{ "created": "2015-12-20T19:56:39Z", "hierarchy": [ { "name": "ROOT", "type": "folder", "uri": "/ROOT" }, { "name": "PPTPD Installation", "type": "article", "uri": "PPTPD_Installation" } ], "html": "PPTPD Installation – Nikhil's Personal Wiki

PPTPD Installation

The following are my notes of installing PoPToP on example.com (RHEL5, i386)

\n

Pre-Flight Check

\n

Check if your kernel supports MPPE (Microsoft Point to Point Encryption).

\n
[root@example ~]# modprobe ppp-compress-18 && echo OK\nOK\n
\n

Usually, kernels 2.6.15 and above support MPPE

\n

Install the necessary packages

\n

First install PPP:

\n
yum install ppp\n
\n

Next install PoPToP:

\n
rpm -ivH http://poptop.sourceforge.net/yum/stable/rhel5/i386/pptpd-1.3.4-1.rhel5.1.i386.rpm\n
\n

Check if everything went well with

\n
rpm -qa pptpd -d\n
\n

Configure PPTPD

\n

You’ll configure the behaviour of your PPTP server in two locations:

\n
    \n
  • All passwords and connection params will be in /etc/ppp.
    • \n
  • The behaviour of the server itself will be controlled with
    \n/etc/pptpd.conf
    • \n
\n

Edit /etc/ppp/options.pptpd to use DNS and require encryption

\n

Configuring /etc/ppp/options.pptpd is rather easy. I only checked the file to make sure that MPPE was required for the connection, that the old-style (and insecure) PAP and CHAP was not enabled, and added the following lines:

\n
ms-dns 19.27.17.20\nms-dns 19.27.12.21\n
\n

Edit /etc/ppp/chap-secrets to manage users

\n

This is very simple too. To add a new user, add a line that looks like:

\n
# Secrets for authentication using CHAP\n# client  server  secret  IP addresses\ntomc * C@saVa\\t *\n
\n

In this case, the user tomc would have the password C@saVa\\t.

\n

Edit /etc/pptpd.conf to disburse IP addresses

\n

I only edited/added the following lines. They tell the server to sustain a maximum of 30 connections and use the remote (client) IP range 10.9.0.2 to 10.9.0.31.

\n
connections 30\n\nlocalip 19.27.18.14\nremoteip 10.9.0.2-31\n
\n

Configure logging

\n

Before starting the PPTPD daemon (how’s that for a tautology), it would be nice to log things to a file to keep track of users and diagnose connection problems. For this, we can use syslogd. Add this to daemon facility in /etc/syslogd.conf:

\n
daemon.*  /var/log/pptpd.log\n
\n

Then restart the syslog daemon:

\n
killall syslogd\n/sbin/syslogd\n
\n

Configure the local system to allow connectiong and IP forwarding

\n

Configure iptables rules

\n

I have a very restrictive set of iptables rules and needed all of these. Your mileage may vary. PPTPD uses port 1723 and protocol 47. In this snippet, my $EXTERNAL_INTERFACE variable is set to eth1.

\n
# Allow PPTP. Note: it's not _port_ 47 but _protocol_ 47 ("GRE", by Cisco)\niptables -A INPUT -i ppp+ -j ACCEPT\niptables -A OUTPUT -o $EXTERNAL_INTERFACE -j ACCEPT\n\niptables -A INPUT  -p tcp --dport 1723 -j ACCEPT\niptables -A OUTPUT -p tcp --sport 1723 -j ACCEPT\niptables -A INPUT  -p 47 -j ACCEPT\niptables -A OUTPUT -p 47 -j ACCEPT\n\niptables -A FORWARD -i ppp+ -o $EXTERNAL_INTERFACE -m state --state NEW -j ACCEPT\niptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT\niptables -A POSTROUTING -t nat -j MASQUERADE\n
\n

IP forwarding

\n

You might also have to enable IP forwarding. Check if this is already enabled by issuing:

\n
[root@example ~]# sysctl net.ipv4.ip_forward\nnet.ipv4.ip_forward = 0\n\nor\n\n[root@example ~]# cat /proc/sys/net/ipv4/ip_forward\n0\n
\n

If you see a 1, you’re good. If not, you can enable it on the fly like so:

\n
[root@example ~]# sysctl -w net.ipv4.ip_forward=1\n\nor\n\n[root@example ~]# echo 1 > /proc/sys/net/ipv4/ip_forward\n
\n

If you do this, make sure that /etc/sysctl.conf has net.ipv4.ip_forward set to 1. Then restart the network service:

\n
[root@example ~]# sysctl -p /etc/sysctl.conf\n\nor\n\n[root@example ~]# service network restart\n
\n

Start the PPTPD service (finally!)

