VPN PPTP

VPN PPTP

[Luis GUSTAVO]

hi people,


I make nat with my linux, and i have other machine
windo 2000 server installed and configured vpn with
pptp.


and i want forward:

port 1723 and the protocol GRE.


how can i make this.



=====

Luis GUSTAVO         lgpcf(arroba)yahoo(ponto)com(ponto)br
+55 (21) 9891-3560    
---------------------------------------------------------------------------------
 










______________________________________________________________________

Yahoo! Messenger - Fale com seus amigos online. Instale agora! 
http://br.download.yahoo.com/messenger/

Re: VPN PPTP

[Antony Stone]

On Wednesday 16 June 2004 8:12 pm, Luis GUSTAVO wrote:

> hi people,
>
> I make nat with my linux, and i have other machine
> windo 2000 server installed and configured vpn with
> pptp.
>
> and i want forward:
>
> port 1723 and the protocol GRE.
>
> how can i make this.

iptables -A FORWARD -p gre -s a.b.c.d -d w.x.y.z -j ACCEPT
iptables -A FORWARD -p tcp --dport 1723 -s a.b.c.d -d w.x.y.z -j ACCEPT

If your /etc/protocols file does not contain a definition for GRE (some do, 
some don't) then simply substitute the number 47 for gre in the rule above.

You probably only want on of the -s a.b.c.d or the -d w.x.y.z specifications, 
depending on which end of the link you are controlling (you say it's the 
server, so you probably want the -d w.x.y.z).

Also, if you are doing NAT, be aware that you can only support one PPTP 
connection at a time unless you use the PPTP-NAT conntrack helper module from 
patch-o-matic.

Regards,

Antony.

-- 
In Heaven, the police are British, the chefs are Italian, the beer is Belgian, 
the mechanics are German, the lovers are French, the entertainment is 
American, and everything is organised by the Swiss.

In Hell, the police are German, the chefs are British, the beer is American, 
the mechanics are French, the lovers are Swiss, the entertainment is Belgian, 
and everything is organised by the Italians.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: VPN PPTP

[Luis GUSTAVO]

yes.. i use NAT.

but i download patch-o-matic, and apply pptp-nat.

which rules i use now ?


--- Antony Stone <Antony@Soft-Solutions.co.uk>
escreveu: > On Wednesday 16 June 2004 8:12 pm, Luis
GUSTAVO
> wrote:
> 
> > hi people,
> >
> > I make nat with my linux, and i have other machine
> > windo 2000 server installed and configured vpn
> with
> > pptp.
> >
> > and i want forward:
> >
> > port 1723 and the protocol GRE.
> >
> > how can i make this.
> 
> iptables -A FORWARD -p gre -s a.b.c.d -d w.x.y.z -j
> ACCEPT
> iptables -A FORWARD -p tcp --dport 1723 -s a.b.c.d
> -d w.x.y.z -j ACCEPT
> 
> If your /etc/protocols file does not contain a
> definition for GRE (some do, 
> some don't) then simply substitute the number 47 for
> gre in the rule above.
> 
> You probably only want on of the -s a.b.c.d or the
> -d w.x.y.z specifications, 
> depending on which end of the link you are
> controlling (you say it's the 
> server, so you probably want the -d w.x.y.z).
> 
> Also, if you are doing NAT, be aware that you can
> only support one PPTP 
> connection at a time unless you use the PPTP-NAT
> conntrack helper module from 
> patch-o-matic.
> 
> Regards,
> 
> Antony.
> 
> -- 
> In Heaven, the police are British, the chefs are
> Italian, the beer is Belgian, 
> the mechanics are German, the lovers are French, the
> entertainment is 
> American, and everything is organised by the Swiss.
> 
> In Hell, the police are German, the chefs are
> British, the beer is American, 
> the mechanics are French, the lovers are Swiss, the
> entertainment is Belgian, 
> and everything is organised by the Italians.
> 
>                                                     
> Please reply to the list;
>                                                     
>       please don't CC me.
> 
> 
>  

=====

Luis GUSTAVO         lgpcf(arroba)yahoo(ponto)com(ponto)br
+55 (21) 9891-3560    
---------------------------------------------------------------------------------
 










______________________________________________________________________

Yahoo! Messenger - Fale com seus amigos online. Instale agora! 
http://br.download.yahoo.com/messenger/

Re: VPN PPTP

[Antony Stone]

On Wednesday 16 June 2004 8:57 pm, Luis GUSTAVO wrote:

> yes.. i use NAT.
>
> but i download patch-o-matic, and apply pptp-nat.
>
> which rules i use now ?

