PPTP server

Related articles
PPTP Client
Point-to-Point Tunneling Protocol
(PPTP) is a method for implementing virtual private networks. PPTP uses a control channel over TCP and a GRE tunnel operating to encapsulate PPP packets.
This entry will show you on how to create a PPTP server in Arch.
Warning
The PPTP protocol is inherently insecure. See
https://poptop.sourceforge.net/dox/protocol-security.phtml
for details.
Installation
Install
the
pptpd
package.
Configuration
Tip
Configuration examples can be found in the
/usr/share/doc/pptpd
directory.
A typical configuration may look like:
/etc/pptpd.conf
# Read man pptpd.conf, see samples in /usr/share/doc/pptpd
# and write your pptpd configuration here

# pppd options file. By default, /etc/ppp/options is used
option /etc/ppp/options.pptpd

# Server IP in local network
localip 192.168.1.2

# IP address ranges used to assign IPs to new connecting clients
# Here we define two ranges for our 192.168.1.* subnet: 234-238 and 245
remoteip 192.168.1.234-238,192.168.1.245
Now create the pppd options file, in our example this is
/etc/ppp/options.pptpd
:
/etc/ppp/options.pptpd
# Read man pppd to see the full list of available options

# The name of the local system for authentication purposes
name pptpd

# Refuse PAP, CHAP or MS-CHAP connections but accept connections with
# MS-CHAPv2 or MPPE with 128-bit encryption
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128

# Add entry to the ARP system table
proxyarp

# For the serial device to ensure exclusive access to the device
lock

# Disable BSD-Compress and Van Jacobson TCP/IP header compression
nobsdcomp
novj
novjccomp

# Disable file logging
nolog

# DNS servers for Microsoft Windows clients. Using Google's public servers here
ms-dns 8.8.8.8
ms-dns 8.8.4.4
Note
Ensure the file ends with a newline to prevent possible parsing issues.
Now create credentials file for authenticating users:
/etc/ppp/chap-secrets
# Secrets for authentication using CHAP
# client	server	secret			IP addresses
  user2         pptpd   123                     *
Now you can be authenticated with
user2
as username and
123
for password.
Create a sysctl configuration file
/etc/sysctl.d/30-ipforward.conf
and enable kernel packet forwarding that allow connecting clients to have access to your subnet (see also
Internet Share#Enable packet forwarding
):
/etc/sysctl.d/30-ipforward.conf
net.ipv4.ip_forward=1
Now apply changes to let the sysctl configuration take effect:
# sysctl --system
iptables firewall configuration
Configure your iptables settings to enable access for PPTP Clients
# Accept all packets via ppp* interfaces (for example, ppp0)
iptables -A INPUT -i ppp+ -j ACCEPT
iptables -A OUTPUT -o ppp+ -j ACCEPT

# Accept incoming connections to port 1723 (PPTP)
iptables -A INPUT -p tcp --dport 1723 -j ACCEPT

# Accept GRE packets
iptables -A INPUT -p 47 -j ACCEPT
iptables -A OUTPUT -p 47 -j ACCEPT

# Enable IP forwarding
iptables -F FORWARD
iptables -A FORWARD -j ACCEPT

# Enable NAT for eth0 on ppp* interfaces
iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE
iptables -A POSTROUTING -t nat -o ppp+ -j MASQUERADE
Note
Ensure that "eth0" is replaced with the actual ethernet interface connected to the server.
Now save the new iptables rules with:
# iptables-save > /etc/iptables/iptables.rules
To load /etc/iptables/iptables.rules automatically after boot,
enable
the
iptables.service
unit.
Read
Iptables
for more information.
UFW firewall configuration
Configure your ufw settings to enable access for PPTP Clients.
You must change default forward policy in
/etc/default/ufw
/etc/default/ufw
DEFAULT_FORWARD_POLICY="ACCEPT"
Now change
/etc/ufw/before.rules
, add following code after header and before *filter line
/etc/ufw/before.rules
# nat Table rules
*nat
:POSTROUTING ACCEPT [0:0]

# Allow traffic from clients to eth0
-A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE

# commit to apply changes
COMMIT
Allow GRE packets (protocol 47) in
/etc/ufw/before.rules
, find the line with:
# drop INVALID packets
and add rule:
/etc/ufw/before.rules
# drop INVALID packets (logs these in loglevel medium and higher)
-A ufw-before-input -p 47 -i $iface -j ACCEPT
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP
Open pptp port 1723
ufw allow 1723
Restart ufw for good measure
ufw disable
ufw enable
Start the server
Now you can
start and enable
your PPTP Server using
pptpd.service
.
Troubleshooting
As with any service, see
Systemd#Troubleshooting
to investigate errors.
Error 619 on the client side
Search for the
logwtmp
option in
/etc/pptpd.conf
and comment it out. When this is enabled,
wtmp
will be used to record client connections and disconnections.
#logwtmp
pptpd[xxxxx]: Long config file line ignored
Add a blank line at the end of
/etc/pptpd.conf
.
[1]
ppp0: ppp: compressor dropped pkt
If you have this error while a client is connected to the server, add the following script to
/etc/ppp/ip-up.d/mppefixmtu.sh
:
#!/bin/sh
CURRENT_MTU="`ip link show $1 | grep -Po '(?<=mtu )([0-9]+)'`"
FIXED_MTU="`expr $CURRENT_MTU + 4`"
ip link set $1 mtu $FIXED_MTU
Make the script
executable
.
See also:
[2]