\n
service pptpd start\n
\n

And you should be good to go. Diagnose network problems with nmap, traceroute, etc. You may also want to start it at reboot

\n
chkconfig --level 345 pptpd on\n
\n

Resources

\n

Poptop Installation guide

\n
", "id": "fb09ca54-5d6b-5ada-b668-6bde5b9f5ec3", "modified": "2026-05-28T13:06:20Z", "revisions": [ { "authorEmail": "mail@nikhil.io", "authorName": "Nikhil Anand", "date": "2026-05-28T13:06:20Z", "id": "ca705b010e954d709ed04fcd2dd63537f18b50ad", "shortId": "ca705b01", "subject": "Formatting fixes -- Claude\n", "content": "The following are my notes of installing PoPToP on **example.com** (RHEL5, i386)\n\n## Pre-Flight Check\n\nCheck if your kernel supports MPPE (Microsoft Point to Point Encryption).\n\n [root@example ~]# modprobe ppp-compress-18 && echo OK\n OK\n\nUsually, kernels 2.6.15 and above support MPPE\n\n## Install the necessary packages\n\nFirst install PPP:\n\n yum install ppp\n\nNext install PoPToP:\n\n rpm -ivH http://poptop.sourceforge.net/yum/stable/rhel5/i386/pptpd-1.3.4-1.rhel5.1.i386.rpm\n\nCheck if everything went well with\n\n rpm -qa pptpd -d\n\n## Configure PPTPD\n\nYou'll configure the behaviour of your PPTP server in two locations:\n\n* All passwords and connection params will be in `/etc/ppp`.\n* The behaviour of the server itself will be controlled with\n `/etc/pptpd.conf`\n\n### Edit /etc/ppp/options.pptpd to use DNS and require encryption\n\nConfiguring `/etc/ppp/options.pptpd` is rather easy. I only checked the file to make sure that MPPE was required for the connection, that the old-style (and insecure) PAP and CHAP was not enabled, and added the following lines:\n\n ms-dns 19.27.17.20\n ms-dns 19.27.12.21\n\n### Edit /etc/ppp/chap-secrets to manage users\n\nThis is very simple too. To add a new user, add a line that looks like:\n\n # Secrets for authentication using CHAP\n # client  server  secret  IP addresses\n tomc * C@saVa\\t *\n\nIn this case, the user `tomc` would have the password `C@saVa\\t`.\n\n### Edit /etc/pptpd.conf to disburse IP addresses\n\nI only edited/added the following lines. They tell the server to sustain a maximum of 30 connections and use the remote (client) IP range `10.9.0.2` to `10.9.0.31`.\n\n connections 30\n\n localip 19.27.18.14\n remoteip 10.9.0.2-31\n\n## Configure logging\n\nBefore starting the PPTPD daemon (how's that for a tautology), it would be nice to log things to a file to keep track of users and diagnose connection problems. For this, we can use `syslogd`. Add this to **daemon** facility in `/etc/syslogd.conf`:\n\n daemon.*  /var/log/pptpd.log\n\nThen restart the syslog daemon:\n\n killall syslogd\n /sbin/syslogd\n\n## Configure the local system to allow connectiong and IP forwarding\n\n### Configure iptables rules\n\nI have a very restrictive set of iptables rules and needed all of these. Your mileage may vary. PPTPD uses port 1723 and *protocol* 47. In this snippet, my `$EXTERNAL_INTERFACE` variable is set to `eth1`.\n\n # Allow PPTP. Note: it's not _port_ 47 but _protocol_ 47 (\"GRE\", by Cisco)\n iptables -A INPUT -i ppp+ -j ACCEPT\n iptables -A OUTPUT -o $EXTERNAL_INTERFACE -j ACCEPT\n\n iptables -A INPUT  -p tcp --dport 1723 -j ACCEPT\n iptables -A OUTPUT -p tcp --sport 1723 -j ACCEPT\n iptables -A INPUT  -p 47 -j ACCEPT\n iptables -A OUTPUT -p 47 -j ACCEPT\n\n iptables -A FORWARD -i ppp+ -o $EXTERNAL_INTERFACE -m state --state NEW -j ACCEPT\n iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT\n iptables -A POSTROUTING -t nat -j MASQUERADE\n\n### IP forwarding\n\nYou might also have to enable IP forwarding. Check if this is already enabled by issuing:\n\n [root@example ~]# sysctl net.ipv4.ip_forward\n net.ipv4.ip_forward = 0\n\n or\n\n [root@example ~]# cat /proc/sys/net/ipv4/ip_forward\n 0\n\nIf you see a **1**, you're good. If not, you can enable it on the fly like so:\n\n [root@example ~]# sysctl -w net.ipv4.ip_forward=1\n\n or\n\n [root@example ~]# echo 1 > /proc/sys/net/ipv4/ip_forward\n\nIf you do this, make sure that `/etc/sysctl.conf` has `net.ipv4.ip_forward` set to **1**. Then restart the network service:\n\n [root@example ~]# sysctl -p /etc/sysctl.conf\n\n or\n\n [root@example ~]# service network restart\n\n## Start the PPTPD service (finally!)