The ones I suggested earlier (with the addition, of course, of the appropriate 
NAT rules, which presumably need to go in your PREROUTING chain (if you're 
doing destination NAT?).

Regards,

Antony.

> --- Antony Stone <Antony@Soft-Solutions.co.uk>
> escreveu: > On Wednesday 16 June 2004 8:12 pm, Luis
> GUSTAVO
>
> > wrote:
> > > hi people,
> > >
> > > I make nat with my linux, and i have other machine
> > > windo 2000 server installed and configured vpn with
> > > pptp.
> > >
> > > and i want forward:
> > >
> > > port 1723 and the protocol GRE.
> > >
> > > how can i make this.
> >
> > iptables -A FORWARD -p gre -s a.b.c.d -d w.x.y.z -j ACCEPT
> > iptables -A FORWARD -p tcp --dport 1723 -s a.b.c.d
> > -d w.x.y.z -j ACCEPT
> >
> > If your /etc/protocols file does not contain a definition for GRE (some
> > do, some don't) then simply substitute the number 47 for gre in the rule
> > above.
> >
> > You probably only want on of the -s a.b.c.d or the -d w.x.y.z
> > specifications, depending on which end of the link you are controlling
> > (you say it's the server, so you probably want the -d w.x.y.z).
> >
> > Regards,
> >
> > Antony.

-- 
Most people have more than the average number of legs.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: VPN PPTP

[Antony Stone]

On Wednesday 16 June 2004 9:19 pm, Antony Stone wrote:

> On Wednesday 16 June 2004 8:57 pm, Luis GUSTAVO wrote:
> > yes.. i use NAT.
> >
> > but i download patch-o-matic, and apply pptp-nat.
> >
> > which rules i use now ?
>
> The ones I suggested earlier (with the addition, of course, of the
> appropriate NAT rules, which presumably need to go in your PREROUTING chain
> (if you're doing destination NAT?).

Just in case your next posting was going to be something like "I have those 
rules, but it doesn't work", here is a suggestion for how to find out what's 
not working.

Add two LOGging rules to the end of your FORWARD chain, one specifying at 
least one of (a) the source address of the remote client, and/or (b) the 
destination address of the server on your network, and the other specifying 
at least one of (a) the source address of your local server, and/or (b) the 
destination address of the remote client.

Then the LOG output will show you any packets going between the two machines 
which are not being properly processed by the ACCEPT rules I suggested 
earlier, and you can see what sort of packets they are, and add appropriate 
rules to let them through.

Regards,

Antony.

-- 
The lottery is a tax for people who can't do maths.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: VPN PPTP

[Luis GUSTAVO]

ok thank you..



--- Antony Stone <Antony@Soft-Solutions.co.uk>
escreveu: > On Wednesday 16 June 2004 9:19 pm, Antony
Stone
> wrote:
> 
> > On Wednesday 16 June 2004 8:57 pm, Luis GUSTAVO
> wrote:
> > > yes.. i use NAT.
> > >
> > > but i download patch-o-matic, and apply
> pptp-nat.
> > >
> > > which rules i use now ?
> >
> > The ones I suggested earlier (with the addition,
> of course, of the
> > appropriate NAT rules, which presumably need to go
> in your PREROUTING chain
> > (if you're doing destination NAT?).
> 
> Just in case your next posting was going to be
> something like "I have those 
> rules, but it doesn't work", here is a suggestion
> for how to find out what's 
> not working.
> 
> Add two LOGging rules to the end of your FORWARD
> chain, one specifying at 
> least one of (a) the source address of the remote
> client, and/or (b) the 
> destination address of the server on your network,
> and the other specifying 
> at least one of (a) the source address of your local
> server, and/or (b) the 
> destination address of the remote client.
> 
> Then the LOG output will show you any packets going
> between the two machines 
> which are not being properly processed by the ACCEPT
> rules I suggested 
> earlier, and you can see what sort of packets they
> are, and add appropriate 
> rules to let them through.
> 
> Regards,
> 
> Antony.
> 
> -- 
> The lottery is a tax for people who can't do maths.
> 
>                                                     
> Please reply to the list;
>                                                     
>       please don't CC me.
> 
> 
>  

=====

SlackWare Simply  the Best

 

Luis GUSTAVO         
+55 (21) 9891-3560    
---------------------------------------------------------------------------------
 











______________________________________________________________________

Yahoo! Messenger - Fale com seus amigos online. Instale agora! 
http://br.download.yahoo.com/messenger/