PPTP reviisted

PPTP reviisted

[Chris Miller]

[-- Attachment #1: Type: text/plain, Size: 887 bytes --]

I've seen a few things in the netfilter archive about PPTP, but no one has
ever really said anything about getting it to work.

 

Here's the deal: I've got a Windows box (192.168.1.10) sitting behind my
Linux firewall. On the firewall runs Debian Woody with iptables 1.2.6a. The
Linux box acts as a NAT to all the hosts behind it. Currently I forward TCP
port 1723 to 192.168.1.10, but clients cannot connect. I know it's got
something to do with GRE?

 

I saw something on Google about an ip_conntrac_pptp module, or something to
that nature, but I've not been able to find it anywhere. I'd love to compile
it and give it a try if it's made to fix this issue.

 

So could someone fill me in with what my options are as far as getting my
VPN working through my NAT? What exactly is going on?

 

 

Thanks,

 

Chris Miller

Compuville Computers

www.compuville.net

423.276.6692

 


[-- Attachment #2: Type: text/html, Size: 4075 bytes --]

Re: PPTP reviisted

[Daniel Chemko]

[-- Attachment #1: Type: text/plain, Size: 1864 bytes --]

If you want to enable conntrack for Linux you will need:

1. A Recent Kernel, I know anything later than 2.4.20 can work fine.
2. Kernel patches from pptpclient.sourceforge.net if you want the 
firewall itself setting up the pptp tunnel, if not, ignore this step
3. CVS download the netfilter code from netfilter.org
4. Apply the patch-o-matic directory to your kernel sources directory 
like so:
# KERNEL_DIR=/usr/src/<kerneldir> ./runme extra
5. Apply all patches that you really care for, but I would recommend 
anything that doesn't fail out on your configuration.Make sure to 
include the connectrack patch
6. Build the kernel with the new netfilter options turned on as modules
7. Install Kernel
8. Execute the following every time you want pptp (once per boot):
# modprobe ip_conntrack_proto_gre
# modprobe ip_nat_proto_gre
# modprobe ip_conntrack_pptp
# modprobe ip_nat_pptp

Chris Miller wrote:

> I've seen a few things in the netfilter archive about PPTP, but no one 
> has ever really said anything about getting it to work.
>
>  
>
> Here's the deal: I've got a Windows box (192.168.1.10) sitting behind 
> my Linux firewall. On the firewall runs Debian Woody with iptables 
> 1.2.6a. The Linux box acts as a NAT to all the hosts behind it. 
> Currently I forward TCP port 1723 to 192.168.1.10, but clients cannot 
> connect. I know it's got something to do with GRE?
>
>  
>
> I saw something on Google about an ip_conntrac_pptp module, or 
> something to that nature, but I've not been able to find it anywhere. 
> I'd love to compile it and give it a try if it's made to fix this issue.
>
>  
>
> So could someone fill me in with what my options are as far as getting 
> my VPN working through my NAT? What exactly is going on?
>
>  
>
>  
>
> Thanks,
>
>  
>
> Chris Miller
>
> Compuville Computers
>
> www.compuville.net
>
> 423.276.6692
>
>  
>

[-- Attachment #2: Type: text/html, Size: 5225 bytes --]

RE: PPTP reviisted

[Chris Miller]

[-- Attachment #1: Type: text/plain, Size: 3000 bytes --]

Now I've got another problem. Here are the steps and what I did:

 

1)       I got kernel 2.4.22

2)       Didn't need this

3)       Done.

4)       Done.

5)       Did almost all of them. Didn't do the ones like ipv6 stuff.
Everything went fine. Done.

6)       Done.

7)       Booted new kernel. Everything seems fine. SSH in so I can apply a
rule that for some reason didn't get applied at boot. Here's what happenend:

 

# iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE

iptables: Invalid argument

#

 

So, you can see my problem. I've tried -j MASQ and iptables tells me it
can't find that target. I've got ipt_MASQUERADE loaded, and a mod-info shows
it's the right one for my kernel. I've also tried it with -o eth1. eth1 is
inside, eth2 is outside (eth0 is nothing as of now). Outside is DHCP or I'd
use SNAT. However, I replaced MASQUERADE with SNAT and got the same error.