\n\n service pptpd start\n\nAnd you should be good to go. Diagnose network problems with nmap, traceroute, etc. You may also want to start it at reboot\n\n chkconfig --level 345 pptpd on\n\n## Resources\n\n[Poptop Installation guide](http://poptop.sourceforge.net/dox/howto1.html)\n" }, { "authorEmail": "mail@nikhil.io", "authorName": "Nikhil Anand", "date": "2026-01-13T18:47:28Z", "id": "2436477560f26e23d00a24add1cbfeafdca4af78", "shortId": "24364775", "subject": "No compression\n", "content": "The following are my notes of installing PoPToP on **example.com** (RHEL5, i386)\n\nPre-Flight Check\n----------------\n\nCheck if your kernel supports MPPE (Microsoft Point to Point\nEncryption).\n\n [root@example ~]# modprobe ppp-compress-18 && echo OK \n OK\n\nUsually, kernels 2.6.15 and above support MPPE\n\nInstall the necessary packages\n------------------------------\n\nFirst install PPP:\n\n yum install ppp\n\nNext install PoPToP:\n\n rpm -ivH http://poptop.sourceforge.net/yum/stable/rhel5/i386/pptpd-1.3.4-1.rhel5.1.i386.rpm\n\nCheck if everything went well with\n\n rpm -qa pptpd -d\n\nConfigure PPTPD\n---------------\n\nYou'll configure the behaviour of your PPTP server in two locations:\n\n* All passwords and connection params will be in `/etc/ppp`.\n* The behaviour of the server itself will be controlled with\n `/etc/pptpd.conf`\n\n### Edit /etc/ppp/options.pptpd to use DNS and require encryption\n\nConfiguring `/etc/ppp/options.pptpd` is rather easy. I only checked the\nfile to make sure that MPPE was required for the connection, that the\nold-style (and insecure) PAP and CHAP was not enabled, and added the\nfollowing lines:\n\n ms-dns 19.27.17.20 \n ms-dns 19.27.12.21\n\n### Edit /etc/ppp/chap-secrets to manage users\n\nThis is very simple too. To add a new user, add a line that looks like:\n\n # Secrets for authentication using CHAP \n # client  server  secret  IP addresses \n tomc * C@saVa\\t *\n\nIn this case, the user `tomc` would have the password `C@saVa\\t`.\n\n### Edit /etc/pptpd.conf to disburse IP addresses\n\nI only edited/added the following lines. They tell the server to sustain\na maximum of 30 connections and use the remote (client) IP range\n`10.9.0.2` to `10.9.0.31`.\n\n connections 30 \n \n localip 19.27.18.14 \n remoteip 10.9.0.2-31\n\nConfigure logging\n-----------------\n\nBefore starting the PPTPD daemon (how's that for a tautology), it would\nbe nice to log things to a file to keep track of users and diagnose\nconnection problems. For this, we can use `syslogd`. Add this to\n**daemon** facility in `/etc/syslogd.conf`:\n\n daemon.*  /var/log/pptpd.log \n\nThen restart the syslog daemon:\n\n killall syslogd \n /sbin/syslogd\n\nConfigure the local system to allow connectiong and IP forwarding\n-----------------------------------------------------------------\n\n### Configure iptables rules\n\nI have a very restrictive set of iptables rules and needed all of these.\nYour mileage may vary. PPTPD uses port 1723 and *protocol* 47. In this\nsnippet, my `$EXTERNAL_INTERFACE` variable is set to `eth1`.