* VPN PPTP @ 2004-06-16 19:12 Luis GUSTAVO 2004-06-16 19:41 ` Antony Stone 0 siblings, 1 reply; 6+ messages in thread From: Luis GUSTAVO @ 2004-06-16 19:12 UTC (permalink / raw) To: netfilter hi people, I make nat with my linux, and i have other machine windo 2000 server installed and configured vpn with pptp. and i want forward: port 1723 and the protocol GRE. how can i make this. ===== Luis GUSTAVO lgpcf(arroba)yahoo(ponto)com(ponto)br +55 (21) 9891-3560 --------------------------------------------------------------------------------- ______________________________________________________________________ Yahoo! Messenger - Fale com seus amigos online. Instale agora! http://br.download.yahoo.com/messenger/ ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: VPN PPTP 2004-06-16 19:12 VPN PPTP Luis GUSTAVO @ 2004-06-16 19:41 ` Antony Stone 2004-06-16 19:57 ` Luis GUSTAVO 0 siblings, 1 reply; 6+ messages in thread From: Antony Stone @ 2004-06-16 19:41 UTC (permalink / raw) To: netfilter On Wednesday 16 June 2004 8:12 pm, Luis GUSTAVO wrote: > hi people, > > I make nat with my linux, and i have other machine > windo 2000 server installed and configured vpn with > pptp. > > and i want forward: > > port 1723 and the protocol GRE. > > how can i make this. iptables -A FORWARD -p gre -s a.b.c.d -d w.x.y.z -j ACCEPT iptables -A FORWARD -p tcp --dport 1723 -s a.b.c.d -d w.x.y.z -j ACCEPT If your /etc/protocols file does not contain a definition for GRE (some do, some don't) then simply substitute the number 47 for gre in the rule above. You probably only want on of the -s a.b.c.d or the -d w.x.y.z specifications, depending on which end of the link you are controlling (you say it's the server, so you probably want the -d w.x.y.z). Also, if you are doing NAT, be aware that you can only support one PPTP connection at a time unless you use the PPTP-NAT conntrack helper module from patch-o-matic. Regards, Antony. -- In Heaven, the police are British, the chefs are Italian, the beer is Belgian, the mechanics are German, the lovers are French, the entertainment is American, and everything is organised by the Swiss. In Hell, the police are German, the chefs are British, the beer is American, the mechanics are French, the lovers are Swiss, the entertainment is Belgian, and everything is organised by the Italians. Please reply to the list; please don't CC me. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: VPN PPTP 2004-06-16 19:41 ` Antony Stone @ 2004-06-16 19:57 ` Luis GUSTAVO 2004-06-16 20:19 ` Antony Stone 0 siblings, 1 reply; 6+ messages in thread From: Luis GUSTAVO @ 2004-06-16 19:57 UTC (permalink / raw) To: netfilter yes.. i use NAT. but i download patch-o-matic, and apply pptp-nat. which rules i use now ? --- Antony Stone <Antony@Soft-Solutions.co.uk> escreveu: > On Wednesday 16 June 2004 8:12 pm, Luis GUSTAVO > wrote: > > > hi people, > > > > I make nat with my linux, and i have other machine > > windo 2000 server installed and configured vpn > with > > pptp. > > > > and i want forward: > > > > port 1723 and the protocol GRE. > > > > how can i make this. > > iptables -A FORWARD -p gre -s a.b.c.d -d w.x.y.z -j > ACCEPT > iptables -A FORWARD -p tcp --dport 1723 -s a.b.c.d > -d w.x.y.z -j ACCEPT > > If your /etc/protocols file does not contain a > definition for GRE (some do, > some don't) then simply substitute the number 47 for > gre in the rule above. > > You probably only want on of the -s a.b.c.d or the > -d w.x.y.z specifications, > depending on which end of the link you are > controlling (you say it's the > server, so you probably want the -d w.x.y.z). > > Also, if you are doing NAT, be aware that you can > only support one PPTP > connection at a time unless you use the PPTP-NAT > conntrack helper module from > patch-o-matic. > > Regards, > > Antony. > > -- > In Heaven, the police are British, the chefs are > Italian, the beer is Belgian, > the mechanics are German, the lovers are French, the > entertainment is > American, and everything is organised by the Swiss. > > In Hell, the police are German, the chefs are > British, the beer is American, > the mechanics are French, the lovers are Swiss, the > entertainment is Belgian, > and everything is organised by the Italians. > > > Please reply to the list; > > please don't CC me. > > > ===== Luis GUSTAVO lgpcf(arroba)yahoo(ponto)com(ponto)br +55 (21) 9891-3560 --------------------------------------------------------------------------------- ______________________________________________________________________ Yahoo! Messenger - Fale com seus amigos online. Instale agora! http://br.download.yahoo.com/messenger/ ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: VPN PPTP 2004-06-16 19:57 ` Luis GUSTAVO @ 2004-06-16 20:19 ` Antony Stone 2004-06-16 20:39 ` Antony Stone 0 siblings, 1 reply; 6+ messages in thread From: Antony Stone @ 2004-06-16 20:19 UTC (permalink / raw) To: netfilter On Wednesday 16 June 2004 8:57 pm, Luis GUSTAVO wrote: > yes.. i use NAT. > > but i download patch-o-matic, and apply pptp-nat. > > which rules i use now ? The ones I suggested earlier (with the addition, of course, of the