------Server
> > 
> > I am currently using IPTables 1.2.5
> >
> 
> I guess I'll just share what I have learned. The below link 
> details pptp filtering. I'm not familiar with conntrack_pptp 
> (assuming this is a module)  The method I have beeb Following 
> is transpaerent but is compiled in as a kernel patch kernel 
> 2.4.17 or earlier. Thus far I'm not getting a stable setup. 
> Ie no filtering thus far. Wouldn't' mind working on this one.
>  
> 
ftp://ftp.rubyriver.com/pub/jhardin/masquerade/ip_masq_vpn.html

Yes I have seen that method for some time now, but I have heard that it
doesn't work very well?  
I have seen some discussions on this group about that conntrack module
(I think it's a P-O-M module) and was hoping that it did the same thing
as that VPN masquerade link you sent...

RE: PPTP through iptables FW...

[Rowan Reid]

 

> Yes I have seen that method for some time now, but I have 
> heard that it doesn't work very well?  
> I have seen some discussions on this group about that 
> conntrack module (I think it's a P-O-M module) and was hoping 
> that it did the same thing as that VPN masquerade link you sent...

That would be good if we could find a link. I am at the point of
reverting to a 
2.2.x Kernel and using IPCHAINS since it's proven you know. But I would
much
Prefer to use 2.4.x 

RE: PPTP through iptables FW...

[Aldo S. Lagana]

Here is what I found on the Netfilter site:

pptp-conntrack-nat 
Author: Harald Welte <laforge@gnumonks.org>
Status: Beta

This adds CONFIG_IP_NF_PPTP:
Connection tracking and NAT support for PPTP.

Note that this code currently has limitations
- can only NAT connections from PNS to PAC
- doesnt' support multiple calls within one session

Here's the link:
http://netfilter.samba.org/documentation/pomlist/pom-extra.html#pptp-con
ntrack-nat



> -----Original Message-----
> From: netfilter-admin@lists.samba.org 
> [mailto:netfilter-admin@lists.samba.org] On Behalf Of Rowan Reid
> Sent: Monday, July 01, 2002 12:44 PM
> To: 'Aldo S. Lagana'; netfilter@lists.samba.org
> Subject: RE: PPTP through iptables FW...
> 
> 
>  
> 
> > Yes I have seen that method for some time now, but I have
> > heard that it doesn't work very well?  
> > I have seen some discussions on this group about that 
> > conntrack module (I think it's a P-O-M module) and was hoping 
> > that it did the same thing as that VPN masquerade link you sent...
> 
> That would be good if we could find a link. I am at the point 
> of reverting to a 
> 2.2.x Kernel and using IPCHAINS since it's proven you know. 
> But I would much Prefer to use 2.4.x 
> 
> 

RE: PPTP through iptables FW...

[Rowan Reid]

> This adds CONFIG_IP_NF_PPTP:
> Connection tracking and NAT support for PPTP.
> 
> Note that this code currently has limitations
> - can only NAT connections from PNS to PAC
> - doesnt' support multiple calls within one session

PNS to PAC ?? What does that mean.
Multiple calls within one session. Can anyone lend som elight on this ?

RE: PPTP through iptables FW...

[George Vieira]

Do what I do.. create a tunnel between the two networks instead of using the
client to make the connection...


client----firewall-------/ internet /-----firewall-----servers
          PPTP------------------------------PPTPD

then you can iptables the client through.. also proxy them in..

thanks,
George Vieira
Systems Manager
Citadel Computer Systems P/L
http://www.citadelcomputer.com.au



-----Original Message-----
From: Aldo S. Lagana [mailto:alagana@discmail.com]
Sent: Monday, 01 July 2002 11:59 PM
To: netfilter@lists.samba.org
Subject: PPTP through iptables FW...


I haven't looked into this, but is there a method to connect to a pptp
server from behind an iptables firewall?  I have seen glimpses of
persons using something called ip_conntrack_pptp (sp?) and that seems it
will fit the bill...not sure..here is ASCII art:

Client-----IPTABLES Firewall------INTERNET--------Remote PPTP
server------Server

I am currently using IPTables 1.2.5

RE: PPTP through iptables FW...

[George Vieira]

yes this is true, you can't make multiple VPN connections to the same host
with this patch but it doesn't stop you from connecting to other hosts.
Which is why I suggested to make a tunnel to connect networks together
rather than client-server... If client security is needed then SSH tunnel
through it..

thanks,
George Vieira
Systems Manager
Citadel Computer Systems P/L
http://www.citadelcomputer.com.au



-----Original Message-----
From: Aldo S. Lagana [mailto:alagana@discmail.com]
Sent: Tuesday, 02 July 2002 4:06 AM
To: 'Rowan Reid'; netfilter@lists.samba.org
Subject: RE: PPTP through iptables FW...


Here is what I found on the Netfilter site:

pptp-conntrack-nat 
Author: Harald Welte <laforge@gnumonks.org>
Status: Beta

This adds CONFIG_IP_NF_PPTP:
Connection tracking and NAT support for PPTP.

Note that this code currently has limitations
- can only NAT connections from PNS to PAC
- doesnt' support multiple calls within one session

Here's the link:
http://netfilter.samba.org/documentation/pomlist/pom-extra.html#pptp-con
ntrack-nat



> -----Original Message-----
> From: netfilter-admin@lists.samba.org 
> [mailto:netfilter-admin@lists.samba.org] On Behalf Of Rowan Reid
> Sent: Monday, July 01, 2002 12:44 PM
> To: 'Aldo S. Lagana'; netfilter@lists.samba.org
> Subject: RE: PPTP through iptables FW...
> 
> 
>  
> 
> > Yes I have seen that method for some time now, but I have
> > heard that it doesn't work very well?  
> > I have seen some discussions on this group about that 
> > conntrack module (I think it's a P-O-M module) and was hoping 
> > that it did the same thing as that VPN masquerade link you sent...
> 
> That would be good if we could find a link. I am at the point 
> of reverting to a 
> 2.2.x Kernel and using IPCHAINS since it's proven you know. 
> But I would much Prefer to use 2.4.x 
> 
>