\n\n # Allow PPTP. Note: it's not _port_ 47 but _protocol_ 47 (\"GRE\", by Cisco) \n iptables -A INPUT -i ppp+ -j ACCEPT \n iptables -A OUTPUT -o $EXTERNAL_INTERFACE -j ACCEPT \n \n iptables -A INPUT  -p tcp --dport 1723 -j ACCEPT \n iptables -A OUTPUT -p tcp --sport 1723 -j ACCEPT \n iptables -A INPUT  -p 47 -j ACCEPT \n iptables -A OUTPUT -p 47 -j ACCEPT \n \n iptables -A FORWARD -i ppp+ -o $EXTERNAL_INTERFACE -m state --state NEW -j ACCEPT \n iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT \n iptables -A POSTROUTING -t nat -j MASQUERADE\n\n### IP forwarding\n\nYou might also have to enable IP forwarding. Check if this is already\nenabled by issuing:\n\n [root@example ~]# sysctl net.ipv4.ip_forward \n net.ipv4.ip_forward = 0 \n \n or \n \n [root@example ~]# cat /proc/sys/net/ipv4/ip_forward \n 0 \n\nIf you see a **1**, you're good. If not, you can enable it on the fly\nlike so:\n\n [root@example ~]# sysctl -w net.ipv4.ip_forward=1 \n \n or \n \n [root@example ~]# echo 1 > /proc/sys/net/ipv4/ip_forward \n \n\nIf you do this, make sure that `/etc/sysctl.conf` has\n`net.ipv4.ip_forward` set to **1**. Then restart the network service:\n\n [root@example ~]# sysctl -p /etc/sysctl.conf \n \n or \n \n [root@example ~]# service network restart\n\nStart the PPTPD service (finally!)\n----------------------------------\n\n service pptpd start\n\nAnd you should be good to go. Diagnose network problems with nmap,\ntraceroute, etc. You may also want to start it at reboot\n\n chkconfig --level 345 pptpd on\n\nResources\n---------\n\n[Poptop Installation guide](http://poptop.sourceforge.net/dox/howto1.html)\n\n" }, { "authorEmail": "mail@nikhil.io", "authorName": "Nikhil Anand", "date": "2015-12-27T07:27:56Z", "id": "1aa29105a45aa67523ffb61e73bcc415f935a47e", "shortId": "1aa29105", "subject": "Fix Markdown conversion\n\nSaw half a season of The Office\n", "content": "The following are my notes of installing PoPToP on **example.com** (RHEL5, i386)\n\nPre-Flight Check\n----------------\n\nCheck if your kernel supports MPPE (Microsoft Point to Point\nEncryption).\n\n [root@example ~]# modprobe ppp-compress-18 && echo OK \n OK\n\nUsually, kernels 2.6.15 and above support MPPE\n\nInstall the necessary packages\n------------------------------\n\nFirst install PPP:\n\n yum install ppp\n\nNext install PoPToP:\n\n rpm -ivH http://poptop.sourceforge.net/yum/stable/rhel5/i386/pptpd-1.3.4-1.rhel5.1.i386.rpm\n\nCheck if everything went well with\n\n rpm -qa pptpd -d\n\nConfigure PPTPD\n---------------\n\nYou'll configure the behaviour of your PPTP server in two locations:\n\n* All passwords and connection params will be in `/etc/ppp`.\n* The behaviour of the server itself will be controlled with\n `/etc/pptpd.conf`\n\n### Edit /etc/ppp/options.pptpd to use DNS and require encryption\n\nConfiguring `/etc/ppp/options.pptpd` is rather easy. I only checked the\nfile to make sure that MPPE was required for the connection, that the\nold-style (and insecure) PAP and CHAP was not enabled, and added the\nfollowing lines:\n\n ms-dns 19.27.17.20 \n ms-dns 19.27.12.21\n\n### Edit /etc/ppp/chap-secrets to manage users\n\nThis is very simple too. To add a new user, add a line that looks like:\n\n # Secrets for authentication using CHAP \n # client  server  secret  IP addresses \n tomc * C@saVa\\t *\n\nIn this case, the user `tomc` would have the password `C@saVa\\t`.\n\n### Edit /etc/pptpd.conf to disburse IP addresses\n\nI only edited/added the following lines. They tell the server to sustain\na maximum of 30 connections and use the remote (client) IP range\n`10.9.0.2` to `10.9.0.31`.\n\n connections 30 \n \n localip 19.27.18.14 \n remoteip 10.9.0.2-31\n\nConfigure logging\n-----------------\n\nBefore starting the PPTPD daemon (how's that for a tautology), it would\nbe nice to log things to a file to keep track of users and diagnose\nconnection problems. For this, we can use `syslogd`. Add this to\n**daemon** facility in `/etc/syslogd.conf`:\n\n daemon.*  /var/log/pptpd.log \n\nThen restart the syslog daemon:\n\n killall syslogd \n /sbin/syslogd\n\nConfigure the local system to allow connectiong and IP forwarding\n-----------------------------------------------------------------\n\n### Configure iptables rules\n\nI have a very restrictive set of iptables rules and needed all of these.