appropriate NAT rules, which presumably need to go in your PREROUTING chain (if you're doing destination NAT?). Regards, Antony. > --- Antony Stone <Antony@Soft-Solutions.co.uk> > escreveu: > On Wednesday 16 June 2004 8:12 pm, Luis > GUSTAVO > > > wrote: > > > hi people, > > > > > > I make nat with my linux, and i have other machine > > > windo 2000 server installed and configured vpn with > > > pptp. > > > > > > and i want forward: > > > > > > port 1723 and the protocol GRE. > > > > > > how can i make this. > > > > iptables -A FORWARD -p gre -s a.b.c.d -d w.x.y.z -j ACCEPT > > iptables -A FORWARD -p tcp --dport 1723 -s a.b.c.d > > -d w.x.y.z -j ACCEPT > > > > If your /etc/protocols file does not contain a definition for GRE (some > > do, some don't) then simply substitute the number 47 for gre in the rule > > above. > > > > You probably only want on of the -s a.b.c.d or the -d w.x.y.z > > specifications, depending on which end of the link you are controlling > > (you say it's the server, so you probably want the -d w.x.y.z). > > > > Regards, > > > > Antony. -- Most people have more than the average number of legs. Please reply to the list; please don't CC me. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: VPN PPTP 2004-06-16 20:19 ` Antony Stone @ 2004-06-16 20:39 ` Antony Stone 2004-06-16 20:43 ` Luis GUSTAVO 0 siblings, 1 reply; 6+ messages in thread From: Antony Stone @ 2004-06-16 20:39 UTC (permalink / raw) To: netfilter On Wednesday 16 June 2004 9:19 pm, Antony Stone wrote: > On Wednesday 16 June 2004 8:57 pm, Luis GUSTAVO wrote: > > yes.. i use NAT. > > > > but i download patch-o-matic, and apply pptp-nat. > > > > which rules i use now ? > > The ones I suggested earlier (with the addition, of course, of the > appropriate NAT rules, which presumably need to go in your PREROUTING chain > (if you're doing destination NAT?). Just in case your next posting was going to be something like "I have those rules, but it doesn't work", here is a suggestion for how to find out what's not working. Add two LOGging rules to the end of your FORWARD chain, one specifying at least one of (a) the source address of the remote client, and/or (b) the destination address of the server on your network, and the other specifying at least one of (a) the source address of your local server, and/or (b) the destination address of the remote client. Then the LOG output will show you any packets going between the two machines which are not being properly processed by the ACCEPT rules I suggested earlier, and you can see what sort of packets they are, and add appropriate rules to let them through. Regards, Antony. -- The lottery is a tax for people who can't do maths. Please reply to the list; please don't CC me. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: VPN PPTP 2004-06-16 20:39 ` Antony Stone @ 2004-06-16 20:43 ` Luis GUSTAVO 0 siblings, 0 replies; 6+ messages in thread From: Luis GUSTAVO @ 2004-06-16 20:43 UTC (permalink / raw) To: netfilter ok thank you.. --- Antony Stone <Antony@Soft-Solutions.co.uk> escreveu: > On Wednesday 16 June 2004 9:19 pm, Antony Stone > wrote: > > > On Wednesday 16 June 2004 8:57 pm, Luis GUSTAVO > wrote: > > > yes.. i use NAT. > > > > > > but i download patch-o-matic, and apply > pptp-nat. > > > > > > which rules i use now ? > > > > The ones I suggested earlier (with the addition, > of course, of the > > appropriate NAT rules, which presumably need to go > in your PREROUTING chain > > (if you're doing destination NAT?). > > Just in case your next posting was going to be > something like "I have those > rules, but it doesn't work", here is a suggestion > for how to find out what's > not working. > > Add two LOGging rules to the end of your FORWARD > chain, one specifying at > least one of (a) the source address of the remote > client, and/or (b) the > destination address of the server on your network, > and the other specifying > at least one of (a) the source address of your local > server, and/or (b) the > destination address of the remote client. > > Then the LOG output will show you any packets going > between the two machines > which are not being properly processed by the ACCEPT > rules I suggested > earlier, and you can see what sort of packets they > are, and add appropriate > rules to let them through. > > Regards, > > Antony. > > -- > The lottery is a tax for people who can't do maths. > > > Please reply to the list; > > please don't CC me. > > > ===== SlackWare Simply the Best Luis GUSTAVO +55 (21) 9891-3560 --------------------------------------------------------------------------------- ______________________________________________________________________ Yahoo! Messenger - Fale com seus amigos online. Instale agora! http://br.download.yahoo.com/messenger/ ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2004-06-16 20:43 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2004-06-16 19:12 VPN PPTP Luis GUSTAVO 2004-06-16 19:41 ` Antony Stone 2004-06-16 19:57 ` Luis GUSTAVO 2004-06-16 20:19 ` Antony Stone 2004-06-16 20:39 ` Antony Stone 2004-06-16 20:43 ` Luis GUSTAVO
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox