RE: Unable to apply pptp patch

RE: Unable to apply pptp patch

[George Vieira]

Yes limitation is to all versions and it's not a netfilter problem.. it's
the design of PPTP which was microsoft big stuff up from memory. The design
didn't allow multiple connections from the same source..
Use a Linux to Linux VPN and you can route the whole network back and
forth....

Also PPTP isn't the best VPN but is widely used due to the Micro$oft support
for it..

I'd rather use IPSEC if I can only just compile my damn kernel right for
once.. (it's been a while)..

-----Original Message-----
From: R. Sterenborg [mailto:rsterenborg@xs4all.nl]
Sent: Wednesday, 03 July 2002 5:23 PM
To: netfilter@lists.samba.org
Subject: Re: Unable to apply pptp patch


----- Original Message -----
From: "Rowan Reid" <rreid@studio3arc.com>
To: <netfilter@lists.samba.org>
Sent: Wednesday, July 03, 2002 3:08 AM
Subject: Unable to apply pptp patch

> Has anyone been able to apply the pptp patch to a 2.4.4 or above kernel
> I've used rusties patch-o-matic with the make pending-pom_patches
> Whenever I get to the pptp patch it fails. Several others fail too.  I
> tried on a 2.4.8 and a 2.4.4 kernel.
>
I think there are multiple PPTP patches available.
I got mine from http://www.impsec.org/linux/masquerade/ip_masq_vpn.html and
it works like a charm.
There are patches for 2.4.12, 2.4.15 and 2.4.17.

The Netfilter website says that the PPTP patch that can be downloaded on
their site has a limitation so you can only make one pptp connection to one
host - not stopping you to make another connection to another host.
I don't know if the one I use has the same limitation.

I have it up and running with the 2.4.17 kernel.
No problems encountered here (yet). Just patched the kernel and recompiled
it.
Then I compiled a new iptables and it worked.

Rob

Re: Unable to apply pptp patch

[Antony Stone]

On Wednesday 03 July 2002 10:18 am, George Vieira wrote:

> Yes limitation is to all versions and it's not a netfilter problem.. it's
> the design of PPTP which was microsoft big stuff up from memory. The design
> didn't allow multiple connections from the same source..
> Use a Linux to Linux VPN and you can route the whole network back and
> forth....
>
> Also PPTP isn't the best VPN but is widely used due to the Micro$oft
> support for it..
>
> I'd rather use IPSEC if I can only just compile my damn kernel right for
> once.. (it's been a while)..

FreeS/WAN isn't difficult - it just takes a while, and you have to follow the 
instructions carefully.   I think the guides and documentation on 
http://www.freeswan.org are very good, though.

 

Antony.

Re: Unable to apply pptp patch

[Ross Vandegrift]

> > I'd rather use IPSEC if I can only just compile my damn kernel right for
> > once.. (it's been a while)..
> 
> FreeS/WAN isn't difficult - it just takes a while, and you have to follow the 
> instructions carefully.   I think the guides and documentation on 
> http://www.freeswan.org are very good, though.

Does anyone distribute the FreeS/WAN kernel code as a patch instead of
the crazy scriptish system they use?  I've never been able to get that
part working without many hours of fudging.  And after that, I'd *never*
want to have to do it again.  OTOH, if someone had a way to make diffs,
that would be very easy.

Ross Vandegrift
ross@willow.seitz.com

Re: IPsec & FreeS/WAN

[Antony Stone]

On Wednesday 03 July 2002 8:01 pm, Ross Vandegrift wrote:

> > > I'd rather use IPSEC if I can only just compile my damn kernel right
> > > for once.. (it's been a while)..
> >
> > FreeS/WAN isn't difficult - it just takes a while, and you have to follow
> > the instructions carefully.   I think the guides and documentation on
> > http://www.freeswan.org are very good, though.
>
> Does anyone distribute the FreeS/WAN kernel code as a patch instead of
> the crazy scriptish system they use?  I've never been able to get that
> part working without many hours of fudging.  And after that, I'd *never*
> want to have to do it again.  OTOH, if someone had a way to make diffs,
> that would be very easy.