\nYour mileage may vary. PPTPD uses port 1723 and *protocol* 47. In this\nsnippet, my `$EXTERNAL_INTERFACE` variable is set to `eth1`.\n\n # Allow PPTP. Note: it's not _port_ 47 but _protocol_ 47 (\"GRE\", by Cisco) \n iptables -A INPUT -i ppp+ -j ACCEPT \n iptables -A OUTPUT -o $EXTERNAL_INTERFACE -j ACCEPT \n \n iptables -A INPUT  -p tcp --dport 1723 -j ACCEPT \n iptables -A OUTPUT -p tcp --sport 1723 -j ACCEPT \n iptables -A INPUT  -p 47 -j ACCEPT \n iptables -A OUTPUT -p 47 -j ACCEPT \n \n iptables -A FORWARD -i ppp+ -o $EXTERNAL_INTERFACE -m state --state NEW -j ACCEPT \n iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT \n iptables -A POSTROUTING -t nat -j MASQUERADE\n\n### IP forwarding\n\nYou might also have to enable IP forwarding. Check if this is already\nenabled by issuing:\n\n [root@example ~]# sysctl net.ipv4.ip_forward \n net.ipv4.ip_forward = 0 \n \n or \n \n [root@example ~]# cat /proc/sys/net/ipv4/ip_forward \n 0 \n\nIf you see a **1**, you're good. If not, you can enable it on the fly\nlike so:\n\n [root@example ~]# sysctl -w net.ipv4.ip_forward=1 \n \n or \n \n [root@example ~]# echo 1 > /proc/sys/net/ipv4/ip_forward \n \n\nIf you do this, make sure that `/etc/sysctl.conf` has\n`net.ipv4.ip_forward` set to **1**. Then restart the network service:\n\n [root@example ~]# sysctl -p /etc/sysctl.conf \n \n or \n \n [root@example ~]# service network restart\n\nStart the PPTPD service (finally!)\n----------------------------------\n\n service pptpd start\n\nAnd you should be good to go. Diagnose network problems with nmap,\ntraceroute, etc. You may also want to start it at reboot\n\n chkconfig --level 345 pptpd on\n\nResources\n---------\n\n[Poptop Installation guide](http://poptop.sourceforge.net/dox/howto1.html)\n\n" }, { "authorEmail": "mail@nikhil.io", "authorName": "Nikhil Anand", "date": "2015-12-21T02:30:47Z", "id": "d658e80d1ecb97b196531c7b15a0f9af709c05de", "shortId": "d658e80d", "subject": "Incremental\n", "content": "The following are my notes of installing PoPToP on **example.com**\n(RHEL5, i386)\n\nPre-Flight Check\n----------------\n\nCheck if your kernel supports MPPE (Microsoft Point to Point\nEncryption).\n\n` [root@example ~]# modprobe ppp-compress-18 && echo OK` \n` OK`\n\nUsually, kernels 2.6.15 and above support MPPE\n\nInstall the necessary packages\n------------------------------\n\nFirst install PPP:\n\n` yum install ppp`\n\nNext install PoPToP:\n\n`  rpm -ivH `[`http://poptop.sourceforge.net/yum/stable/rhel5/i386/pptpd-1.3.4-1.rhel5.1.i386.rpm`](http://poptop.sourceforge.net/yum/stable/rhel5/i386/pptpd-1.3.4-1.rhel5.1.i386.rpm)\n\nCheck if everything went well with\n\n` rpm -qa pptpd -d`\n\nConfigure PPTPD\n---------------\n\nYou'll configure the behaviour of your PPTP server in two locations:\n\n- All passwords and connection params will be in `/etc/ppp`.\n- The behaviour of the server itself will be controlled with\n `/etc/pptpd.conf`\n\n### Edit /etc/ppp/options.pptpd to use DNS and require encryption\n\nConfiguring `/etc/ppp/options.pptpd` is rather easy. I only checked the\nfile to make sure that MPPE was required for the connection, that the\nold-style (and insecure) PAP and CHAP was not enabled, and added the\nfollowing lines:\n\n` ms-dns 19.27.17.20` \n` ms-dns 19.27.12.21`\n\n### Edit /etc/ppp/chap-secrets to manage users\n\nThis is very simple too. To add a new user, add a line that looks like:\n\n` # Secrets for authentication using CHAP` \n` # client  server  secret  IP addresses` \n` tomc * C@saVa\\t *`\n\nIn this case, the user `tomc` would have the password `C@saVa\\t`.\n\n### Edit /etc/pptpd.conf to disburse IP addresses\n\nI only edited/added the following lines. They tell the server to sustain\na maximum of 30 connections and use the remote (client) IP range\n`10.9.0.2` to `10.9.0.31`.