 

What gives? I'm getting closer at least.

 

 

Thanks,

 

Chris Miller

Compuville Computers

www.compuville.net

 

  _____  

From: Daniel Chemko [mailto:dchemko@smgtec.com] 
Sent: Sunday, September 28, 2003 3:28 AM
To: Chris Miller
Cc: netfilter@lists.netfilter.org
Subject: Re: PPTP reviisted

 

If you want to enable conntrack for Linux you will need:

1. A Recent Kernel, I know anything later than 2.4.20 can work fine.
2. Kernel patches from pptpclient.sourceforge.net if you want the firewall
itself setting up the pptp tunnel, if not, ignore this step
3. CVS download the netfilter code from netfilter.org
4. Apply the patch-o-matic directory to your kernel sources directory like
so:
# KERNEL_DIR=/usr/src/<kerneldir> ./runme extra
5. Apply all patches that you really care for, but I would recommend
anything that doesn't fail out on your configuration.Make sure to include
the connectrack patch
6. Build the kernel with the new netfilter options turned on as modules
7. Install Kernel
8. Execute the following every time you want pptp (once per boot):
# modprobe ip_conntrack_proto_gre
# modprobe ip_nat_proto_gre
# modprobe ip_conntrack_pptp
# modprobe ip_nat_pptp

Chris Miller wrote:



I've seen a few things in the netfilter archive about PPTP, but no one has
ever really said anything about getting it to work.

 

Here's the deal: I've got a Windows box (192.168.1.10) sitting behind my
Linux firewall. On the firewall runs Debian Woody with iptables 1.2.6a. The
Linux box acts as a NAT to all the hosts behind it. Currently I forward TCP
port 1723 to 192.168.1.10, but clients cannot connect. I know it's got
something to do with GRE?

 

I saw something on Google about an ip_conntrac_pptp module, or something to
that nature, but I've not been able to find it anywhere. I'd love to compile
it and give it a try if it's made to fix this issue.

 

So could someone fill me in with what my options are as far as getting my
VPN working through my NAT? What exactly is going on?

 

 

Thanks,

 

Chris Miller

Compuville Computers

www.compuville.net

423.276.6692

 


[-- Attachment #2: Type: text/html, Size: 15094 bytes --]

Re: PPTP reviisted

[Philip Craig]

Chris Miller wrote:
> 7)       Booted new kernel. Everything seems fine. SSH in so I can apply a
> rule that for some reason didn't get applied at boot. Here's what happenend:
> 
>  
> 
> # iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE
> 
> iptables: Invalid argument

 From the help for the latest pptp-conntrack-nat.patch:

- you have to recompile your iptables userspace program since some
   structure sizes change

-- 
Philip Craig - philipc@snapgear.com - http://www.SnapGear.com
SnapGear - Custom Embedded Solutions and Security Appliances

REDIRECT incoming Port to IP

[Jon Pol]

[-- Attachment #1: Type: text/plain, Size: 286 bytes --]

Just a quick newbie Q:

I want to redirect incoming/outgoing traffic ports (1024-65535)  to a certain IP Address (192.168.0.10). that is;

incoming/outgoing traffic ---- > 203.x.x.x(destination port 1024-65535) -----> REDIRECT -----> (192.168.0.10)

any hint?

Thanks.
JP



[-- Attachment #2: Type: text/html, Size: 2310 bytes --]

Re: REDIRECT incoming Port to IP

[Jon Pol]

[-- Attachment #1: Type: text/plain, Size: 505 bytes --]

thanks. got it to work :-)
  ----- Original Message ----- 
  From: Jon Pol 
  To: netfilter@lists.netfilter.org 
  Sent: Monday, September 29, 2003 11:34 AM
  Subject: REDIRECT incoming Port to IP


  Just a quick newbie Q:

  I want to redirect incoming/outgoing traffic ports (1024-65535)  to a certain IP Address (192.168.0.10). that is;

  incoming/outgoing traffic ---- > 203.x.x.x(destination port 1024-65535) -----> REDIRECT -----> (192.168.0.10)

  any hint?

  Thanks.
  JP



[-- Attachment #2: Type: text/html, Size: 3204 bytes --]