What kernel source do you start from ?

I haven't had any problems using FreeS/WAN's method of patching / modifying 
the kernel source, but suppose someone did that on their machine and then 
sent you a set of diff files - if you can't get the FreeS/WAN system to work, 
surely you wouldn't be able to apply the diffs to your kernel source either ?

Do the problems you get suggest that the FreeS/WAN system can't find the 
right files to update, or it can't find the tools on your machine to do the 
updating with ?

The only thing I've ever had to load separately to get FreeS/WAN working is 
the gmp maths library.   I use the Slackware distro.

 

Antony.

Re: IPsec & FreeS/WAN

[Ross Vandegrift]

On Wed, Jul 03, 2002 at 08:12:22PM +0100, Antony Stone wrote:
> On Wednesday 03 July 2002 8:01 pm, Ross Vandegrift wrote:
> > Does anyone distribute the FreeS/WAN kernel code as a patch instead of
> > the crazy scriptish system they use?  I've never been able to get that
> > part working without many hours of fudging.  And after that, I'd *never*
> > want to have to do it again.  OTOH, if someone had a way to make diffs,
> > that would be very easy.
> 
> What kernel source do you start from ?

I start from a clean, bleeding edge tree in the 2.4 series.  I usually
apply a few misc patches: Andrew Morton's lowlatency, any available
reiserfs fixes, sometime and AC series patch.  Unfortunately, my HDD
died a week or two ago and I'm limping along on borrowed disk until my
RMA is fuffilled, so I can't check where the problem was.

Part of the problem was that there wasn't an easy way to just run the
kernel patching script.  IIRC, the scripts configure FreeS/WAN, and then
run something like "make config dep clean bzImage modules" in the kernel source
tree.  I'd much rather do "make patch" in the FreeS/WAN source tree, and
then be left to my own devices to build the KLIPS kernel.  Again, I'd
have hacked on this problem if my HDD hadn't died.

Perhpas when I get it back I'll do some work to make this part easier -
especially since were running into VPN type problems where I work.
What's the relative performance difference between an encrypted
vtun or vpnd session and an IPSec session?

Ross Vandegrift
ross@willow.seitz.com

Re: IPsec & FreeS/WAN

[Antony Stone]

On Thursday 04 July 2002 6:59 pm, Ross Vandegrift wrote:

> On Wed, Jul 03, 2002 at 08:12:22PM +0100, Antony Stone wrote:

> > What kernel source do you start from ?
>
> I start from a clean, bleeding edge tree in the 2.4 series.  I usually
> apply a few misc patches: Andrew Morton's lowlatency, any available
> reiserfs fixes, sometime and AC series patch.

> Part of the problem was that there wasn't an easy way to just run the
> kernel patching script.  IIRC, the scripts configure FreeS/WAN, and then
> run something like "make config dep clean bzImage modules" in the kernel
> source tree.  I'd much rather do "make patch" in the FreeS/WAN source tree,
> and then be left to my own devices to build the KLIPS kernel.

You should have a quick look at the Makefile for FreeS/WAN.

I've just had a look, and it's rather nicely split up into different sections 
/ modules for doing different bits, and for example, "make menugo" (which is 
the one I normally use) does:
make precheck verset insert
make mcf
make confcheck programs install kernel

Therefore I'm sure you could use this list to start working out which bits 
you'd like to run with the make script and which bits you want to do later on 
by hand...

 

Antony.

Re: Unable to apply pptp patch

[R. Sterenborg]

----- Original Message -----
From: "George Vieira" <GeorgeV@citadelcomputer.com.au>


> Yes limitation is to all versions and it's not a netfilter problem.. it's
Thanks for telling me... I was going to try it today.

> Also PPTP isn't the best VPN but is widely used due to the Micro$oft
support
> for it..
>
I know PPTP is crappy compared to a real VPN but we have Windows clients and
I have to support Windows 98, NT4 and 2000 for wich, at the time, I didn't
find a VPN client.
Also my collegue (semi-boss) didn't want a Linux PPTP server because he
cannot administer it, so I'm stuck with it (yet) ;-/

It's been a while since I searched ; is there a real VPN client and server
for Windows 9x/NT4/2000 ?
Since PPTP is obviously going to be a problem in the future, we will have to
have an alternative, heheh.. Even if that means we're going to have a Linux
VPN server.