\n\n` connections 30` \n` ` \n` localip 19.27.18.14` \n` remoteip 10.9.0.2-31`\n\nConfigure logging\n-----------------\n\nBefore starting the PPTPD daemon (how's that for a tautology), it would\nbe nice to log things to a file to keep track of users and diagnose\nconnection problems. For this, we can use `syslogd`. Add this to\n**daemon** facility in `/etc/syslogd.conf`:\n\n` daemon.*  /var/log/pptpd.log` \n` `\n\nThen restart the syslog daemon:\n\n` killall syslogd` \n` /sbin/syslogd`\n\nConfigure the local system to allow connectiong and IP forwarding\n-----------------------------------------------------------------\n\n### Configure iptables rules\n\nI have a very restrictive set of iptables rules and needed all of these.\nYour mileage may vary. PPTPD uses port 1723 and *protocol* 47. In this\nsnippet, my `$EXTERNAL_INTERFACE` variable is set to `eth1`.\n\n` # Allow PPTP. Note: it's not _port_ 47 but _protocol_ 47 (\"GRE\", by Cisco)` \n` iptables -A INPUT -i ppp+ -j ACCEPT` \n` iptables -A OUTPUT -o $EXTERNAL_INTERFACE -j ACCEPT` \n` ` \n` iptables -A INPUT  -p tcp --dport 1723 -j ACCEPT` \n` iptables -A OUTPUT -p tcp --sport 1723 -j ACCEPT` \n` iptables -A INPUT  -p 47 -j ACCEPT` \n` iptables -A OUTPUT -p 47 -j ACCEPT` \n` ` \n` iptables -A FORWARD -i ppp+ -o $EXTERNAL_INTERFACE -m state --state NEW -j ACCEPT` \n` iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT` \n` iptables -A POSTROUTING -t nat -j MASQUERADE`\n\n### IP forwarding\n\nYou might also have to enable IP forwarding. Check if this is already\nenabled by issuing:\n\n` [root@example ~]# sysctl net.ipv4.ip_forward` \n` net.ipv4.ip_forward = 0` \n` ` \n` or` \n` ` \n` [root@example ~]# cat /proc/sys/net/ipv4/ip_forward` \n` 0` \n\nIf you see a **1**, you're good. If not, you can enable it on the fly\nlike so:\n\n` [root@example ~]# sysctl -w net.ipv4.ip_forward=1` \n` ` \n` or` \n` ` \n` [root@example ~]# echo 1 > /proc/sys/net/ipv4/ip_forward` \n` `\n\nIf you do this, make sure that `/etc/sysctl.conf` has\n`net.ipv4.ip_forward` set to **1**. Then restart the network service:\n\n` [root@example ~]# sysctl -p /etc/sysctl.conf` \n` ` \n` or` \n` ` \n` [root@example ~]# service network restart`\n\nStart the PPTPD service (finally!)\n----------------------------------\n\n` service pptpd start`\n\nAnd you should be good to go. Diagnose network problems with nmap,\ntraceroute, etc. You may also want to start it at reboot\n\n` chkconfig --level 345 pptpd on`\n\nResources\n---------\n\n[Poptop Installation\nguide](http://poptop.sourceforge.net/dox/howto1.html)\n\n\n\n\n" }, { "authorEmail": "mail@nikhil.io", "authorName": "Nikhil Anand", "date": "2015-12-20T19:56:39Z", "id": "b822c3281d3c847a0468884f94b0163719c1932b", "shortId": "b822c328", "subject": "PPTPD Installation : First Draft\n", "content": "The following are my notes of installing PoPToP on **example.com**\n(RHEL5, i386)\n\nPre-Flight Check\n----------------\n\nCheck if your kernel supports MPPE (Microsoft Point to Point\nEncryption).\n\n` [root@example ~]# modprobe ppp-compress-18 && echo OK` \n` OK`\n\nUsually, kernels 2.6.15 and above support MPPE\n\nInstall the necessary packages\n------------------------------\n\nFirst install PPP:\n\n` yum install ppp`\n\nNext install PoPToP:\n\n`  rpm -ivH `[`http://poptop.sourceforge.net/yum/stable/rhel5/i386/pptpd-1.3.4-1.rhel5.1.i386.rpm`](http://poptop.sourceforge.net/yum/stable/rhel5/i386/pptpd-1.3.4-1.rhel5.1.i386.rpm)\n\nCheck if everything went well with\n\n` rpm -qa pptpd -d`\n\nConfigure PPTPD\n---------------\n\nYou'll configure the behaviour of your PPTP server in two locations:\n\n- All passwords and connection params will be in `/etc/ppp`.