Re: GRE/PPTP

[Philip Craig <philipc@snapgear.com>]

Jamie Vuyk wrote:
> 1)       Does the standard kernel (RH 2.4.18) need to be patched in any
> way in order to PASS THROUGH proto 47 (GRE) to an internal server?  Im
> running a simply iptables firewall which I want to pass an external VPN
> connection through to an internal server.  As I understand if I want
> Linux to terminate the PPTP VPN I need a patch, if I want it to pass
> through I don't.  However I am having a lot of trouble getting this to
> work and I would like to know if Im on the right track.  Also note that
> the firewall is masquerading all connections.

If you only ever have one PPTP connection per client/server pair (after
masquerading), then you can get by without any patches.  You will need to
forward both port 1723 and protocol 47 to the PPTP server.

If you may have more than one PPTP connection, then you need to apply
the PPTP conntrack patch from patch-o-matic.  You will need to forward
port 1723 to the PPTP server, and accept RELATED protocol 47 packets.
The PPTP conntrack will automatically NAT the protocol 47 packets to
go to the server.


> 2)       I have setup my firewall to allow and forward the 1723 to my
> internal server.  This appears to work but the external Win2k box gets
> stuck on "verifying username and password".  This eventually times out
> with "disconnected".  A simple test was to Telnet to port 1723.
> Although there is no response as such from the server (expected) it does
> connect both internally and externally.  At what point does the 1723
> data exchange end and the "payload" as such start on the GRE protocol?
> Is GRE involved in the 'verifying username and password' stage or is
> that still TCP on 1723?

This is definitely due to the protocol 47 packets not getting through.
The 'verifying username and password' stage is part of the PPP
negotiation, which runs over the GRE tunnel.

-- 
Philip Craig - philipc@snapgear.com - http://www.SnapGear.com
SnapGear - Custom Embedded Solutions and Security Appliances