Re: pptp

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

On Fri, Oct 15, 2004 at 11:25:41AM -0500, K. Shantanu  wrote:
> * Jason Opperisano <opie@xxxxxxxxxxx> [041015 11:15]:
> > yes--if your are performing SNAT/MASQ for your entire internal network
> > on your gateway, it won't work.  there is a PPTP conntrack and nat module
> > in POM for this situation, but it will only compile against a 2.4 kernel.
> Yes, I am performing MASQ for entire network. Is there no way I can get
> it to work against 2.6 series? I will have a lot of troble downgrading
> the kernel. It is a live server.

i wasn't necessarily recommending that you downgrade to a 2.4
kernel--just pointing out that there's a "fancy" option available, but
it is 2.4-specific.  i am unaware of any successful ports of the PPTP
modules from POM to the 2.6 kernel.

> > one option would be to give the PPTP client a dedicated public IP and
> > perform a one-to-one SNAT/DNAT for that client and allow TCP 1723 and
> > IP protocol 47 outbound from that client and IP protocol 47 inbound to
> > that client from the PPTP server.
> Can you please give an example of this to be on safe side?  Is this something 
> like,
> * I add eth0:1 on Linux box and give it an public IP.
> * redirect all traffic to that IP from ouside to the client having pptp 
> client? Will something like below help,
> iptables -A PREROUTING -d <ext ip> -p tcp -m tcp --dport 47 -j DNAT --to-destination

i tried to point this out subtly in my first reply--but you are
confusing "IP Protocol Number 47" with TCP Port 47.  GRE is IP protocol
number 47, analogous to TCP being IP protocol number 6 or UDP being IP
protocol 17...

  iptables -A PREROUTING -d <ext ip> -p 47 \
    -j DNAT --to-destination

> iptables -A PREROUTING -d <ext ip> -p tcp -m tcp --dport 1723 -j DNAT --to-destination

you don't need to forward TCP port 1723 to the client--but you do need
SNAT rules as well...or rule.  i would do it like this:

  # new public IP for one-to-one NAT for PPTP client
  ip address add $PUBIP dev $OUTSIDE_IF

  # DNAT for PPTP client
    -j DNAT --to-destination

  # SNAT for PPTP client
  iptables -A POSTROUTING -o $OUTSIDE_IF -s
    -j SNAT --to-source $PUBIP

  # outbound filter rules for PPTP client
  iptables -A FORWARD -s -d $PPTP_SERVER \
    -p tcp --dport 1723 -j ACCEPT

  iptables -A FORWARD -s -d $PPTP_SERVER \
    -p 47 -j ACCEPT
  # inbound filter rules for PPTP client
  iptables -A FORWARD -s $PPTP_SERVER -d \
    -p 47 -j ACCEPT

and that should about cover it...unless i've some sort of heinous
mistake that someone else would be so kind as to point out...

Jason Opperisano <opie@xxxxxxxxxxx>

[Linux Netfilter Development]     [Linux Kernel Networking Development]     [Linux Networking Development]     [Linux Kernel Development]     [Linux Resources]     [LARTC]     [Bugtraq]     [Consulting]     [Free Internet Dating]     [Yosemite Forum]     [Photo]

Add to Google Powered by Linux