\n- The behaviour of the server itself will be controlled with\n `/etc/pptpd.conf`\n\n### Edit /etc/ppp/options.pptpd to use DNS and require encryption\n\nConfiguring `/etc/ppp/options.pptpd` is rather easy. I only checked the\nfile to make sure that MPPE was required for the connection, that the\nold-style (and insecure) PAP and CHAP was not enabled, and added the\nfollowing lines:\n\n` ms-dns 19.27.17.20` \n` ms-dns 19.27.12.21`\n\n### Edit /etc/ppp/chap-secrets to manage users\n\nThis is very simple too. To add a new user, add a line that looks like:\n\n` # Secrets for authentication using CHAP` \n` # client  server  secret  IP addresses` \n` tomc * C@saVa\\t *`\n\nIn this case, the user `tomc` would have the password `C@saVa\\t`.\n\n### Edit /etc/pptpd.conf to disburse IP addresses\n\nI only edited/added the following lines. They tell the server to sustain\na maximum of 30 connections and use the remote (client) IP range\n`10.9.0.2` to `10.9.0.31`.\n\n` connections 30` \n` ` \n` localip 19.27.18.14` \n` remoteip 10.9.0.2-31`\n\nConfigure logging\n-----------------\n\nBefore starting the PPTPD daemon (how's that for a tautology), it would\nbe nice to log things to a file to keep track of users and diagnose\nconnection problems. For this, we can use `syslogd`. Add this to\n**daemon** facility in `/etc/syslogd.conf`:\n\n` daemon.*  /var/log/pptpd.log` \n` `\n\nThen restart the syslog daemon:\n\n` killall syslogd` \n` /sbin/syslogd`\n\nConfigure the local system to allow connectiong and IP forwarding\n-----------------------------------------------------------------\n\n### Configure iptables rules\n\nI have a very restrictive set of iptables rules and needed all of these.\nYour mileage may vary. PPTPD uses port 1723 and *protocol* 47. In this\nsnippet, my `$EXTERNAL_INTERFACE` variable is set to `eth1`.\n\n` # Allow PPTP. Note: it's not _port_ 47 but _protocol_ 47 (\"GRE\", by Cisco)` \n` iptables -A INPUT -i ppp+ -j ACCEPT` \n` iptables -A OUTPUT -o $EXTERNAL_INTERFACE -j ACCEPT` \n` ` \n` iptables -A INPUT  -p tcp --dport 1723 -j ACCEPT` \n` iptables -A OUTPUT -p tcp --sport 1723 -j ACCEPT` \n` iptables -A INPUT  -p 47 -j ACCEPT` \n` iptables -A OUTPUT -p 47 -j ACCEPT` \n` ` \n` iptables -A FORWARD -i ppp+ -o $EXTERNAL_INTERFACE -m state --state NEW -j ACCEPT` \n` iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT` \n` iptables -A POSTROUTING -t nat -j MASQUERADE`\n\n### IP forwarding\n\nYou might also have to enable IP forwarding. Check if this is already\nenabled by issuing:\n\n` [root@example ~]# sysctl net.ipv4.ip_forward` \n` net.ipv4.ip_forward = 0` \n` ` \n` or` \n` ` \n` [root@example ~]# cat /proc/sys/net/ipv4/ip_forward` \n` 0` \n\nIf you see a **1**, you're good. If not, you can enable it on the fly\nlike so:\n\n` [root@example ~]# sysctl -w net.ipv4.ip_forward=1` \n` ` \n` or` \n` ` \n` [root@example ~]# echo 1 > /proc/sys/net/ipv4/ip_forward` \n` `\n\nIf you do this, make sure that `/etc/sysctl.conf` has\n`net.ipv4.ip_forward` set to **1**. Then restart the network service:\n\n` [root@example ~]# sysctl -p /etc/sysctl.conf` \n` ` \n` or` \n` ` \n` [root@example ~]# service network restart`\n\nStart the PPTPD service (finally!)\n----------------------------------\n\n` service pptpd start`\n\nAnd you should be good to go. Diagnose network problems with nmap,\ntraceroute, etc. You may also want to start it at reboot\n\n` chkconfig --level 345 pptpd on`\n\nResources\n---------\n\n[Poptop Installation\nguide](http://poptop.sourceforge.net/dox/howto1.html)\n\n[Category:Nikhil's Notes](Category:Nikhil's_Notes \"wikilink\")\n[Category:Installation Logs](Category:Installation_Logs \"wikilink\")\n[Category:From a past sysadmin\nlife](Category:From_a_past_sysadmin_life \"wikilink\")\n" } ], "sizeInBytes": 4121, "source": "The following are my notes of installing PoPToP on **example.com** (RHEL5, i386)\n\n## Pre-Flight Check\n\nCheck if your kernel supports MPPE (Microsoft Point to Point Encryption).