> I'd rather use IPSEC if I can only just compile my damn kernel right for
> once.. (it's been a while)..
>
Haven't *really* looked into that yet. Can I use it with older Windows
clients ?
If so, I could try that too.


Rob

Re: Unable to apply pptp patch

[Antony Stone]

On Wednesday 03 July 2002 10:34 am, R. Sterenborg wrote:

> It's been a while since I searched ; is there a real VPN client and server
> for Windows 9x/NT4/2000 ?

By 'real', I assume you mean IPsec...

Are you looking for Open Source or $$$ ?

Open Source, no I don't think there is an IPsec client/server for Windows.

If you can spend $$$, then there's CheckPoint, obviously, I'm sure Cisco can 
do something, there's a Nortel VPN client commonly used on wireless LAN 
systems...

Depending on what you need, have you considered using an SSH based VPN ?

There are Open Source SSH clients for Windows, the server can be Windows or 
Linux, you get multiplexed port forwarding and strong encryption...   Might 
be a useful halfway house ?

 

Antony.

RE: Unable to apply pptp patch

[Joe Patterson]

>
> > It's been a while since I searched ; is there a real VPN client
> and server
> > for Windows 9x/NT4/2000 ?
>
> By 'real', I assume you mean IPsec...
>
> Are you looking for Open Source or $$$ ?
>
> Open Source, no I don't think there is an IPsec client/server for Windows.

Well, yes and no...  Windows 2000 and XP both have native support for IPSec.
Lame support, but native support.  The configuration of it is, to say the
least, unpleasant.  However, there is an open-source tool for 2K/XP from
Marcus Mueller at http://vpn.ebootis.de/, which helps make the windows
config much more reasonable.  This is, by the way, built specifically for
interoperating with FreeSwan, but may work with other things too.

Or if you want to pay for a windows client and get the linux server free,
there are several nice clients that interoperate with freeswan, such as
SafeNet and SSH Sentinel (and several others)

Beyond that, the best bet would probably be to get something from Cisco or
Nortel.  With those, you pay for the server and get the client for free.
And, they work fairly well.

But, we've digressed fairly far off topic now... The two mailing lists I
read the most are this and freeswan-users, so I sometimes forget what's on
topic for the list I'm responding to.  :)

> Depending on what you need, have you considered using an SSH based VPN ?
>
> There are Open Source SSH clients for Windows, the server can be
> Windows or
> Linux, you get multiplexed port forwarding and strong
> encryption...   Might
> be a useful halfway house ?

This works really well in some cases (i.e, I want to connect to a windows
box inside my lan using  the terminal services client... ssh works well),
but not so well in other cases (I need a file off of this server... I can't
redirect port 139, because I'm using it locally, I can't tell windows to use
a different port for netbios, so I'll ssh to my linux box, redirect term
serv to the internal box, term serv onto it, download a windows scp client,
scp the file I want onto the linux box, then scp it back to my laptop....
it works, but it's a pain in the butt, and I would *never* try and describe
how to do this to the typical user...)

>
>
>
> Antony.
>
>
>

Re: Unable to apply pptp patch

[Ramin Alidousti]

On Wed, Jul 03, 2002 at 07:18:29PM +1000, George Vieira wrote:

> Yes limitation is to all versions and it's not a netfilter problem.. it's
> the design of PPTP which was microsoft big stuff up from memory. The design
> didn't allow multiple connections from the same source..

And it wasn't supposed to. Not being an M$ lover, but:

pptp is a standard based on Cisco's L2F and Microsoft's L2TP. Its
design is meant as an extention of ppp where the remote end of the
ppp session is not the NAS/RAS (at the edge) but on the LNS (somewhere
within the IP cloud). pptp has some very nice applications, and in a
sense it can be considered as a VPN solution like any other tunneling
solution ipip/gre/... but one has never claimed that it's a secure VPN
solution like IPsec.

