RHEL5下PPTPVPN服务器的搭建

2010年2月5日，在农历新年来临之前，重新整理了下pptp vpn的配置文档，因为前段配置openvpn的关系，本次使用的环境同openvpn使用的一致，之前的配置未提及修改路由部分，本次更新也涉及到了修改路由，（明显感觉自己在进步，哈哈……）同时附上服务器端的关键日志信息！
openvpn配置链接地址：http://www.linuxidc.com/Linux/2010-05/25980.htm
192.168.229.201为VPN服务器内网IP；192.168.90.10为外网IP；
演示环境中服务器的eth0为虚拟机的桥接网卡，可连接公网，eth1为vm9，模拟内网；客户端的网卡也为vm9,默认不能连接公网！

[root@server1 ~]# ifconfig |grep 'inet addr'
inet addr:192.168.90.10  Bcast:192.168.90.255  Mask:255.255.255.0
inet addr:192.168.229.201  Bcast:192.168.229.255  Mask:255.255.255.0
inet addr:127.0.0.1  Mask:255.0.0.0

[root@server1 ~]#rpm -q gcc
gcc-4.1.1-52.el5
[root@server1 ~]# rpm -q ppp
ppp-2.4.4-1.el5
[root@server1 ~]wget ftp://ftp.pbone.net/mirror/ftp.sourceforge.net/pub/sourceforge/p/project/po/poptop/mppe%20module%20builder/kernel_ppp_mppe-1.0.2%20dkms-2.0.6/dkms-2.0.6-1.noarch.rpm

[root@server1 ~]#wget ftp://ftp.ntua.gr/pub/net/poptop/mppe%20module%20builder/kernel_ppp_mppe-1.0.2%20dkms-2.0.6/kernel_ppp_mppe-1.0.2-3dkms.noarch.rpm

[root@server1 ~]# rpm -ivh dkms-2.0.6-1.noarch.rpm
warning: dkms-2.0.6-1.noarch.rpm: Header V3 DSA signature: NOKEY, key ID 862acc42
Preparing...                ########################################### [100%]
1:dkms                   ########################################### [100%]

[root@server1 ~]# rpm -ivh kernel_ppp_mppe-1.0.2-3dkms.noarch.rpm
warning: kernel_ppp_mppe-1.0.2-3dkms.noarch.rpm: Header V3 DSA signature: NOKEY, key ID

862acc42
Preparing...                ########################################### [100%]
1:kernel_ppp_mppe        ########################################### [100%]

Creating symlink /var/lib/dkms/kernel_ppp_mppe/1.0.2/source ->
/usr/src/kernel_ppp_mppe-1.0.2

DKMS: add Completed.
Module build for the currently running kernel was skipped
since the kernel source for this kernel does not seem to be
installed.

[root@server1 ~]# wget http://www.sfr-fresh.com/linux/misc/pptpd-1.3.4.tar.gz
[root@server1 ~]# tar -zxvf pptpd-1.3.4.tar.gz
[root@server1 ~]# cd pptpd-1.3.4
[root@server1 pptpd-1.3.4]# ./configure --prefix=/usr/local/pptp
[root@server1 pptpd-1.3.4]# make && make install

[root@server1 pptpd-1.3.4]# ls /usr/local/pptp/
lib/   sbin/  share/
[root@server1 pptpd-1.3.4]# mkdir /usr/local/pptp/etc
[root@server1 pptpd-1.3.4]# cp samples/pptpd.conf /usr/local/pptp/etc/
[root@server1 pptpd-1.3.4]# cp samples/options.pptpd /usr/local/pptp/etc/

[root@server1 ~]# grep -v '^#' /usr/local/pptp/etc/pptpd.conf |sort -n |uniq
debug
localip 1.1.1.1
option /usr/local/pptp/etc/options.pptpd
remoteip  1.1.1.10-100

[root@server1 ~]# cat /etc/ppp/chap-secrets
# client        server secret                  IP addresses
yang （用户名）         server1.yang.com（VPN服务器的主机名）       123（密码）       *（表示所有IP

地址都可以拨号）

[root@server1 ~]# grep -v '^#' /usr/local/pptp/etc/options.pptpd |sort -n |uniq
debug
dump
lock
ms-dns 8.8.8.8
name server1.yang.com
nobsdcomp
nologfd
novj
novjccomp
proxyarp
refuse-chap
refuse-mschap
refuse-pap
require-mppe-128
require-mschap-v2

[root@server1 ~]# /usr/local/pptp/sbin/pptpd -c /usr/local/pptp/etc/pptpd.conf -o /usr/local/pptp/etc/options.pptpd
[root@server1 ~]# netstat -ntpl |grep 1723
tcp        0      0 0.0.0.0:1723                0.0.0.0:*                   LISTEN    

2585/pptpd
[root@server1 ~]# killall pptpd
[root@server1 ~]# netstat -ntpl |grep 1723
[root@server1 ~]# /usr/local/pptp/sbin/pptpd -c /usr/local/pptp/etc/pptpd.conf -o /usr/local/pptp/etc/options.pptpd

[root@server1 ~]# tail -f /var/log/messages
Jan 25 02:27:13 server1 pppd[4599]: pppd 2.4.4 started by root, uid 0
Jan 25 02:27:13 server1 pppd[4599]: Using interface ppp0
Jan 25 02:27:13 server1 pppd[4599]: Connect: ppp0 <--> /dev/pts/0
Jan 25 02:27:13 server1 pptpd[4598]: CTRL: Ignored a SET LINK INFO packet with real ACCMs!
Jan 25 02:27:13 server1 kernel: PPP MPPE Compression module registered
Jan 25 02:27:13 server1 pppd[4599]: MPPE 128-bit stateless compression enabled
Jan 25 02:27:15 server1 pppd[4599]: Cannot determine ethernet address for proxy ARP
Jan 25 02:27:15 server1 pppd[4599]: local  IP address 1.1.1.1
Jan 25 02:27:15 server1 pppd[4599]: remote IP address 1.1.1.10

[root@server1 ~]# ifconfig ppp0
ppp0      Link encap:Point-to-Point Protocol 
inet addr:1.1.1.1  P-t-P:1.1.1.10  Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1396  Metric:1
RX packets:39 errors:0 dropped:0 overruns:0 frame:0
TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:4166 (4.0 KiB)  TX bytes:326 (326.0 b)

[root@server1 ~]# cat /proc/sys/net/ipv4/ip_forward
1
[root@server1 ~]# cat iptables.sh
#!/bin/sh
iptables -F
iptables -Z
iptables -X
iptables -P INPUT ACCEPT
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -A POSTROUTING -s 1.1.1.0/24  -o eth0  -j MASQUERADE
service iptables save

C:\>ipconfig /all

Ethernet adapter 本地连接:

Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : AMD PCNET Family PCI Ethe
r
Physical Address. . . . . . . . . : 00-0C-29-E7-4C-9C
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.229.20
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.229.20

PPP adapter VPN:

Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
Physical Address. . . . . . . . . : 00-53-45-00-00-00
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 1.1.1.10
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . : 1.1.1.10
DNS Servers . . . . . . . . . . . : 8.8.8.8
8.8.8.8

C:\>ping www.g.cn

Pinging www.g.cn [203.208.37.99] with 32 bytes of data:

Reply from 203.208.37.99: bytes=32 time=53ms TTL=127
Reply from 203.208.37.99: bytes=32 time=47ms TTL=127