\n\n [root@example ~]# modprobe ppp-compress-18 && echo OK\n OK\n\nUsually, kernels 2.6.15 and above support MPPE\n\n## Install the necessary packages\n\nFirst install PPP:\n\n yum install ppp\n\nNext install PoPToP:\n\n rpm -ivH http://poptop.sourceforge.net/yum/stable/rhel5/i386/pptpd-1.3.4-1.rhel5.1.i386.rpm\n\nCheck if everything went well with\n\n rpm -qa pptpd -d\n\n## Configure PPTPD\n\nYou'll configure the behaviour of your PPTP server in two locations:\n\n* All passwords and connection params will be in `/etc/ppp`.\n* The behaviour of the server itself will be controlled with\n `/etc/pptpd.conf`\n\n### Edit /etc/ppp/options.pptpd to use DNS and require encryption\n\nConfiguring `/etc/ppp/options.pptpd` is rather easy. I only checked the file to make sure that MPPE was required for the connection, that the old-style (and insecure) PAP and CHAP was not enabled, and added the following lines:\n\n ms-dns 19.27.17.20\n ms-dns 19.27.12.21\n\n### Edit /etc/ppp/chap-secrets to manage users\n\nThis is very simple too. To add a new user, add a line that looks like:\n\n # Secrets for authentication using CHAP\n # client  server  secret  IP addresses\n tomc * C@saVa\\t *\n\nIn this case, the user `tomc` would have the password `C@saVa\\t`.\n\n### Edit /etc/pptpd.conf to disburse IP addresses\n\nI only edited/added the following lines. They tell the server to sustain a maximum of 30 connections and use the remote (client) IP range `10.9.0.2` to `10.9.0.31`.\n\n connections 30\n\n localip 19.27.18.14\n remoteip 10.9.0.2-31\n\n## Configure logging\n\nBefore starting the PPTPD daemon (how's that for a tautology), it would be nice to log things to a file to keep track of users and diagnose connection problems. For this, we can use `syslogd`. Add this to **daemon** facility in `/etc/syslogd.conf`:\n\n daemon.*  /var/log/pptpd.log\n\nThen restart the syslog daemon:\n\n killall syslogd\n /sbin/syslogd\n\n## Configure the local system to allow connectiong and IP forwarding\n\n### Configure iptables rules\n\nI have a very restrictive set of iptables rules and needed all of these. Your mileage may vary. PPTPD uses port 1723 and *protocol* 47. In this snippet, my `$EXTERNAL_INTERFACE` variable is set to `eth1`.\n\n # Allow PPTP. Note: it's not _port_ 47 but _protocol_ 47 (\"GRE\", by Cisco)\n iptables -A INPUT -i ppp+ -j ACCEPT\n iptables -A OUTPUT -o $EXTERNAL_INTERFACE -j ACCEPT\n\n iptables -A INPUT  -p tcp --dport 1723 -j ACCEPT\n iptables -A OUTPUT -p tcp --sport 1723 -j ACCEPT\n iptables -A INPUT  -p 47 -j ACCEPT\n iptables -A OUTPUT -p 47 -j ACCEPT\n\n iptables -A FORWARD -i ppp+ -o $EXTERNAL_INTERFACE -m state --state NEW -j ACCEPT\n iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT\n iptables -A POSTROUTING -t nat -j MASQUERADE\n\n### IP forwarding\n\nYou might also have to enable IP forwarding. Check if this is already enabled by issuing:\n\n [root@example ~]# sysctl net.ipv4.ip_forward\n net.ipv4.ip_forward = 0\n\n or\n\n [root@example ~]# cat /proc/sys/net/ipv4/ip_forward\n 0\n\nIf you see a **1**, you're good. If not, you can enable it on the fly like so:\n\n [root@example ~]# sysctl -w net.ipv4.ip_forward=1\n\n or\n\n [root@example ~]# echo 1 > /proc/sys/net/ipv4/ip_forward\n\nIf you do this, make sure that `/etc/sysctl.conf` has `net.ipv4.ip_forward` set to **1**. Then restart the network service:\n\n [root@example ~]# sysctl -p /etc/sysctl.conf\n\n or\n\n [root@example ~]# service network restart\n\n## Start the PPTPD service (finally!)\n\n service pptpd start\n\nAnd you should be good to go. Diagnose network problems with nmap, traceroute, etc. You may also want to start it at reboot\n\n chkconfig --level 345 pptpd on\n\n## Resources\n\n[Poptop Installation guide](http://poptop.sourceforge.net/dox/howto1.html)\n", "title": "PPTPD Installation", "untracked": false, "uri": "/PPTPD_Installation", "relativePath": "PPTPD Installation.md" }