So, in short, don't blame something when using the wrong technology
as a wrong solution.

Ramin

> Use a Linux to Linux VPN and you can route the whole network back and
> forth....
> 
> Also PPTP isn't the best VPN but is widely used due to the Micro$oft support
> for it..
> 
> I'd rather use IPSEC if I can only just compile my damn kernel right for
> once.. (it's been a while)..

RE: Unable to apply pptp patch

[George Vieira]

Yeah I've compiled kernels over and over again.. just this time it's a sh$@
and I get CRC on reboots..

and this is a big network so I can't reboot it too often...

-----Original Message-----
From: Antony Stone [mailto:Antony@Soft-Solutions.co.uk]
Sent: Wednesday, 03 July 2002 7:26 PM
To: netfilter@lists.samba.org
Subject: Re: Unable to apply pptp patch


On Wednesday 03 July 2002 10:18 am, George Vieira wrote:

> Yes limitation is to all versions and it's not a netfilter problem.. it's
> the design of PPTP which was microsoft big stuff up from memory. The
design
> didn't allow multiple connections from the same source..
> Use a Linux to Linux VPN and you can route the whole network back and
> forth....
>
> Also PPTP isn't the best VPN but is widely used due to the Micro$oft
> support for it..
>
> I'd rather use IPSEC if I can only just compile my damn kernel right for
> once.. (it's been a while)..

FreeS/WAN isn't difficult - it just takes a while, and you have to follow
the 
instructions carefully.   I think the guides and documentation on 
http://www.freeswan.org are very good, though.

 

Antony.

Unable to apply pptp patch

[Rowan Reid]

Has anyone been able to apply the pptp patch to a 2.4.4 or above kernel
I've used rusties patch-o-matic with the make pending-pom_patches 
Whenever I get to the pptp patch it fails. Several others fail too.  I
tried on a 2.4.8 and a 2.4.4 kernel.
 
Rowan Reid
Job Captain, 
Systems Administrator
STUDIO 3 ARCHITECTS
909  982  1717

Re: Unable to apply pptp patch

[R. Sterenborg]

----- Original Message -----
From: "Rowan Reid" <rreid@studio3arc.com>
To: <netfilter@lists.samba.org>
Sent: Wednesday, July 03, 2002 3:08 AM
Subject: Unable to apply pptp patch

> Has anyone been able to apply the pptp patch to a 2.4.4 or above kernel
> I've used rusties patch-o-matic with the make pending-pom_patches
> Whenever I get to the pptp patch it fails. Several others fail too.  I
> tried on a 2.4.8 and a 2.4.4 kernel.
>
I think there are multiple PPTP patches available.
I got mine from http://www.impsec.org/linux/masquerade/ip_masq_vpn.html and
it works like a charm.
There are patches for 2.4.12, 2.4.15 and 2.4.17.

The Netfilter website says that the PPTP patch that can be downloaded on
their site has a limitation so you can only make one pptp connection to one
host - not stopping you to make another connection to another host.
I don't know if the one I use has the same limitation.

I have it up and running with the 2.4.17 kernel.
No problems encountered here (yet). Just patched the kernel and recompiled
it.
Then I compiled a new iptables and it worked.

Rob

RE: Unable to apply pptp patch

[Rowan Reid]

 I use has the same limitation.
> 
> I have it up and running with the 2.4.17 kernel.
> No problems encountered here (yet). Just patched the kernel 
> and recompiled it. Then I compiled a new iptables and it worked.
> 
> Rob
> 

I am trying the same version you are trying the problem I had was I was
using reiserfs and
It doesn't work with the 2.4.17 kernel.  Which new iptables did you
compile did you get a revised
Version from the netfilter site or is this related to the link you gave
me ?  I don’t recall seeing
Any version of netfilter listed.  With the problems I'm having I'm
figuring just adding another boxen
Then tying them togetehr via ipsec.  The reason I chose this option is
my other firewall which was previously
Set up is a firewall in a box solution....